|
| 1 | +/* |
| 2 | + * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved. |
| 3 | + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| 4 | + * |
| 5 | + * This code is free software; you can redistribute it and/or modify it |
| 6 | + * under the terms of the GNU General Public License version 2 only, as |
| 7 | + * published by the Free Software Foundation. |
| 8 | + * |
| 9 | + * This code is distributed in the hope that it will be useful, but WITHOUT |
| 10 | + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| 11 | + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| 12 | + * version 2 for more details (a copy is included in the LICENSE file that |
| 13 | + * accompanied this code). |
| 14 | + * |
| 15 | + * You should have received a copy of the GNU General Public License version |
| 16 | + * 2 along with this work; if not, write to the Free Software Foundation, |
| 17 | + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| 18 | + * |
| 19 | + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| 20 | + * or visit www.oracle.com if you need additional information or have any |
| 21 | + * questions. |
| 22 | + */ |
| 23 | + |
| 24 | +package compiler.c2; |
| 25 | + |
| 26 | +/* |
| 27 | + * @test |
| 28 | + * @bug 8370405 |
| 29 | + * @summary Test case where we had escape analysis tell us that we can possibly eliminate |
| 30 | + * the array allocation, then MergeStores introduces a mismatched store, which |
| 31 | + * the actual elimination does not verify for. That led to wrong results. |
| 32 | + * @run main/othervm -XX:CompileCommand=compileonly,compiler.c2.TestMergeStoresAndAllocationElimination::test |
| 33 | + * -XX:CompileCommand=exclude,compiler.c2.TestMergeStoresAndAllocationElimination::dontinline |
| 34 | + * -XX:-TieredCompilation -Xbatch |
| 35 | + * -XX:+IgnoreUnrecognizedVMOptions -XX:-CICompileOSR |
| 36 | + * compiler.c2.TestMergeStoresAndAllocationElimination |
| 37 | + * @run main compiler.c2.TestMergeStoresAndAllocationElimination |
| 38 | + */ |
| 39 | + |
| 40 | +public class TestMergeStoresAndAllocationElimination { |
| 41 | + static void dontinline() {} |
| 42 | + |
| 43 | + static int test(boolean flag) { |
| 44 | + int[] arr = new int[4]; |
| 45 | + // The values below will be caputured as "raw stores" in the Initialize |
| 46 | + // of the array allocation above. |
| 47 | + // These stores are for cosmetics only, we set the "1" bits so that it is |
| 48 | + // simple to track where values are coming from. |
| 49 | + arr[0] = 0x0001_0000; |
| 50 | + arr[1] = 0x0010_0000; |
| 51 | + arr[2] = 0x0000_0100; |
| 52 | + arr[3] = 0x0100_0000; |
| 53 | + // So far, the result should be: |
| 54 | + // 0x421_0300 |
| 55 | + |
| 56 | + // The call below prevents further assignments from being captured into |
| 57 | + // the Initialize above. |
| 58 | + dontinline(); |
| 59 | + // The follwoing stores are eventually optimized by MergeStores, and create |
| 60 | + // a mismatched StoreL. |
| 61 | + arr[0] = 0x0000_0001; |
| 62 | + arr[1] = 0x0000_0010; |
| 63 | + // Now, the result should be: |
| 64 | + // 0x400_0321 |
| 65 | + |
| 66 | + // We create an uncommon trap because of an "unstable if". |
| 67 | + // If Escape Analysis were to work, it would try to capture the values |
| 68 | + // from the StoreL above. But because it is mismatched, it should fail. |
| 69 | + // What happened before that verification: we would take the ConL, and |
| 70 | + // insert it in a list of ConI. That meant that we eventually applied |
| 71 | + // that value wrong if the deopt was taken (flag = true). |
| 72 | + // |
| 73 | + // What happened when the deopt got the wrong values: It got these values: |
| 74 | + // [0]=68719476737 = 0x10_0000_0001 -> long value, not correct |
| 75 | + // [1]=1048576 = 0x10_0000 -> this entry is not updated! |
| 76 | + // [2]=256 = 0x100 |
| 77 | + // [3]=16777216 = 0x100_0000 |
| 78 | + // |
| 79 | + // This is serialized as a long and 3 ints, and that looks like 5 ints. |
| 80 | + // This creates an array of 5 elements (and not 4): |
| 81 | + // [0] = 0x1 |
| 82 | + // [1] = 0x10 |
| 83 | + // [2] = 0x10_0000 -> this entry is "inserted" |
| 84 | + // [3] = 0x100 |
| 85 | + // [4] = 0x100_0000 |
| 86 | + // |
| 87 | + // This creates the wrong state: |
| 88 | + // 0x30_0421 |
| 89 | + // And we can actually read that the arr.length is 5, below. |
| 90 | + if (flag) { System.out.println("unstable if: " + arr.length); } |
| 91 | + |
| 92 | + // Delay the allocation elimination until after loop opts, so that it |
| 93 | + // happens after MergeStores. Without this, we would immediately |
| 94 | + // eliminate the allocation during Escape Analysis, and then MergeStores |
| 95 | + // would not find the stores that would be removed with the allocation. |
| 96 | + for (int i = 0; i < 10_000; i++) { |
| 97 | + arr[3] = 0x0000_1000; |
| 98 | + } |
| 99 | + // Coming from the correct value, we should have transition of state: |
| 100 | + // 0x400_0321 -> 0x4321 |
| 101 | + // But coming from the bad (rematerialized) state, we transition: |
| 102 | + // 0x30_0421 -> 0x30_4021 |
| 103 | + |
| 104 | + // Tag each entry with an index number |
| 105 | + // We expect: 0x4321 |
| 106 | + return 1 * arr[0] + 2 * arr[1] + 3 * arr[2] + 4 * arr[3]; |
| 107 | + } |
| 108 | + |
| 109 | + public static void main(String[] args) { |
| 110 | + // Capture interpreter result. |
| 111 | + int gold = test(false); |
| 112 | + // Repeat until we get compilation. |
| 113 | + for (int i = 0; i < 10_000; i++) { |
| 114 | + test(false); |
| 115 | + } |
| 116 | + // Capture compiled results. |
| 117 | + int res0 = test(false); |
| 118 | + int res1 = test(true); |
| 119 | + if (res0 != gold || res1 != gold) { |
| 120 | + throw new RuntimeException("Unexpected result: " + Integer.toHexString(res0) + " and " + Integer.toHexString(res1) + ", should be: " + Integer.toHexString(gold)); |
| 121 | + } |
| 122 | + } |
| 123 | +} |
0 commit comments