8265907: JVM crashes when matching VectorMaskCmp Node #3670

Wanghuang-Huawei · 2021-04-25T07:38:30Z

fix the issue JDK-8265907
all archs might be effected by this bug. I fixed x86 and aarch64.

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8265907: JVM crashes when matching VectorMaskCmp Node

Reviewers

Sandhya Viswanathan (@sviswa7 - Reviewer) ⚠️ Review applies to b61ee9c
Ningsheng Jian (@nsjian - Committer)
Jatin Bhateja (@jatin-bhateja - Committer)

Contributors

Wang Huang <whuang@openjdk.org>
Ai Jiaming <aijiaming1@huawei.com>

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/3670/head:pull/3670
$ git checkout pull/3670

Update a local copy of the PR:
$ git checkout pull/3670
$ git pull https://git.openjdk.java.net/jdk pull/3670/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 3670

View PR using the GUI difftool:
$ git pr show -t 3670

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/3670.diff

bridgekeeper · 2021-04-25T07:39:18Z

👋 Welcome back whuang! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

Wanghuang-Huawei · 2021-04-25T07:40:50Z

/contributor add Wang Huang whuang@openjdk.org
/contributor add Ai Jiaming aijiaming1@huawei.com

openjdk · 2021-04-25T07:41:23Z

@Wanghuang-Huawei
Contributor Wang Huang <whuang@openjdk.org> successfully added.

openjdk · 2021-04-25T07:43:36Z

@Wanghuang-Huawei
Contributor Ai Jiaming <aijiaming1@huawei.com> successfully added.

openjdk · 2021-04-25T07:45:05Z

@Wanghuang-Huawei The following label will be automatically applied to this pull request:

hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-04-25T07:49:57Z

Webrevs

nsjian · 2021-04-26T05:32:14Z

src/hotspot/cpu/aarch64/aarch64.ad

+    case Op_VectorMaskCmp:
+      if (vlen < 2 || bit_size < 64) {
+        return false;
+      }
+      break;


Hmm, currently min_vector_size for byte type is lower to 4 bytes to support vector api shuffle, but we don't have a per Opcode size check correctly. E.g. no length check for reduce_add8B, do you also see any issue for that? I think we'd better only allow 4 bytes for vector api shuffle related opcodes (and 2 for mask related opcodes) in match_rule_supported_vector, while for other opcodes, we still only support for >=64 bits.

Hmm, currently min_vector_size for byte type is lower to 4 bytes to support vector api shuffle, but we don't have a per Opcode size check correctly. E.g. no length check for reduce_add8B, do you also see any issue for that?

Since SLP does not support subword reduction, I think current match rules are fine. AArch64 part looks good to me.

XiaohongGong · 2021-04-29T09:05:52Z

src/hotspot/cpu/x86/x86.ad

+    case Op_VectorMaskCmp:
+      if (vlen < 2 || size_in_bits < 64) {
+        return false;
+      }
+      break;


Did you also see the crash on x86?

Yes, this bug effects x86.

bridgekeeper · 2021-05-28T03:13:17Z

@Wanghuang-Huawei This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

Wanghuang-Huawei · 2021-05-29T03:25:18Z

@iwanowww @mgkwill Could you do me a favor to review this issue? Any suggestion is welcome.

mgkwill · 2021-05-31T02:01:58Z

@jatin-bhateja and @sviswa7 could you review this for x86?

jatin-bhateja · 2021-05-31T07:00:52Z

Hi @Wanghuang-Huawei ,
By adding suggested check we may suppress iotaShuffle intrinsification for Long256, Int128, Short64 species.
Since currently shuffles are stored in a byte array so this case seeped through the constraint to prevent vectorization imposed by match rule supported vector (i.e. vlen < 4 for byte vectors).

