From c3f755c69bf3d5fb7b340e99cff0b7d4d4ca18e0 Mon Sep 17 00:00:00 2001 From: Ozan Cetin Date: Thu, 29 Jan 2026 12:43:48 +0000 Subject: [PATCH] Backport e85d5d7a16024f6a3eda14f1e08f72e07ae38dd0 --- src/hotspot/share/opto/vector.cpp | 38 +++---------- .../vectorapi/VectorBoxExpandPhi.java | 50 +++++++++++++++++ .../vectorapi/VectorBoxExpandProj.java | 54 +++++++++++++++++++ 3 files changed, 112 insertions(+), 30 deletions(-) create mode 100644 test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandPhi.java create mode 100644 test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandProj.java diff --git a/src/hotspot/share/opto/vector.cpp b/src/hotspot/share/opto/vector.cpp index 4ffbd2e96b4..527ba17f0fc 100644 --- a/src/hotspot/share/opto/vector.cpp +++ b/src/hotspot/share/opto/vector.cpp @@ -326,37 +326,15 @@ Node* PhaseVector::expand_vbox_node_helper(Node* vbox, return expand_vbox_alloc_node(vbox_alloc, vect, box_type, vect_type); } - // Handle the case when both the allocation input and vector input to - // VectorBoxNode are Phi. This case is generated after the transformation of - // Phi: Phi (VectorBox1 VectorBox2) => VectorBox (Phi1 Phi2). - // With this optimization, the relative two allocation inputs of VectorBox1 and - // VectorBox2 are gathered into Phi1 now. Similarly, the original vector - // inputs of two VectorBox nodes are in Phi2. - // - // See PhiNode::merge_through_phi in cfg.cpp for more details. - if (vbox->is_Phi() && vect->is_Phi()) { - assert(vbox->as_Phi()->region() == vect->as_Phi()->region(), ""); + // Handle the case when the allocation input to VectorBoxNode is a Phi. + // This is generated after the transformation in PhiNode::merge_through_phi: + // Phi (VectorBox1 VectorBox2) => VectorBox (Phi1 Phi2) + // The vector input may also be a Phi (Phi2 above), or it may have been + // value-numbered to a single node if all inputs were identical. + if (vbox->is_Phi()) { + bool same_region = vect->is_Phi() && vbox->as_Phi()->region() == vect->as_Phi()->region(); for (uint i = 1; i < vbox->req(); i++) { - Node* new_box = expand_vbox_node_helper(vbox->in(i), vect->in(i), - box_type, vect_type, visited); - if (!new_box->is_Phi()) { - C->initial_gvn()->hash_delete(vbox); - vbox->set_req(i, new_box); - } - } - return C->initial_gvn()->transform(vbox); - } - - // Handle the case when the allocation input to VectorBoxNode is a phi - // but the vector input is not, which can definitely be the case if the - // vector input has been value-numbered. It seems to be safe to do by - // construction because VectorBoxNode and VectorBoxAllocate come in a - // specific order as a result of expanding an intrinsic call. After that, if - // any of the inputs to VectorBoxNode are value-numbered they can only - // move up and are guaranteed to dominate. - if (vbox->is_Phi() && (vect->is_Vector() || vect->is_LoadVector())) { - for (uint i = 1; i < vbox->req(); i++) { - Node* new_box = expand_vbox_node_helper(vbox->in(i), vect, + Node* new_box = expand_vbox_node_helper(vbox->in(i), same_region ? vect->in(i) : vect, box_type, vect_type, visited); if (!new_box->is_Phi()) { C->initial_gvn()->hash_delete(vbox); diff --git a/test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandPhi.java b/test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandPhi.java new file mode 100644 index 00000000000..936d24e4767 --- /dev/null +++ b/test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandPhi.java @@ -0,0 +1,50 @@ +/* + * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package compiler.vectorapi; + +import jdk.incubator.vector.*; + +/* + * @test + * @bug 8374903 + * @summary C2 crashes when VectorBox Phi and vector Phi have different regions + * @modules jdk.incubator.vector + * @library /test/lib + * + * @run main/othervm -Xbatch -XX:CompileCommand=compileonly,compiler.vectorapi.VectorBoxExpandPhi::test compiler.vectorapi.VectorBoxExpandPhi + */ +public class VectorBoxExpandPhi { + public static void main(String[] args) { + for (int i = 0; i < 10_000; i++) { + test(); + } + } + + public static Object test() { + var v0 = DoubleVector.broadcast(DoubleVector.SPECIES_128, 1.0); + var v1 = (FloatVector)v0.convertShape(VectorOperators.Conversion.ofCast(double.class, float.class), FloatVector.SPECIES_64, 0); + var v2 = (FloatVector)v1.convertShape(VectorOperators.Conversion.ofReinterpret(float.class, float.class), FloatVector.SPECIES_64, 0); + return v2; + } +} diff --git a/test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandProj.java b/test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandProj.java new file mode 100644 index 00000000000..5d152834b17 --- /dev/null +++ b/test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandProj.java @@ -0,0 +1,54 @@ +/* + * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package compiler.vectorapi; + +import jdk.incubator.vector.*; + +/* + * @test + * @bug 8375010 + * @summary C2 crashes when expanding VectorBox with Proj input from vector math call + * @modules jdk.incubator.vector + * @library /test/lib + * + * @run main/othervm -Xbatch -XX:CompileCommand=compileonly,compiler.vectorapi.VectorBoxExpandProj::test compiler.vectorapi.VectorBoxExpandProj + */ +public class VectorBoxExpandProj { + static boolean b; + + public static void main(String[] args) { + for (int i = 0; i < 20_000; i++) { + b = !b; + test(); + } + System.out.println("PASS"); + } + + // TAN returns Proj (not VectorNode). Phi merging creates VectorBox(Phi, Proj). + // expand_vbox_node_helper must handle Proj inputs with vector type. + static Object test() { + var t = DoubleVector.broadcast(DoubleVector.SPECIES_128, 1.0).lanewise(VectorOperators.TAN); + return b ? t.convertShape(VectorOperators.Conversion.ofCast(double.class, double.class), DoubleVector.SPECIES_128, 0) : t; + } +}