We discovered an internal error in the HotSpot JVM (C2 Compiler) using a fuzzing tool. The issue manifests when executing a specific switch statement inside a loop that runs frequently enough to trigger JIT compilation.

XMLWordPrintable

      ADDITIONAL SYSTEM INFORMATION :
      Software:
          System Software Overview:
            System Version: Ubuntu 22.04.4 LTS
            Kernel Version: 4.15.0-45-generic
            Boot Volume: overlay
            Boot Mode: Legacy BIOS
            Computer Name: 899309ef3feb
            User Name: root
            Time since boot: 21 weeks, 2 days, 6 hours, 47 minutes

      Hardware:
          Hardware Overview:
            Model: Unknown
            Model Identifier: Unknown
            Chip: Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
            Total Number of Cores: 40 (10 physical x 2 logical)
            Memory: 125Gi
            System Firmware Version: Unknown

      A DESCRIPTION OF THE PROBLEM :
      The test case involves a simple for loop (iterating from 10 to 50) and a switch statement on the value i * 5. Notably, the logic creates a scenario where most case labels are mathematically unreachable given the loop bounds (e.g., case 25 requires i=5, but i starts at 10).

      When running this code on HotSpot, the JVM outputs an unexpected internal error message:
      Default case invoked for: opcode = 79, "Con"

      This error message suggests an unhandled state in the C2 compiler's internal logic. Specifically, opcode = 79 corresponds to Op_Con (Constant Node) in the C2 ideal graph. It appears that during the optimization or matching phase (likely while attempting to eliminate dead paths or fold constants in the switch), the compiler encounters a Constant node in a context where it is not expected, hitting a default fallback case in the underlying C++ implementation.

      In contrast, when running the same program on the OpenJ9 JVM, the execution completes successfully with no output, which is the expected behavior.

      REGRESSION : Java version that customer using for 8u472



      REGRESSION : Last worked in version 8u472

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      1. Compile the source code: javac Test.java
      2. Run the class with HotSpot JVM: java -Xcomp Test

      ---------- BEGIN SOURCE ----------
      public class Test {
          public static int test() {
              int res = 0;
              for (int i = 10; i < 50; ++i) {
                  switch (i * 5) {
                      case 25 :
                      case 40 :
                      case 101 :
                          return 42;
                      case 45 :
                      case 51 :
                      case 60 :
                          res++;
                          break;
                  }
              }
              return res;
          }

          public static void main(String[] args) {
              for (int i = 0; i < 100000; ++i) {
                  test();
              }
          }
      }
      ---------- END SOURCE ----------

      FREQUENCY :
      ALWAYS

            Assignee:
            Unassigned
            Reporter:
            Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated: