jdk icon indicating copy to clipboard operation
jdk copied to clipboard
verified publisher icon openjdk

8370200: Crash: assert(outer->outcnt() >= phis + 2 - be_loads && outer->outcnt() <= phis + 2 + stores + 1) failed: only phis

Open rwestrel opened this issue 2 months ago • 10 comments

The crash occurs because verification code expects the inner and outer loop of a loop strip mining nest to have the same number of phis but, in this case, the inner loop has one more memory phis than the outer loop.

  1. After OuterStripMinedLoopNode::adjust_strip_mined_loop, inner and outer loops have the same number of phis, as expected.
 309  MergeMem  === _ 1 306 1 1 284  [[ 429 ]]  { - - N284:instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow] }  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=205 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 248  OuterStripMinedLoop  === 248 321 247  [[ 248 249 428 429 430 ]] 
 429  Phi  === 248 309 205  [[ 93 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 430  Phi  === 248 306 121  [[ 94 ]]  #memory  Memory: @instptr:TestMismatchedMemoryPhis:BotPTR+16,iid=bot, name=l, idx=4; !orig=94 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 249  CountedLoop  === 249 248 197  [[ 249 119 96 93 94 ]] inner stride: 1  strip mined !orig=[223],[91] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  93  Phi  === 249 429 205  [[ 117 97 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  94  Phi  === 249 430 121  [[ 97 ]]  #memory  Memory: @instptr:TestMismatchedMemoryPhis:BotPTR+16,iid=bot, name=l, idx=4; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  1. Then PhiNode::Ideal runs for 429 and pushed the MergeMem 309 through the outer loop phi:
 248  OuterStripMinedLoop  === 248 321 247  [[ 248 249 428 429 430 444 446 ]] 
 430  Phi  === 248 306 121  [[ 94 ]]  #memory  Memory: @instptr:TestMismatchedMemoryPhis:BotPTR+16,iid=bot, name=l, idx=4; !orig=94 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 444  Phi  === 248 306 121  [[ 445 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=429,93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 446  Phi  === 248 284 170  [[ 445 ]]  #memory  Memory: @instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow], name=detailMessage, idx=5; !orig=444,429,93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 445  MergeMem  === _ 1 444 1 1 446  [[ 93 ]]  { - - N446:instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow] }  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=[429],93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 249  CountedLoop  === 249 248 197  [[ 249 119 96 93 94 ]] inner stride: 1  strip mined !orig=[223],[91] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  93  Phi  === 249 445 205  [[ 117 97 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  94  Phi  === 249 430 121  [[ 97 ]]  #memory  Memory: @instptr:TestMismatchedMemoryPhis:BotPTR+16,iid=bot, name=l, idx=4; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  1. PhiNode::Identity runs for 430 and finds that it can be replace by 429: the non bottom memory phi 430 can be replaced by the bottom memory 429 that has the same inputs.
 248  OuterStripMinedLoop  === 248 321 247  [[ 248 249 428 446 444 ]] 
 446  Phi  === 248 284 170  [[ 445 ]]  #memory  Memory: @instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow], name=detailMessage, idx=5; !orig=444,[429],93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 444  Phi  === 248 306 121  [[ 445 94 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=[429],93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 445  MergeMem  === _ 1 444 1 1 446  [[ 93 ]]  { - - N446:instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow] }  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=[429],93 !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 249  CountedLoop  === 249 248 197  [[ 249 119 96 93 94 ]] inner stride: 1  strip mined !orig=[223],[91] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  93  Phi  === 249 445 205  [[ 117 97 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  94  Phi  === 249 444 121  [[ 97 ]]  #memory  Memory: @instptr:TestMismatchedMemoryPhis:BotPTR+16,iid=bot, name=l, idx=4; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  1. PhiNode::Ideal runs for 93 and pushed the MergeMem through that Phi:
 248  OuterStripMinedLoop  === 248 321 247  [[ 248 249 428 446 444 ]] 
 446  Phi  === 248 284 170  [[ 453 ]]  #memory  Memory: @instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow], name=detailMessage, idx=5; !orig=444,[429],[93] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 444  Phi  === 248 306 121  [[ 451 94 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=[429],[93] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

 249  CountedLoop  === 249 248 197  [[ 249 119 96 453 94 451 ]] inner stride: 1  strip mined !orig=[223],[91] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 453  Phi  === 249 446 170  [[ 452 ]]  #memory  Memory: @instptr:java/lang/Throwable (java/io/Serializable):BotPTR+20,iid=bot [narrow], name=detailMessage, idx=5; !orig=451,[93] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
  94  Phi  === 249 444 121  [[ 97 ]]  #memory  Memory: @instptr:TestMismatchedMemoryPhis:BotPTR+16,iid=bot, name=l, idx=4; !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)
 451  Phi  === 249 444 121  [[ 452 ]]  #memory  Memory: @ptr:BotPTR+bot, idx=Bot; !orig=[93] !jvms: TestMismatchedMemoryPhis::mainTest @ bci:37 (line 49)

Now, PhiNode::Identity for 94 could replace it with the bottom memory phi with same inputs 451. But it doesn't run. It last ran between 3) and 4) and there's no reason for igvn to execute it again because 4) doesn't cause 94 to change in any way.