Please let me know if its ok to integrate following changes in your patch.

diff --git a/src/hotspot/cpu/x86/c2_MacroAssembler_x86.cpp b/src/hotspot/cpu/x86/c2_MacroAssembler_x86.cpp
index 310bbbfa150..ca77ee043e2 100644
--- a/src/hotspot/cpu/x86/c2_MacroAssembler_x86.cpp
+++ b/src/hotspot/cpu/x86/c2_MacroAssembler_x86.cpp
@@ -1496,7 +1496,11 @@ void C2_MacroAssembler::load_vector_mask(XMMRegister dst, XMMRegister src, int v
 
 void C2_MacroAssembler::load_iota_indices(XMMRegister dst, Register scratch, int vlen_in_bytes) {
   ExternalAddress addr(StubRoutines::x86::vector_iota_indices());
-  if (vlen_in_bytes <= 16) {
+  if (vlen_in_bytes == 4) {
+    movdl(dst, addr);
+  } else if (vlen_in_bytes == 8) {
+    movq(dst, addr);
+  } else if (vlen_in_bytes == 16) {
     movdqu(dst, addr, scratch);
   } else if (vlen_in_bytes == 32) {
     vmovdqu(dst, addr, scratch);
@@ -1505,6 +1509,7 @@ void C2_MacroAssembler::load_iota_indices(XMMRegister dst, Register scratch, int
     evmovdqub(dst, k0, addr, false /*merge*/, Assembler::AVX_512bit, scratch);
   }
 }
+
 // Reductions for vectors of bytes, shorts, ints, longs, floats, and doubles.
 
 void C2_MacroAssembler::reduce_operation_128(BasicType typ, int opcode, XMMRegister dst, XMMRegister src) {
diff --git a/src/hotspot/cpu/x86/x86.ad b/src/hotspot/cpu/x86/x86.ad
index 5f6d5bc6fdb..cb23ebdd9db 100644
--- a/src/hotspot/cpu/x86/x86.ad
+++ b/src/hotspot/cpu/x86/x86.ad
@@ -6867,7 +6867,7 @@ instruct evcmpFD(vec dst, vec src1, vec src2, immI8 cond, rRegP scratch, kReg kt
 %}
 
 instruct vcmp(legVec dst, legVec src1, legVec src2, immI8 cond, rRegP scratch) %{
-  predicate(vector_length_in_bytes(n->in(1)->in(1)) >=  8 && // src1
+  predicate(vector_length_in_bytes(n->in(1)->in(1)) >=  4 && // src1
             vector_length_in_bytes(n->in(1)->in(1)) <= 32 && // src1
             is_integral_type(vector_element_basic_type(n->in(1)->in(1)))); // src1
   match(Set dst (VectorMaskCmp (Binary src1 src2) cond));
diff --git a/src/hotspot/share/opto/vectorIntrinsics.cpp b/src/hotspot/share/opto/vectorIntrinsics.cpp
index f613299a1c4..e9657e1136d 100644
--- a/src/hotspot/share/opto/vectorIntrinsics.cpp
+++ b/src/hotspot/share/opto/vectorIntrinsics.cpp
@@ -340,9 +340,6 @@ bool LibraryCallKit::inline_vector_shuffle_iota() {
   int num_elem = vlen->get_con();
   BasicType elem_bt = T_BYTE;
 
-  if (num_elem < 4)
-    return false;
-
   if (!arch_supports_vector(VectorNode::replicate_opcode(elem_bt), num_elem, elem_bt, VecMaskNotUsed)) {
     return false;
   }

jatin-bhateja · 2021-05-31T15:00:14Z

Hi @Wanghuang-Huawei , I have updated the proposed fix.

Wanghuang-Huawei · 2021-06-02T08:46:15Z

Hi @Wanghuang-Huawei , I have updated the proposed fix.

Thank you for your suggestion. I think your codes can solve the x86's problem here. I will add it to my next push.

sviswa7 · 2021-06-04T00:24:54Z

x86 changes look good to me.

sviswa7

@Wanghuang-Huawei Are you planning to proceed with this? x86 changes are good. You will need an approval from aarch64 side. Please do a rebase to latest.

openjdk · 2021-06-09T01:01:39Z

@Wanghuang-Huawei this pull request can not be integrated into master due to one or more merge conflicts. To resolve these merge conflicts and update this pull request you can run the following commands in the local repository for your personal fork:

git checkout JDK-8265907
git fetch https://git.openjdk.java.net/jdk master
git merge FETCH_HEAD
# resolve conflicts and follow the instructions given by git merge
git commit -m "Merge master"
git push

Wanghuang-Huawei · 2021-06-09T03:24:55Z

@Wanghuang-Huawei Are you planning to proceed with this? x86 changes are good. You will need an approval from aarch64 side. Please do a rebase to latest.

