8296389: C2: PhaseCFG::convert_NeverBranch_to_Goto must handle both orders of successors

[eme64]

The code in PhaseCFG::convert_NeverBranch_to_Goto looks like it is ready to have idx == 1, but it is not.

We would read succ from _succs[1].

jdk/src/hotspot/share/opto/block.cpp

Line 626 in 8c472e4

Block *succ = b->_succs[idx];

Then overwrite _succs[0] with succ, and shorten the array.

jdk/src/hotspot/share/opto/block.cpp

Lines 635 to 636 in 8c472e4

	b->_succs.map(0,succ); // Map only successor
	b->_num_succs = 1;

And finally attempt to read dead from _succs[0], where the dead block used to be, but was just overwritten.

jdk/src/hotspot/share/opto/block.cpp

Line 645 in 8c472e4

Block* dead = b->_succs[1 - idx];

Solution
Read dead before overwriting it. I also made it more robust by going via the projections, and not assuming that the projections and successors are ordered equally (though that is probably guaranteed by the matching traversal).

Refactoring: added class id for NeverBranch
I also added the class id for NeverBranch, and replaced all Op_NeverBranch checks with is_NeverBranch().

Why did we never hit this bug before?
Normal case: during matching, "succ" projection is added as output of NeverBranch before the "dead" projection leading to Halt. Thus, the outputs of NeverBranch are normally [[ "succ", "dead" ]], hence idx == 0.
Details: During DFS, usually we go from Halt to NeverBranch. Then via Region/Loop, take backedge, and find the "succ" edge. We already have its inputs (NeverBranch), thus we can now post-visit the live edge, and attach it to the NeverBranch first. Later, once we have processed the whole infinite loop, we post-visit out of NeverBranch to the "dead" projection edge, which we attach second.

Rare case: "dead" projection is first attached to NeverBranch, and "succ" projection is added second. We have [[ "dead", "succ" ]], hence idx == 1.
We have a peeled infinite loop. The NeverBranch of the peeled iteration is first visited via the "dead" projection from HaltNode. Since the peeled iteration has no backedge, we do not visit the "succ" projection yet, but instead attach "dead" projection to HaltNode already once we are done visiting everything above. Later, we come from the peeled loop's NeverBranch exit, to the "succ" projection of the peeled iteration's NeverBranch, and attach the "succ" projection.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8296389: C2: PhaseCFG::convert_NeverBranch_to_Goto must handle both orders of successors

Reviewers

• Tobias Hartmann (@TobiHartmann - Reviewer) ⚠️ Review applies to 55ce9581
• Christian Hagedorn (@chhagedorn - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk pull/11481/head:pull/11481
$ git checkout pull/11481

Update a local copy of the PR:
$ git checkout pull/11481
$ git pull https://git.openjdk.org/jdk pull/11481/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 11481

View PR using the GUI difftool:
$ git pr show -t 11481

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/11481.diff

[bridgekeeper]

👋 Welcome back epeter! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@eme64 The following label will be automatically applied to this pull request:

• hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 03: Full - Incremental (e119e963)
• 02: Full - Incremental (55ce9581)
• 01: Full - Incremental (f1d25d0e)
• 00: Full (c826a8ff)

[TobiHartmann]

Much better, thanks for making these changes. Looks good.

[openjdk]

@eme64 This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8296389: C2: PhaseCFG::convert_NeverBranch_to_Goto must handle both orders of successors

Reviewed-by: thartmann, chagedorn

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 25 new commits pushed to the master branch:

• 6c23b4f: 8298480: Remove unused KlassRemSet
• 8e5c331: 8298471: Parallel: Don't keep alive nmethods in Young GC
• d646e32: 8298090: Use String.join() instead of manual loop in DescriptorSupport.toString
• a37de62: 8298126: Print statistics for objects in CDS archive heap
• 8ea2a67: 8292265: Add old gen used field at G1HeapSummary JFR event
• 478ef38: 8296812: sprintf is deprecated in Xcode 14
• 715bf70: Merge
• a894649: 8298225: [AIX] Disable PPC64LE continuations on AIX
• 52fffdd: 8298463: tools/javac/modules/EdgeCases.java fails on Windows after JDK-8297988
• b7b996c: 8298353: C2 fails with assert(opaq->outcnt() == 1 && opaq->in(1) == limit) failed
• ... and 15 more: https://git.openjdk.org/jdk/compare/7f9c6ce3318aedfd85f12f4002dc442b0b468c27...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[chhagedorn]

Nice analysis and tests! The fix looks good to me, too.

[eme64]

Thanks @chhagedorn @TobiHartmann for the reviews!
/integrate

[openjdk]

Going to push as commit fabda24.
Since your change was applied there have been 25 commits pushed to the master branch:

• 6c23b4f: 8298480: Remove unused KlassRemSet
• 8e5c331: 8298471: Parallel: Don't keep alive nmethods in Young GC
• d646e32: 8298090: Use String.join() instead of manual loop in DescriptorSupport.toString
• a37de62: 8298126: Print statistics for objects in CDS archive heap
• 8ea2a67: 8292265: Add old gen used field at G1HeapSummary JFR event
• 478ef38: 8296812: sprintf is deprecated in Xcode 14
• 715bf70: Merge
• a894649: 8298225: [AIX] Disable PPC64LE continuations on AIX
• 52fffdd: 8298463: tools/javac/modules/EdgeCases.java fails on Windows after JDK-8297988
• b7b996c: 8298353: C2 fails with assert(opaq->outcnt() == 1 && opaq->in(1) == limit) failed
• ... and 15 more: https://git.openjdk.org/jdk/compare/7f9c6ce3318aedfd85f12f4002dc442b0b468c27...master

Your commit was automatically rebased without conflicts.

[openjdk]

@eme64 Pushed as commit fabda24.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.