Bug 1417266 - RFC: Crash in jit generation / optimizer
RFC: Crash in jit generation / optimizer
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: java-1.8.0-openjdk (Show other bugs)
6.8
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: Andrew John Hughes
BaseOS QE - Apps
:
Depends On:
Blocks: 1374441 1461138
  Show dependency treegraph
 
Reported: 2017-01-27 12:58 EST by Paulo Andrade
Modified: 2017-10-02 16:13 EDT (History)
10 users (show)

See Also:
Fixed In Version: java-1.8.0-openjdk-1.8.0.121-3.b13.el6
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-10-02 16:13:09 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Icedtea Bugzilla 3334 None None None 2017-03-03 01:58 EST
openjdk bug system JDK-8174164 None None None 2017-02-23 12:01 EST

  None (edit)
Description Paulo Andrade 2017-01-27 12:58:01 EST
User can prevent the crash by excluding a dispatching loop
routine from jit generation.

  Immediate backtrace is:

...
#6  <signal handler called>
#7  in (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/node.hpp:365
#8  idom_no_update (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/loopnode.hpp:732
#9  idom (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/loopnode.hpp:741
#10 PhaseIdealLoop::build_loop_late_post (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/loopnode.cpp:3567
#11 0x00007f8d09bc19bb in PhaseIdealLoop::build_loop_late (this=0x7f8c89efb410, visited=..., worklist=..., nstack=...)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/loopnode.cpp:3455
#12 0x00007f8d09bc4a80 in PhaseIdealLoop::build_and_optimize (this=0x7f8d04881f90, do_split_ifs=false, skip_loop_opts=true)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/loopnode.cpp:2281
#13 0x00007f8d0989a12c in Compile::Optimize (this=0x7f8c89efcc00) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/compile.cpp:2181
...

all threads, but #211 on blocking libc calls.

...
[Switching to thread 211 (Thread 0x7f8c89dfd700 (LWP 7979))]#0  remove (this=0x7f8c89df95b0, a=<value optimized out>)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/indexSet.hpp:148
148	      uint32 before = words()[word_index];
(gdb) bt
#0  remove (this=0x7f8c89df95b0, a=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/indexSet.hpp:148
#1  remove (this=0x7f8c89df95b0, a=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/indexSet.hpp:308
#2  PhaseIFG::remove_node (this=0x7f8c89df95b0, a=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/ifg.cpp:151
#3  0x00007f8d0980a7fe in PhaseChaitin::Simplify (this=0x7f8c89dfacf0) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/chaitin.cpp:1171
#4  0x00007f8d0980e6f9 in PhaseChaitin::Register_Allocate (this=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/chaitin.cpp:502
#5  0x00007f8d09898bcf in Compile::Code_Gen (this=0x7f8c89dfbb80) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/compile.cpp:2373
#6  0x00007f8d0989b902 in Compile::Compile (this=0x7f8c89dfbb80, ci_env=<value optimized out>, compiler=0x7f8d04881050, target=<value optimized out>, osr_bci=<value optimized out>, 
    subsume_loads=<value optimized out>, do_escape_analysis=true, eliminate_boxing=true) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/compile.cpp:910
#7  0x00007f8d097f38dc in C2Compiler::compile_method (this=0x7f8d04881050, env=0x7f8c89dfc660, target=0x7f8c6463c1b0, entry_bci=-1)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/c2compiler.cpp:118
#8  0x00007f8d098a40d6 in CompileBroker::invoke_compiler_on_method (task=0x7f8d05bf8410)
...

  In crashing thread:

(gdb) frame 8
#8  idom_no_update (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64/openjdk/hotspot/src/share/vm/opto/loopnode.hpp:732
732	    while (n->in(0) == NULL) {  // Skip dead CFG nodes
(gdb) list
727	
728	  Node* idom_no_update(Node* d) const {
729	    assert(d->_idx < _idom_size, "oob");
730	    Node* n = _idom[d->_idx];
731	    assert(n != NULL,"Bad immediate dominator info.");
732	    while (n->in(0) == NULL) {  // Skip dead CFG nodes
733	      //n = n->in(1);
734	      n = (Node*)(((intptr_t)_nodes[n->_idx]) & ~1);
735	      assert(n != NULL,"Bad immediate dominator info.");
736	    }
(gdb) p _idom
$1 = (Node **) 0x7f8c70745ac0
(gdb) p n
$16 = (Node *) 0x0
(gdb) p d
$2 = <value optimized out>

<< from disassembly, "d" is in $rbx >>

(gdb) p *(Node*)$rbx
$3 = {_vptr.Node = 0x7f8d0a2cf690, _in = 0x7f8c0000000e, _out = 0x7f8c89efcc00, _cnt = 76029872, _max = 32653, _outcnt = 76029872, _outmax = 32653, _idx = 16384, _class_id = 32653, _flags = 0, 
  static NotAMachineReg = 4294901760}
(gdb) p _idom[16384]
$4 = (Node *) 0x7f8d0a321560
(gdb) p *_idom[16384]
$5 = {_vptr.Node = 0x0, _in = 0x0, _out = 0x0, _cnt = 0, _max = 0, _outcnt = 1, _outmax = 7581, _idx = 104, _class_id = 0, _flags = 0, static NotAMachineReg = 4294901760}
Comment 5 Roland Westrelin 2017-01-31 09:32:01 EST
I managed to extract a dump of the IR graph from the core file and I can see what's causing the crash: the IR graph is incorrect but unless I can reproduce the failure I can't really say what caused the IR graph to become incorrect (i.e. what previous optimization broke the graph).

Using the serviceability agent I managed to extract a replay file and a jar of the loaded classes from the core file but when I replay the compilation, I don't get a crash. So either, the replay or the jar are bad or I'm missing some command line argument or this is one of the rare cases where the compilation cannot be replayed reliably.
Comment 7 Roland Westrelin 2017-02-08 04:57:58 EST
upstream bug:

https://bugs.openjdk.java.net/browse/JDK-8174164

I'm testing a fix
Comment 8 Roland Westrelin 2017-02-10 05:46:12 EST
FTR, fix is being discussed upstream: http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2017-February/025588.html
Comment 9 Roland Westrelin 2017-02-16 03:57:45 EST
Bug is fixed upstream (in 9): http://hg.openjdk.java.net/jdk9/hs/hotspot/rev/35db0413819a
Comment 10 Deepak Bhole 2017-02-16 10:43:07 EST
Fixed upstream, re-assigning to Jiri for inclusion in future builds. If possible, we should roll it in with the April CPU.
Comment 11 Deepak Bhole 2017-02-16 10:44:29 EST
Roland, is there a backport available for 8? If not, can you please create one and propose it upstream and attach it to this bug?
Comment 19 Dana Safford 2017-03-11 11:41:07 EST
Setting the 'Customer Escalation' flag.

We will need a test build, please.
Comment 28 Andrew John Hughes 2017-04-27 11:11:22 EDT
Removing 6.9.z request as this was fixed in the recent 8u131 security update.
See java-1.8.0-openjdk-1.8.0.131-0.b11.el6_9

Note You need to log in before you can comment on or make changes to this bug.