Skip to content
This repository has been archived by the owner on Jul 17, 2024. It is now read-only.
/ jdk22u Public archive

Commit

Permalink
8328702: C2: Crash during parsing because sub type check is not folded
Browse files Browse the repository at this point in the history
Reviewed-by: thartmann
Backport-of: e5e21a8a6e64466f9cda2064aa2723a15d4ae86a
  • Loading branch information
chhagedorn committed Apr 10, 2024
1 parent 98a63a8 commit 817cf13
Show file tree
Hide file tree
Showing 3 changed files with 141 additions and 4 deletions.
13 changes: 12 additions & 1 deletion src/hotspot/share/opto/graphKit.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2703,7 +2703,18 @@ Node* Phase::gen_subtype_check(Node* subklass, Node* superklass, Node** ctrl, No
// Foo[] fa = blah(); Foo x = fa[0]; fa[1] = x;
// Here, the type of 'fa' is often exact, so the store check
// of fa[1]=x will fold up, without testing the nullness of x.
switch (C->static_subtype_check(superk, subk)) {
//
// Do not skip the static sub type check with StressReflectiveCode during
// parsing (i.e. with ExpandSubTypeCheckAtParseTime) because the
// associated CheckCastNodePP could already be folded when the type
// system can prove it's an impossible type. Therefore, we should also
// do the static sub type check here to ensure control is folded as well.
// Otherwise, the graph is left in a broken state.
// At macro expansion, we would have already folded the SubTypeCheckNode
// being expanded here because we always perform the static sub type
// check in SubTypeCheckNode::sub() regardless of whether
// StressReflectiveCode is set or not.
switch (C->static_subtype_check(superk, subk, !ExpandSubTypeCheckAtParseTime)) {
case Compile::SSC_always_false:
{
Node* always_fail = *ctrl;
Expand Down
11 changes: 8 additions & 3 deletions src/hotspot/share/opto/type.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -6459,14 +6459,19 @@ template <class T1, class T2> bool TypePtr::maybe_java_subtype_of_helper_for_arr
if (other->klass() == ciEnv::current()->Object_klass() && other->_interfaces->empty() && other_exact) {
return true;
}
int dummy;
bool this_top_or_bottom = (this_one->base_element_type(dummy) == Type::TOP || this_one->base_element_type(dummy) == Type::BOTTOM);
if (!this_one->is_loaded() || !other->is_loaded() || this_top_or_bottom) {
if (!this_one->is_loaded() || !other->is_loaded()) {
return true;
}
if (this_one->is_instance_type(other)) {
return other->klass()->equals(ciEnv::current()->Object_klass()) && other->_interfaces->intersection_with(this_one->_interfaces)->eq(other->_interfaces);
}

int dummy;
bool this_top_or_bottom = (this_one->base_element_type(dummy) == Type::TOP || this_one->base_element_type(dummy) == Type::BOTTOM);
if (this_top_or_bottom) {
return true;
}

assert(this_one->is_array_type(other), "");

const T1* other_ary = this_one->is_array_type(other);
Expand Down
121 changes: 121 additions & 0 deletions test/hotspot/jtreg/compiler/types/TestSubTypeCheckWithBottomArray.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
/*
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

/*
* @test id=Xcomp
* @bug 8328702
* @summary Check that SubTypeCheckNode is properly folded when having an array with bottom type elements checked
* against an interface.
*
* @run main/othervm -Xcomp -XX:CompileCommand=compileonly,compiler.types.TestSubTypeCheckWithBottomArray::test*
* -XX:CompileCommand=inline,compiler.types.TestSubTypeCheckWithBottomArray::check*
* compiler.types.TestSubTypeCheckWithBottomArray
*/

/*
* @test id=Xbatch
* @bug 8328702
* @summary Check that SubTypeCheckNode is properly folded when having an array with bottom type elements checked
* against an interface.
*
* @run main/othervm -Xbatch -XX:CompileCommand=compileonly,compiler.types.TestSubTypeCheckWithBottomArray::test*
* -XX:CompileCommand=inline,compiler.types.TestSubTypeCheckWithBottomArray::check*
* compiler.types.TestSubTypeCheckWithBottomArray
*/

/*
* @test id=stress
* @bug 8328702
* @summary Check that PartialSubtypeCheckNode is properly folded when having an array with bottom type elements checked
* either against an interface or an unrelated non-sub-class.
*
* @run main/othervm -Xcomp -XX:CompileCommand=compileonly,compiler.types.TestSubTypeCheckWithBottomArray::test*
* -XX:+UnlockDiagnosticVMOptions -XX:+ExpandSubTypeCheckAtParseTime
* -XX:+IgnoreUnrecognizedVMOptions -XX:+StressReflectiveCode
* -XX:CompileCommand=inline,compiler.types.TestSubTypeCheckWithBottomArray::check*
* compiler.types.TestSubTypeCheckWithBottomArray
* @run main/othervm -Xbatch -XX:CompileCommand=compileonly,compiler.types.TestSubTypeCheckWithBottomArray::test*
* -XX:+UnlockDiagnosticVMOptions -XX:+ExpandSubTypeCheckAtParseTime
* -XX:+IgnoreUnrecognizedVMOptions -XX:+StressReflectiveCode
* -XX:CompileCommand=inline,compiler.types.TestSubTypeCheckWithBottomArray::check*
* compiler.types.TestSubTypeCheckWithBottomArray
*/

package compiler.types;

public class TestSubTypeCheckWithBottomArray {
static byte[] bArr = new byte[10];
static Object[] oArr = new Object[10];
static boolean flag;

public static void main(String[] args) {
A a = new A();
B b = new B();
Y y = new Y();
Z z = new Z();
for (int i = 0; i < 10000; i++) {
// With -Xcomp: Immediatly crashes because of no profiling -> don't know anything.
checkInterface(a); // Make sure that checkInterface() sometimes passes instanceof.
checkInterface(b); // Use two sub classes such that checkcast is required.
testInterface();

checkClass(y); // Make sure that checkClass() sometimes passes instanceof.
checkClass(z); // Use two sub classes such that checkcast is required.
testClass();
flag = !flag;
}
}

static void testInterface() {
checkInterface(flag ? bArr : oArr); // Inlined, never passes instanceof
}

static void checkInterface(Object o) {
if (o instanceof I i) {
// Use of i: Needs CheckCastPP which is replaced by top because [bottom <: I cannot be true.
// But: SubTypeCheckNode is not folded away -> broken graph (data dies, control not)
i.getClass();
}
}

static void testClass() {
checkClass(flag ? bArr : oArr); // Inlined, never passes instanceof
}

static void checkClass(Object o) {
if (o instanceof X x) {
// Use of i: Needs CheckCastPP which is replaced by top because [bottom <: I cannot be true.
// But: SubTypeCheckNode is not folded away -> broken graph (data dies, control not)
x.getClass();
}
}

}

interface I {}
class A implements I {}
class B implements I {}

class X {}
class Y extends X {}
class Z extends X {}

1 comment on commit 817cf13

@openjdk-notifier
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.