The fix I propose is to mirror the transformation from PhiNode::Identity in PhiNode::Ideal so the end result doesn't depend on what phi is modified and processed by igvn last.

Progress

  • [ ] Change must be properly reviewed (1 review required, with at least 1 Reviewer)
  • [x] Change must not contain extraneous whitespace
  • [x] Commit message must refer to an issue

Issue

  • JDK-8370200: Crash: assert(outer->outcnt() >= phis + 2 - be_loads && outer->outcnt() <= phis + 2 + stores + 1) failed: only phis (Bug - P3)(⚠️ The fixVersion in this issue is [26] but the fixVersion in .jcheck/conf is 27, a new backport will be created when this pr is integrated.)

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/28677/head:pull/28677
$ git checkout pull/28677

Update a local copy of the PR:
$ git checkout pull/28677
$ git pull https://git.openjdk.org/jdk.git pull/28677/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 28677

View PR using the GUI difftool:
$ git pr show -t 28677

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/28677.diff

Using Webrev

Link to Webrev Comment

rwestrel avatar Dec 05 '25 11:12 rwestrel

:wave: Welcome back roland! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

bridgekeeper[bot] avatar Dec 05 '25 11:12 bridgekeeper[bot]

@rwestrel This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8370200: Crash: assert(outer->outcnt() >= phis + 2 - be_loads && outer->outcnt() <= phis + 2 + stores + 1) failed: only phis

Reviewed-by: rcastanedalo, dlunden, dfenacci

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 119 new commits pushed to the master branch:

  • 4f283f188c43cb25c4eafcdf22eb7f58eae286cc: 8373820: C2: Robust Node::uncast_helper infinite loop check
  • d8eb1259f4c0d80861401612e9fc7def1466602e: 8373866: Refactor java/net/httpclient/ThrowingSubscribers*.java tests to use JUnit5
  • c6da35d7c7076aa9643b3dbf03a285420bb1003d: 8373796: Refactor java/net/httpclient/ThrowingPublishers*.java tests to use JUnit5
  • ... and 116 more: https://git.openjdk.org/jdk/compare/00068a80304a809297d0df8698850861e9a1c5e9...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk[bot] avatar Dec 05 '25 11:12 openjdk[bot]

@rwestrel The following label will be automatically applied to this pull request:

  • hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

openjdk[bot] avatar Dec 05 '25 11:12 openjdk[bot]

Webrevs

mlbridge[bot] avatar Dec 05 '25 11:12 mlbridge[bot]

Thanks for working on this @rwestrel!

Now, PhiNode::Identity for 94 could replace it with the bottom memory phi with same inputs 451. But it doesn't run. It last ran between 3) and 4) and there's no reason for igvn to execute it again because 4) doesn't cause 94 to change in any way.

Just to double check, does VerifyIterativeGVN identify this missed transformation? If not, we should make sure it does.

It doesn't because PhaseIterGVN::verify_Identity_for() skips Phi nodes. All issues related to Phi nodes in VerifyIterativeGVN would need to be fixed first.

The fix I propose is to mirror the transformation from PhiNode::Identity in PhiNode::Ideal so the end result doesn't depend on what phi is modified and processed by igvn last.

Correct me if I'm wrong, but do we not achieve the same thing if we identify and add 94 to the worklist after the transformation of 93 -> 451? This possibly seems like a cleaner solution to me (see my code comment below).

In principle, yes. The question is how do you reliably get 94 on the igvn queue. In this particular case, PhiNode::Ideal() creates 451 and enqueues it on the igvn queue with register_new_node_with_optimizer(). Do we want to add custom logic in PhiNode::Ideal() to also enqueue all memory Phis that are uses of the region? It's likely not sufficient in the general case as, maybe, the transformation can only happen once one input of the bottom Phi is changed. So do we need something like PhaseIterGVN::add_users_of_use_to_worklist() as well? It wouldn't quite the same as we wouldn't enqueue uses of a use but the uses of a common input (the region)? Or rather than having logic in a couple different places to enqueue the non bottom memory Phi, maybe, we can do that in PhiNode::Ideal for the bottom Phi which would essentially bethe patch I propose but, instead of making any change to the graph, it would enqueue the non bottom Phi so PhiNode::Identity does the change. It seems a bit wasteful to delay the change to the graph when it can be done safely in PhiNode::Ideal for the bottom memory Phi which is why I went with the change I propose.

rwestrel avatar Dec 09 '25 09:12 rwestrel

The question is how do you reliably get 94 on the igvn queue. In this particular case, PhiNode::Ideal() creates 451 and enqueues it on the igvn queue with register_new_node_with_optimizer(). Do we want to add custom logic in PhiNode::Ideal() to also enqueue all memory Phis that are uses of the region? It's likely not sufficient in the general case as, maybe, the transformation can only happen once one input of the bottom Phi is changed. So do we need something like PhaseIterGVN::add_users_of_use_to_worklist() as well? It wouldn't quite the same as we wouldn't enqueue uses of a use but the uses of a common input (the region)?

