C2 JIT incorrectly executes "if" block despite condition being false in a loop with integer underflow

XMLWordPrintable

      ADDITIONAL SYSTEM INFORMATION :
      Software:
          System Software Overview:
            System Version: Ubuntu 22.04.4 LTS
            Kernel Version: 4.15.0-45-generic
            Boot Volume: overlay
            Boot Mode: Legacy BIOS
            Computer Name: 899309ef3feb
            User Name: root
            Time since boot: 21 weeks, 2 days, 6 hours, 47 minutes

      Hardware:
          Hardware Overview:
            Model: Unknown
            Model Identifier: Unknown
            Chip: Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
            Total Number of Cores: 40 (10 physical x 2 logical)
            Memory: 125Gi
            System Firmware Version: Unknown
            

      A DESCRIPTION OF THE PROBLEM :
      I have identified a serious correctness bug in the C2 JIT compiler involving a loop with an integer induction variable that undergoes underflow/overflow.

      The code contains an if statement with the condition ((i > 999) && (i < 10000)).
      However, when running on HotSpot, the body of the if statement is executed when i is -2147483000.
      Since -2147483000 is clearly NOT greater than 999, the body should not be executed.

      This suggests that the C2 optimizer (likely during Loop Predication, Range Check Elimination, or Induction Variable analysis) incorrectly removed the check or miscalculated the control flow graph, failing to account for the semantics of integer underflow correctly.

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      1. Compile the provided Bug.java.
      2. Run with java -Xcomp Bug.

      ---------- BEGIN SOURCE ----------
      public class Bug {
          public static void main(String[] args) {
              for (int i = 0, j = 0; j < 2; i -= 1000) {
                  if ((i > 999) && (i < 10000)) {
                      j++;
                      System.out.println("#" + j + ' ' + i);
                  }
              }
          }
      }
      ---------- END SOURCE ----------

      FREQUENCY :
      ALWAYS

            Assignee:
            Unassigned
            Reporter:
            Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: