Bug 1417266 - RFC: Crash in jit generation / optimizer
Summary: RFC: Crash in jit generation / optimizer
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: java-1.8.0-openjdk
Version: 6.8
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Andrew John Hughes
QA Contact: BaseOS QE - Apps
Depends On:
Blocks: 1374441 1461138
TreeView+ depends on / blocked
Reported: 2017-01-27 17:58 UTC by Paulo Andrade
Modified: 2020-06-11 13:15 UTC (History)
10 users (show)

Fixed In Version: java-1.8.0-openjdk-
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-10-02 20:13:09 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Icedtea Bugzilla 3334 0 None None None 2017-03-03 06:58:34 UTC
openjdk bug system JDK-8174164 0 None None None 2017-02-23 17:01:31 UTC

Description Paulo Andrade 2017-01-27 17:58:01 UTC
User can prevent the crash by excluding a dispatching loop
routine from jit generation.

  Immediate backtrace is:

#6  <signal handler called>
#7  in (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-
#8  idom_no_update (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-
#9  idom (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-
#10 PhaseIdealLoop::build_loop_late_post (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-
#11 0x00007f8d09bc19bb in PhaseIdealLoop::build_loop_late (this=0x7f8c89efb410, visited=..., worklist=..., nstack=...)
    at /usr/src/debug/java-1.8.0-openjdk-
#12 0x00007f8d09bc4a80 in PhaseIdealLoop::build_and_optimize (this=0x7f8d04881f90, do_split_ifs=false, skip_loop_opts=true)
    at /usr/src/debug/java-1.8.0-openjdk-
#13 0x00007f8d0989a12c in Compile::Optimize (this=0x7f8c89efcc00) at /usr/src/debug/java-1.8.0-openjdk-

all threads, but #211 on blocking libc calls.

[Switching to thread 211 (Thread 0x7f8c89dfd700 (LWP 7979))]#0  remove (this=0x7f8c89df95b0, a=<value optimized out>)
    at /usr/src/debug/java-1.8.0-openjdk-
148	      uint32 before = words()[word_index];
(gdb) bt
#0  remove (this=0x7f8c89df95b0, a=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-
#1  remove (this=0x7f8c89df95b0, a=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-
#2  PhaseIFG::remove_node (this=0x7f8c89df95b0, a=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-
#3  0x00007f8d0980a7fe in PhaseChaitin::Simplify (this=0x7f8c89dfacf0) at /usr/src/debug/java-1.8.0-openjdk-
#4  0x00007f8d0980e6f9 in PhaseChaitin::Register_Allocate (this=<value optimized out>) at /usr/src/debug/java-1.8.0-openjdk-
#5  0x00007f8d09898bcf in Compile::Code_Gen (this=0x7f8c89dfbb80) at /usr/src/debug/java-1.8.0-openjdk-
#6  0x00007f8d0989b902 in Compile::Compile (this=0x7f8c89dfbb80, ci_env=<value optimized out>, compiler=0x7f8d04881050, target=<value optimized out>, osr_bci=<value optimized out>, 
    subsume_loads=<value optimized out>, do_escape_analysis=true, eliminate_boxing=true) at /usr/src/debug/java-1.8.0-openjdk-
#7  0x00007f8d097f38dc in C2Compiler::compile_method (this=0x7f8d04881050, env=0x7f8c89dfc660, target=0x7f8c6463c1b0, entry_bci=-1)
    at /usr/src/debug/java-1.8.0-openjdk-
#8  0x00007f8d098a40d6 in CompileBroker::invoke_compiler_on_method (task=0x7f8d05bf8410)

  In crashing thread:

(gdb) frame 8
#8  idom_no_update (this=0x7f8c89efb410, n=0x7f8c711f5110) at /usr/src/debug/java-1.8.0-openjdk-
732	    while (n->in(0) == NULL) {  // Skip dead CFG nodes
(gdb) list
728	  Node* idom_no_update(Node* d) const {
729	    assert(d->_idx < _idom_size, "oob");
730	    Node* n = _idom[d->_idx];
731	    assert(n != NULL,"Bad immediate dominator info.");
732	    while (n->in(0) == NULL) {  // Skip dead CFG nodes
733	      //n = n->in(1);
734	      n = (Node*)(((intptr_t)_nodes[n->_idx]) & ~1);
735	      assert(n != NULL,"Bad immediate dominator info.");
736	    }
(gdb) p _idom
$1 = (Node **) 0x7f8c70745ac0
(gdb) p n
$16 = (Node *) 0x0
(gdb) p d
$2 = <value optimized out>

<< from disassembly, "d" is in $rbx >>

(gdb) p *(Node*)$rbx
$3 = {_vptr.Node = 0x7f8d0a2cf690, _in = 0x7f8c0000000e, _out = 0x7f8c89efcc00, _cnt = 76029872, _max = 32653, _outcnt = 76029872, _outmax = 32653, _idx = 16384, _class_id = 32653, _flags = 0, 
  static NotAMachineReg = 4294901760}
(gdb) p _idom[16384]
$4 = (Node *) 0x7f8d0a321560
(gdb) p *_idom[16384]
$5 = {_vptr.Node = 0x0, _in = 0x0, _out = 0x0, _cnt = 0, _max = 0, _outcnt = 1, _outmax = 7581, _idx = 104, _class_id = 0, _flags = 0, static NotAMachineReg = 4294901760}

Comment 5 Roland Westrelin 2017-01-31 14:32:01 UTC
I managed to extract a dump of the IR graph from the core file and I can see what's causing the crash: the IR graph is incorrect but unless I can reproduce the failure I can't really say what caused the IR graph to become incorrect (i.e. what previous optimization broke the graph).

Using the serviceability agent I managed to extract a replay file and a jar of the loaded classes from the core file but when I replay the compilation, I don't get a crash. So either, the replay or the jar are bad or I'm missing some command line argument or this is one of the rare cases where the compilation cannot be replayed reliably.

Comment 7 Roland Westrelin 2017-02-08 09:57:58 UTC
upstream bug:


I'm testing a fix

Comment 8 Roland Westrelin 2017-02-10 10:46:12 UTC
FTR, fix is being discussed upstream: http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2017-February/025588.html

Comment 9 Roland Westrelin 2017-02-16 08:57:45 UTC
Bug is fixed upstream (in 9): http://hg.openjdk.java.net/jdk9/hs/hotspot/rev/35db0413819a

Comment 10 Deepak Bhole 2017-02-16 15:43:07 UTC
Fixed upstream, re-assigning to Jiri for inclusion in future builds. If possible, we should roll it in with the April CPU.

Comment 11 Deepak Bhole 2017-02-16 15:44:29 UTC
Roland, is there a backport available for 8? If not, can you please create one and propose it upstream and attach it to this bug?

Comment 19 Dana Safford 2017-03-11 16:41:07 UTC
Setting the 'Customer Escalation' flag.

We will need a test build, please.

Comment 28 Andrew John Hughes 2017-04-27 15:11:22 UTC
Removing 6.9.z request as this was fixed in the recent 8u131 security update.
See java-1.8.0-openjdk-

Note You need to log in before you can comment on or make changes to this bug.