OK. I will rebase & solve the conflict. Thank you.

openjdk · 2021-06-09T03:45:03Z

@Wanghuang-Huawei This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8265907: JVM crashes when matching VectorMaskCmp Node

Co-authored-by: Wang Huang <whuang@openjdk.org>
Co-authored-by: Ai Jiaming <aijiaming1@huawei.com>
Reviewed-by: sviswanathan, njian, jbhateja

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 64 new commits pushed to the master branch:

df65237: 8267930: Refine code for loading hsdis library
2e900da: 8268574: ProblemList tests failing due to UseBiasedLocking going away
4fd2a14: 8267556: Enhance class paths check during runtime
8c8422e: 8267893: Improve jtreg test failure handler do get native/mixed stack traces for cores and live processes
1e1039a: 8268223: Problemlist vmTestbase/nsk/jdi/HiddenClass/events/events001.java
78cb677: 8268539: several serviceability/sa tests should be run in driver mode
7267227: 8268361: Fix the infinite loop in next_line
b018c45: 8267630: Start of release updates for JDK 18
7400789: 8268542: serviceability/logging/TestFullNames.java tests only 1st test case
a95e64c: 8268443: ParallelGC Full GC should use parallel WeakProcessor
... and 54 more: https://git.openjdk.java.net/jdk/compare/2cc1977a9698af9538101a5842c311659521a0aa...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@sviswa7, @nsjian, @jatin-bhateja) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

nsjian

AArch64 change looks good to me (not a Reviewer).

sviswa7 · 2021-06-10T18:31:17Z

@Wanghuang-Huawei Could you please submit this fix versus JDK17 repo which forked today?

Wanghuang-Huawei · 2021-06-11T01:39:50Z

@Wanghuang-Huawei Could you please submit this fix versus JDK17 repo which forked today?

OK. I will submit it.

Wanghuang-Huawei · 2021-06-11T01:40:35Z

/integrate

openjdk · 2021-06-11T01:41:31Z

@Wanghuang-Huawei
Your change (at version a28a2f7) is now ready to be sponsored by a Committer.

Wanghuang-Huawei · 2021-06-11T01:50:55Z

@theRealAph Could you do me a favor to review this patch?

nsjian · 2021-06-11T02:09:20Z

I think this should go to https://github.com/openjdk/jdk17?

PaulSandoz · 2021-06-11T15:15:20Z

@nsjian yes, withdraw this PR and redo it for https://github.com/openjdk/jdk17

nsjian · 2021-06-18T02:31:00Z

@Wanghuang-Huawei Could you please create the PR in jdk17 and withdraw this as suggested by @PaulSandoz ?

Wanghuang-Huawei · 2021-06-24T03:07:47Z

@nsjian @PaulSandoz I will recommit this patch to jdk17 soon.

Wanghuang-Huawei · 2021-06-24T08:38:52Z

openjdk/jdk17#134

TobiHartmann · 2021-07-06T06:04:18Z

This PR can be closed now.

openjdk bot added the rfr Pull request is ready for review label Apr 25, 2021

openjdk bot added the hotspot-compiler hotspot-compiler-dev@openjdk.org label Apr 25, 2021

nsjian reviewed Apr 26, 2021

View reviewed changes

8265907: JVM crashes when matching VectorMaskCmp Node

44b255c

Wanghuang-Huawei force-pushed the JDK-8265907 branch from a193ff0 to 44b255c Compare April 26, 2021 07:33

Wanghuang-Huawei changed the title ~~8265907: JVM crashes when matching VectorMaskCmp Node for Neon backend~~ 8265907: JVM crashes when matching VectorMaskCmp Node Apr 26, 2021

fix x86's bug

817c8be

XiaohongGong reviewed Apr 29, 2021

View reviewed changes

Merge branch 'master' into JDK-8265907

ea390ec

fix x86's problem in other way

b61ee9c

sviswa7 approved these changes Jun 9, 2021

View reviewed changes

openjdk bot added the merge-conflict Pull request has merge conflict with target branch label Jun 9, 2021

Merge master

a28a2f7

openjdk bot added the ready Pull request is ready to be integrated label Jun 9, 2021

openjdk bot removed the merge-conflict Pull request has merge conflict with target branch label Jun 9, 2021

nsjian approved these changes Jun 10, 2021

View reviewed changes

jatin-bhateja approved these changes Jun 10, 2021

View reviewed changes

openjdk bot added the sponsor Pull request is ready to be sponsored label Jun 11, 2021

Wanghuang-Huawei mentioned this pull request Jun 24, 2021

8265907: JVM crashes when matching VectorMaskCmp Node openjdk/jdk17#134

Closed

3 tasks

Wanghuang-Huawei closed this Jul 14, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8265907: JVM crashes when matching VectorMaskCmp Node #3670

8265907: JVM crashes when matching VectorMaskCmp Node #3670

Wanghuang-Huawei commented Apr 25, 2021 •

edited by openjdk bot

Loading

bridgekeeper bot commented Apr 25, 2021

Wanghuang-Huawei commented Apr 25, 2021

openjdk bot commented Apr 25, 2021

openjdk bot commented Apr 25, 2021

openjdk bot commented Apr 25, 2021

mlbridge bot commented Apr 25, 2021 •

edited

Loading

nsjian Apr 26, 2021

nsjian May 31, 2021

XiaohongGong Apr 29, 2021

Wanghuang-Huawei Apr 30, 2021

bridgekeeper bot commented May 28, 2021

Wanghuang-Huawei commented May 29, 2021

mgkwill commented May 31, 2021

jatin-bhateja commented May 31, 2021 •

edited

Loading

jatin-bhateja commented May 31, 2021

Wanghuang-Huawei commented Jun 2, 2021

sviswa7 commented Jun 4, 2021

sviswa7 left a comment

openjdk bot commented Jun 9, 2021

Wanghuang-Huawei commented Jun 9, 2021

openjdk bot commented Jun 9, 2021 •

edited

Loading

nsjian left a comment

sviswa7 commented Jun 10, 2021

Wanghuang-Huawei commented Jun 11, 2021

Wanghuang-Huawei commented Jun 11, 2021

openjdk bot commented Jun 11, 2021

Wanghuang-Huawei commented Jun 11, 2021

nsjian commented Jun 11, 2021

PaulSandoz commented Jun 11, 2021 •

edited

Loading

nsjian commented Jun 18, 2021

Wanghuang-Huawei commented Jun 24, 2021

Wanghuang-Huawei commented Jun 24, 2021

TobiHartmann commented Jul 6, 2021

8265907: JVM crashes when matching VectorMaskCmp Node #3670

8265907: JVM crashes when matching VectorMaskCmp Node #3670

Conversation

Wanghuang-Huawei commented Apr 25, 2021 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Contributors

Reviewing

bridgekeeper bot commented Apr 25, 2021

Wanghuang-Huawei commented Apr 25, 2021

openjdk bot commented Apr 25, 2021

openjdk bot commented Apr 25, 2021

openjdk bot commented Apr 25, 2021

mlbridge bot commented Apr 25, 2021 • edited Loading

Webrevs

nsjian Apr 26, 2021

Choose a reason for hiding this comment

nsjian May 31, 2021

Choose a reason for hiding this comment

XiaohongGong Apr 29, 2021

Choose a reason for hiding this comment

Wanghuang-Huawei Apr 30, 2021

Choose a reason for hiding this comment

bridgekeeper bot commented May 28, 2021

Wanghuang-Huawei commented May 29, 2021

mgkwill commented May 31, 2021

jatin-bhateja commented May 31, 2021 • edited Loading

jatin-bhateja commented May 31, 2021

Wanghuang-Huawei commented Jun 2, 2021

sviswa7 commented Jun 4, 2021

sviswa7 left a comment

Choose a reason for hiding this comment

openjdk bot commented Jun 9, 2021

Wanghuang-Huawei commented Jun 9, 2021

openjdk bot commented Jun 9, 2021 • edited Loading

nsjian left a comment

Choose a reason for hiding this comment

sviswa7 commented Jun 10, 2021

Wanghuang-Huawei commented Jun 11, 2021

Wanghuang-Huawei commented Jun 11, 2021

openjdk bot commented Jun 11, 2021

Wanghuang-Huawei commented Jun 11, 2021

nsjian commented Jun 11, 2021

PaulSandoz commented Jun 11, 2021 • edited Loading

nsjian commented Jun 18, 2021

Wanghuang-Huawei commented Jun 24, 2021

Wanghuang-Huawei commented Jun 24, 2021

TobiHartmann commented Jul 6, 2021

Wanghuang-Huawei commented Apr 25, 2021 •

edited by openjdk bot

Loading

mlbridge bot commented Apr 25, 2021 •

edited

Loading

jatin-bhateja commented May 31, 2021 •

edited

Loading

openjdk bot commented Jun 9, 2021 •

edited

Loading

PaulSandoz commented Jun 11, 2021 •

edited

Loading