8331085: Crash in MergePrimitiveArrayStores::is_compatible_store()

Reviewed-by: thartmann, chagedorn

src/hotspot/share/opto/memnode.cpp

@@ -2971,7 +2971,11 @@ StoreNode* MergePrimitiveArrayStores::run() {
   }
 
   // Only merge stores on arrays, and the stores must have the same size as the elements.
-  const TypeAryPtr* aryptr_t = _store->adr_type()->isa_aryptr();
+  const TypePtr* ptr_t = _store->adr_type();
+  if (ptr_t == nullptr) {
+    return nullptr;
+  }
+  const TypeAryPtr* aryptr_t = ptr_t->isa_aryptr();
   if (aryptr_t == nullptr) {
     return nullptr;
   }
@@ -3016,6 +3020,7 @@ bool MergePrimitiveArrayStores::is_compatible_store(const StoreNode* other_store
 
   if (other_store == nullptr ||
       _store->Opcode() != other_store->Opcode() ||
+      other_store->adr_type() == nullptr ||
       other_store->adr_type()->isa_aryptr() == nullptr) {
     return false;
   }

test/hotspot/jtreg/compiler/c2/TestMergeStoresNullAdrType.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package compiler.c2;
+
+/*
+ * @test
+ * @bug 8318446 8331085
+ * @summary Test merge stores, when "adr_type() == nullptr" because of TOP somewhere in the address.
+ * @run main/othervm -XX:CompileCommand=compileonly,compiler.c2.TestMergeStoresNullAdrType::test
+ *                   -XX:-TieredCompilation -Xcomp
+ *                   -XX:+UnlockDiagnosticVMOptions -XX:+StressIGVN -XX:+StressCCP
+ *                   -XX:RepeatCompilation=1000
+ *                   compiler.c2.TestMergeStoresNullAdrType
+ * @run main compiler.c2.TestMergeStoresNullAdrType
+ */
+
+public class TestMergeStoresNullAdrType {
+    static int arr[] = new int[100];
+
+    static void test() {
+        boolean b = false;
+        for (int k = 269; k > 10; --k) {
+            b = b;
+            int j = 6;
+            while ((j -= 3) > 0) {
+                if (b) {
+                } else {
+                    arr[j] >>= 2;
+                }
+            }
+        }
+    }
+
+    public static void main(String[] args) {
+        test();
+    }
+}