8288204: GVN Crash: assert() failed: correct memory chain

Reviewed-by: kvn, thartmann

Author: y1yang0

src/hotspot/share/opto/cfgnode.cpp

@@ -1023,14 +1023,6 @@ PhiNode* PhiNode::slice_memory(const TypePtr* adr_type) const {
 PhiNode* PhiNode::split_out_instance(const TypePtr* at, PhaseIterGVN *igvn) const {
   const TypeOopPtr *t_oop = at->isa_oopptr();
   assert(t_oop != NULL && t_oop->is_known_instance(), "expecting instance oopptr");
-  const TypePtr *t = adr_type();
-  assert(type() == Type::MEMORY &&
-         (t == TypePtr::BOTTOM || t == TypeRawPtr::BOTTOM ||
-          t->isa_oopptr() && !t->is_oopptr()->is_known_instance() &&
-          t->is_oopptr()->cast_to_exactness(true)
-           ->is_oopptr()->cast_to_ptr_type(t_oop->ptr())
-           ->is_oopptr()->cast_to_instance_id(t_oop->instance_id()) == t_oop),
-         "bottom or raw memory required");
 
   // Check if an appropriate node already exists.
   Node *region = in(0);

src/hotspot/share/opto/memnode.cpp

@@ -215,11 +215,26 @@ Node *MemNode::optimize_memory_chain(Node *mchain, const TypePtr *t_adr, Node *l
     PhiNode *mphi = result->as_Phi();
     assert(mphi->bottom_type() == Type::MEMORY, "memory phi required");
     const TypePtr *t = mphi->adr_type();
-    if (t == TypePtr::BOTTOM || t == TypeRawPtr::BOTTOM ||
-        (t->isa_oopptr() && !t->is_oopptr()->is_known_instance() &&
-         t->is_oopptr()->cast_to_exactness(true)
-           ->is_oopptr()->cast_to_ptr_type(t_oop->ptr())
-            ->is_oopptr()->cast_to_instance_id(t_oop->instance_id()) == t_oop)) {
+    bool do_split = false;
+    // In the following cases, Load memory input can be further optimized based on
+    // its precise address type
+    if (t == TypePtr::BOTTOM || t == TypeRawPtr::BOTTOM ) {
+      do_split = true;
+    } else if (t->isa_oopptr() && !t->is_oopptr()->is_known_instance()) {
+      const TypeOopPtr* mem_t =
+        t->is_oopptr()->cast_to_exactness(true)
+        ->is_oopptr()->cast_to_ptr_type(t_oop->ptr())
+        ->is_oopptr()->cast_to_instance_id(t_oop->instance_id());
+      if (t_oop->is_aryptr()) {
+        mem_t = mem_t->is_aryptr()
+                     ->cast_to_stable(t_oop->is_aryptr()->is_stable())
+                     ->cast_to_size(t_oop->is_aryptr()->size())
+                     ->with_offset(t_oop->is_aryptr()->offset())
+                     ->is_aryptr();
+      }
+      do_split = mem_t == t_oop;
+    }
+    if (do_split) {
       // clone the Phi with our address type
       result = mphi->split_out_instance(t_adr, igvn);
     } else {

test/hotspot/jtreg/compiler/c2/TestGVNCrash.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2022, Alibaba Group Holding Limited. All Rights Reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ *
+ */
+
+/**
+ * @test
+ * @key stress randomness
+ * @bug 8288204
+ * @summary GVN Crash: assert() failed: correct memory chain
+ *
+ * @run main/othervm -Xbatch -XX:+UnlockDiagnosticVMOptions -XX:+StressIGVN -XX:CompileCommand=compileonly,compiler.c2.TestGVNCrash::test compiler.c2.TestGVNCrash
+ */
+
+package compiler.c2;
+
+public class TestGVNCrash {
+    public static int iField = 0;
+    public static double[] dArrFld = new double[256];
+    public static int[] iArrFld = new int[256];
+    public int[][] iArrFld1 = new int[256][256];
+
+    public void test() {
+        int x = 0;
+        for (int i = 0; i < 10; i++) {
+            do {
+                for (float j = 0; j < 0; j++) {
+                    iArrFld[x] = 3;
+                    iArrFld1[1][x] -= iField;
+                    dArrFld = new double[256];
+                    for (int k = 0; k < dArrFld.length; k++) {
+                        dArrFld[k] = (k % 2 == 0) ? k + 1 : k - 1;
+                    }
+                }
+            } while (++x < 5);
+            for (int j = 0; j < 100_000; j++) {
+                String s = "test";
+                s = s + s;
+                s = s + s;
+            }
+        }
+    }
+
+    public static void main(String[] args) {
+        TestGVNCrash t = new TestGVNCrash();
+        t.test();
+    }
+}