8224957: C2 compilation fails with assert: Bad graph detected in build_loop_late

Disable walking up the dominator chain for regions with more than 2 input paths.

Reviewed-by: roland, kvn

src/hotspot/share/opto/c2_globals.hpp

@@ -510,7 +510,7 @@
           "Sets max value cached by the java.lang.Integer autobox cache")   \
           range(0, max_jint)                                                \
                                                                             \
-  experimental(bool, AggressiveUnboxing, false,                             \
+  experimental(bool, AggressiveUnboxing, true,                              \
           "Control optimizations for aggressive boxing elimination")        \
                                                                             \
   develop(bool, TracePostallocExpand, false, "Trace expanding nodes after"  \

src/hotspot/share/opto/memnode.cpp

@@ -1435,8 +1435,6 @@ Node *LoadNode::split_through_phi(PhaseGVN *phase) {
     }
   }
 
-  bool load_boxed_phi = load_boxed_values && base_is_phi && (base->in(0) == mem->in(0));
-
   // Split through Phi (see original code in loopopts.cpp).
   assert(C->have_alias_type(t_oop), "instance should have alias type");
 

src/hotspot/share/opto/node.cpp

@@ -1228,12 +1228,10 @@ bool Node::dominates(Node* sub, Node_List &nlist) {
     if (sub == up && sub->is_Loop()) {
       // Take loop entry path on the way up to 'dom'.
       up = sub->in(1); // in(LoopNode::EntryControl);
-    } else if (sub == up && sub->is_Region() && sub->req() != 3) {
-      // Always take in(1) path on the way up to 'dom' for clone regions
-      // (with only one input) or regions which merge > 2 paths
-      // (usually used to merge fast/slow paths).
+    } else if (sub == up && sub->is_Region() && sub->req() == 2) {
+      // Take in(1) path on the way up to 'dom' for regions with only one input
       up = sub->in(1);
-    } else if (sub == up && sub->is_Region()) {
+    } else if (sub == up && sub->is_Region() && sub->req() == 3) {
       // Try both paths for Regions with 2 input paths (it may be a loop head).
       // It could give conservative 'false' answer without information
       // which region's input is the entry path.

test/hotspot/jtreg/compiler/eliminateAutobox/TestSplitThroughPhi.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8224957
+ * @summary Test splitting a boxed field load through a loop Phi.
+ * @run main/othervm -XX:-TieredCompilation -XX:-ProfileInterpreter
+ *                   -XX:CompileOnly=compiler.eliminateAutobox.TestSplitThroughPhi::test
+ *                   compiler.eliminateAutobox.TestSplitThroughPhi
+ */
+
+package compiler.eliminateAutobox;
+
+public class TestSplitThroughPhi {
+
+  static volatile boolean loop = true;
+
+  public static void test(Object obj) {
+      for (int i = 0; i == 0; ) {
+          // OSR compilation generates Region with 3 input paths
+          while (true) {
+              // Load from boxed int
+              int val = (Integer)obj;
+              if (val == i++) break;
+              if (!loop) break;
+          }
+      }
+  }
+
+  public static void main(String[] args) {
+      test(100_000);
+  }
+}