8331194: NPE in ArrayCreationTree.java with -XX:-UseCompressedOops

Reviewed-by: kvn

src/hotspot/share/opto/machnode.hpp

@@ -867,6 +867,10 @@ public:
     assert(verify_jvms(jvms), "jvms must match");
     return in(_jvmadj + jvms->monitor_box_offset(idx));
   }
+  Node* scalarized_obj(const JVMState* jvms, uint idx) const {
+    assert(verify_jvms(jvms), "jvms must match");
+    return in(_jvmadj + jvms->scloff() + idx);
+  }
   void  set_local(const JVMState* jvms, uint idx, Node *c) {
     assert(verify_jvms(jvms), "jvms must match");
     set_req(_jvmadj + jvms->locoff() + idx, c);

src/hotspot/share/opto/output.cpp

@@ -974,6 +974,27 @@ bool PhaseOutput::contains_as_owner(GrowableArray<MonitorValue*> *monarray, Obje
   return false;
 }
 
+// Determine if there is a scalar replaced object description represented by 'ov'.
+bool PhaseOutput::contains_as_scalarized_obj(JVMState* jvms, MachSafePointNode* sfn,
+                                             GrowableArray<ScopeValue*>* objs,
+                                             ObjectValue* ov) const {
+  for (int i = 0; i < jvms->scl_size(); i++) {
+    Node* n = sfn->scalarized_obj(jvms, i);
+    // Other kinds of nodes that we may encounter here, for instance constants
+    // representing values of fields of objects scalarized, aren't relevant for
+    // us, since they don't map to ObjectValue.
+    if (!n->is_SafePointScalarObject()) {
+      continue;
+    }
+
+    ObjectValue* other = (ObjectValue*) sv_for_node_id(objs, n->_idx);
+    if (ov == other) {
+      return true;
+    }
+  }
+  return false;
+}
+
 //--------------------------Process_OopMap_Node--------------------------------
 void PhaseOutput::Process_OopMap_Node(MachNode *mach, int current_offset) {
   // Handle special safepoint nodes for synchronization
@@ -1137,7 +1158,10 @@ void PhaseOutput::Process_OopMap_Node(MachNode *mach, int current_offset) {
 
         for (int j = 0; j< merge->possible_objects()->length(); j++) {
           ObjectValue* ov = merge->possible_objects()->at(j)->as_ObjectValue();
-          bool is_root = locarray->contains(ov) || exparray->contains(ov) || contains_as_owner(monarray, ov);
+          bool is_root = locarray->contains(ov) ||
+                         exparray->contains(ov) ||
+                         contains_as_owner(monarray, ov) ||
+                         contains_as_scalarized_obj(jvms, sfn, objs, ov);
           ov->set_root(is_root);
         }
       }

src/hotspot/share/opto/output.hpp

@@ -208,6 +208,9 @@ public:
 
   bool starts_bundle(const Node *n) const;
   bool contains_as_owner(GrowableArray<MonitorValue*> *monarray, ObjectValue *ov) const;
+  bool contains_as_scalarized_obj(JVMState* jvms, MachSafePointNode* sfn,
+                                  GrowableArray<ScopeValue*>* objs,
+                                  ObjectValue* ov) const;
 
   // Dump formatted assembly
 #if defined(SUPPORT_OPTO_ASSEMBLY)

test/hotspot/jtreg/compiler/escapeAnalysis/TestReduceAllocationAndNestedScalarized.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8331194
+ * @summary Check that Reduce Allocation Merges doesn't crash when an input
+ *          of the Phi is not the _current_ output of the Phi but said input
+ *          needs to be rematerialized because it's used regardless of the
+ *          Phi output.
+ * @run main/othervm -XX:CompileCommand=dontinline,*TestReduceAllocationAndNestedScalarized*::test
+ *                   -XX:CompileCommand=compileonly,*TestReduceAllocationAndNestedScalarized*::test
+ *                   -XX:CompileCommand=compileonly,*Picture*::*init*
+ *                   -XX:CompileCommand=compileonly,*Point*::*init*
+ *                   -XX:CompileCommand=exclude,*Unloaded*::*
+ *                   -XX:+IgnoreUnrecognizedVMOptions
+ *                   -XX:-TieredCompilation
+ *                   -XX:-UseCompressedOops
+ *                   -Xcomp
+ *                   -server
+ *                   compiler.escapeAnalysis.TestReduceAllocationAndNestedScalarized
+ * @run main compiler.escapeAnalysis.TestReduceAllocationAndNestedScalarized
+ */
+
+package compiler.escapeAnalysis;
+
+public class TestReduceAllocationAndNestedScalarized {
+    static class Picture {
+        public Point first;
+        public Point second;
+    }
+
+    static class Point {
+        int x;
+    }
+
+    static class Unloaded {
+    }
+
+    static int test(boolean cond) {
+        Picture p = new Picture();
+        p.first = new Point();
+        Point p2 = p.first;
+
+        if (cond) p2 = new Point();
+
+        p.second = p2;
+
+        new Unloaded();
+
+        return p.first.x;
+    }
+
+    public static void main(String[] args) {
+        Picture pic = new Picture();
+        Point pnt   = new Point();
+        int res     = test(true);
+        System.out.println("Result is: " + res);
+    }
+}