stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8274074: SIGFPE with C2 compiled code with -XX:+StressGCM

Browse Source 
Reviewed-by: roland, thartmann
This commit is contained in:
Christian Hagedorn 2021-09-27 14:05:51 +00:00
parent 7436a77e3d
commit b0983df5a4
2 changed files with 95 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/hotspot/share/opto/loopopts.cpp
View File

@ -1448,6 +1448,16 @@ void PhaseIdealLoop::try_sink_out_of_loop(Node* n) {
n->Opcode() != Op_Opaque4) {
Node *n_ctrl = get_ctrl(n);
IdealLoopTree *n_loop = get_loop(n_ctrl);
if (n->in(0) != NULL) {
IdealLoopTree* loop_ctrl = get_loop(n->in(0));
if (n_loop != loop_ctrl && n_loop->is_member(loop_ctrl)) {
// n has a control input inside a loop but get_ctrl() is member of an outer loop. This could happen, for example,
// for Div nodes inside a loop (control input inside loop) without a use except for an UCT (outside the loop).
// Rewire control of n to get_ctrl(n) to move it out of the loop, regardless if its input(s) are later sunk or not.
_igvn.replace_input_of(n, 0, n_ctrl);
}
}
if (n_loop != _ltree_root && n->outcnt() > 1) {
// Compute early control: needed for anti-dependence analysis. It's also possible that as a result of
// previous transformations in this loop opts round, the node can be hoisted now: early control will tell us.

85
test/hotspot/jtreg/compiler/loopopts/TestSinkingDivisorLostPin.java Normal file
View File

@ -0,0 +1,85 @@
/*
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @key stress randomness
* @bug 8274074
* @requires vm.compiler2.enabled
* @summary Sinking a data node used as divisor of a DivI node into a zero check UCT loses its pin outside the loop due to
* optimizing the CastII node away, resulting in a div by zero crash (SIGFPE) due to letting the DivI node floating
* back inside the loop.
* @run main/othervm -Xcomp -XX:CompileCommand=compileonly,compiler.loopopts.TestSinkingDivisorLostPin -XX:-TieredCompilation
* -XX:+UnlockDiagnosticVMOptions -XX:+StressGCM -XX:StressSeed=4177789702 compiler.loopopts.TestSinkingDivisorLostPin
* @run main/othervm -Xcomp -XX:CompileCommand=compileonly,compiler.loopopts.TestSinkingDivisorLostPin -XX:-TieredCompilation
* -XX:+UnlockDiagnosticVMOptions -XX:+StressGCM compiler.loopopts.TestSinkingDivisorLostPin
*/
package compiler.loopopts;
public class TestSinkingDivisorLostPin {
static int iFld = 1;
static int x = 1;
static int q = 0;
static int iArrFld[] = new int[100];
public static void main(String[] strArr) {
test();
}
static void test() {
int y = 1;
int i = 1;
do {
int j;
for (j = 1; j < 88; j++) {
iArrFld[1] = x;
}
try {
y = iFld - q; // y = 1 - 0
y = (iArrFld[2] / y); // y = iArrFld[2] / 1
// Zero check Z1 with UCT
// DivI node D on IfTrue path of zero check
y = (5 / iFld); // y = 5 / 1
// Zero check Z2 with UCT
// DivI node D is only used on IfFalse path of zero check Z2 into UCT (on IfTrue path, the result is not used anywhere
// because we directly overwrite it again with "y = (5 / iFld)). The IfFalse path of the zero check, however, is never
// taken because iFld = 1. But before applying the sinking algorithm, the DivI node D could be executed during the
// loop, as the zero check Z1 succeeds. Only after sinking the SubI node for "iFld - q" into the IfFalse path of Z2
// and optimizing it accordingly (iFld is found to be zero because the zero check Z2 failed, i.e. iFld is zero which is
// propagated into the CastII node whose type is improved to [0,0] and the node is replaced by constant zero), the
// DivI node must NOT be executed inside the loop anymore. But the DivI node is executed in the loop because of losing
// the CastII pin. The fix is to update the control input of the DivI node to the get_ctrl() input outside the loop
// (IfFalse of zero check Z2).
} catch (ArithmeticException a_e) {
}
iFld -= 8;
if (y == 3) {
}
i++;
} while (i < 10);
}
}