I'm not sure about the exact mechanism, but it would be nice if PhiNode::Ideal adds all relevant nodes to the worklist after creating a new Bot memory Phi. Optimally, we'd like VerifyIterativeGVN to notify us of any missing cases. Sounds like two follow-up issues: (1) support Phi nodes in VerifyIterativeGVN and (2) use the information from VerifyIterativeGVN to fix missing cases.

Or rather than having logic in a couple different places to enqueue the non bottom memory Phi, maybe, we can do that in PhiNode::Ideal for the bottom Phi which would essentially bethe patch I propose but, instead of making any change to the graph, it would enqueue the non bottom Phi so PhiNode::Identity does the change. It seems a bit wasteful to delay the change to the graph when it can be done safely in PhiNode::Ideal for the bottom memory Phi which is why I went with the change I propose.

Right, this is what I propose to fix the present issue and it seems cleaner to me (we let Identity handle the identity transformations). I doubt there'll be a measurable compilation time difference. I don't have a strong opinion though, so we can go with what you propose as well. Let's see what other reviewers think before we make a decision!

dlunde avatar Dec 09 '25 10:12 dlunde

I just started some internal testing, will come back with results in a day or two, and hopefully also start reviewing this soon.

robcasloz avatar Dec 09 '25 14:12 robcasloz

I just started some internal testing, will come back with results in a day or two, and hopefully also start reviewing this soon.

Test results look good except for trivial failures in product runs of the new tests, due to missing -XX:+UnlockDiagnosticVMOptions for the stress options.

Right, this is what I propose to fix the present issue and it seems cleaner to me (we let Identity handle the identity transformations). I doubt there'll be a measurable compilation time difference. I don't have a strong opinion though, so we can go with what you propose as well. Let's see what other reviewers think before we make a decision!

Like Daniel and Damon, I also have a slight preference towards enqueuing the node and letting PhiNode::Identity perform the change.

robcasloz avatar Dec 10 '25 13:12 robcasloz

Like Daniel and Damon, I also have a slight preference towards enqueuing the node and letting PhiNode::Identity perform the change.

Thanks @dlunde @dafedafe @robcasloz for the comments. I made that change.

rwestrel avatar Dec 11 '25 09:12 rwestrel

Like Daniel and Damon, I also have a slight preference towards enqueuing the node and letting PhiNode::Identity perform the change.

Thanks @dlunde @dafedafe @robcasloz for the comments. I made that change.

Thanks Roland, will come back with internal test results.

robcasloz avatar Dec 11 '25 09:12 robcasloz

What should I do with this change? Should I go ahead and integrate?

rwestrel avatar Dec 17 '25 12:12 rwestrel

What should I do with this change? Should I go ahead and integrate?

I'm happy with the current version of this changeset, please give me one or two days to re-run it through or CI test system.

robcasloz avatar Dec 17 '25 13:12 robcasloz

@robcasloz @dlunde @dafedafe thanks for the reviews and testing

rwestrel avatar Dec 18 '25 10:12 rwestrel

/integrate

rwestrel avatar Dec 18 '25 10:12 rwestrel

Going to push as commit 2ba423db9925355348106fc9fcf84450123d2605. Since your change was applied there have been 119 commits pushed to the master branch:

  • 4f283f188c43cb25c4eafcdf22eb7f58eae286cc: 8373820: C2: Robust Node::uncast_helper infinite loop check
  • d8eb1259f4c0d80861401612e9fc7def1466602e: 8373866: Refactor java/net/httpclient/ThrowingSubscribers*.java tests to use JUnit5
  • c6da35d7c7076aa9643b3dbf03a285420bb1003d: 8373796: Refactor java/net/httpclient/ThrowingPublishers*.java tests to use JUnit5
  • ... and 116 more: https://git.openjdk.org/jdk/compare/00068a80304a809297d0df8698850861e9a1c5e9...master

Your commit was automatically rebased without conflicts.

openjdk[bot] avatar Dec 18 '25 10:12 openjdk[bot]

@rwestrel Pushed as commit 2ba423db9925355348106fc9fcf84450123d2605.

:bulb: You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

openjdk[bot] avatar Dec 18 '25 10:12 openjdk[bot]