src/share/vm/opto/loopTransform.cpp
Index Unified diffs Context diffs Sdiffs Patch New Old Previous File Next File hotspot Sdiff src/share/vm/opto

src/share/vm/opto/loopTransform.cpp

Print this page
rev 7345 : 8054478: C2: Incorrectly compiled char[] array access crashes JVM
Summary: propagate node replacements along control flow edges to callers
Reviewed-by: dead backbranch in main loop results in erroneous array access
rev 7347 : reviews


  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "compiler/compileLog.hpp"
  27 #include "memory/allocation.inline.hpp"
  28 #include "opto/addnode.hpp"
  29 #include "opto/callnode.hpp"

  30 #include "opto/connode.hpp"
  31 #include "opto/convertnode.hpp"
  32 #include "opto/divnode.hpp"
  33 #include "opto/loopnode.hpp"
  34 #include "opto/mulnode.hpp"
  35 #include "opto/movenode.hpp"
  36 #include "opto/opaquenode.hpp"
  37 #include "opto/rootnode.hpp"
  38 #include "opto/runtime.hpp"
  39 #include "opto/subnode.hpp"
  40 
  41 //------------------------------is_loop_exit-----------------------------------
  42 // Given an IfNode, return the loop-exiting projection or NULL if both
  43 // arms remain in the loop.
  44 Node *IdealLoopTree::is_loop_exit(Node *iff) const {
  45   if( iff->outcnt() != 2 ) return NULL; // Ignore partially dead tests
  46   PhaseIdealLoop *phase = _phase;
  47   // Test is an IfNode, has 2 projections.  If BOTH are in the loop
  48   // we need loop unswitching instead of peeling.
  49   if( !is_member(phase->get_loop( iff->raw_out(0) )) )


 868   for( uint i = 1; i < n->req(); i++ ) {
 869     Node *g = clone_up_backedge_goo( back_ctrl, preheader_ctrl, n->in(i), visited, clones );
 870     if( g != n->in(i) ) {
 871       if( !x ) {
 872         assert(clones.find(n->_idx) == NULL, "dead loop");
 873         x = n->clone();
 874         clones.push(x, n->_idx);
 875       }
 876       x->set_req(i, g);
 877     }
 878   }
 879   if( x ) {                     // x can legally float to pre-header location
 880     register_new_node( x, preheader_ctrl );
 881     return x;
 882   } else {                      // raise n to cover LCA of uses
 883     set_ctrl( n, find_non_split_ctrl(back_ctrl->in(0)) );
 884   }
 885   return n;
 886 }
 887 














 888 //------------------------------insert_pre_post_loops--------------------------
 889 // Insert pre and post loops.  If peel_only is set, the pre-loop can not have
 890 // more iterations added.  It acts as a 'peel' only, no lower-bound RCE, no
 891 // alignment.  Useful to unroll loops that do no array accesses.
 892 void PhaseIdealLoop::insert_pre_post_loops( IdealLoopTree *loop, Node_List &old_new, bool peel_only ) {
 893 
 894 #ifndef PRODUCT
 895   if (TraceLoopOpts) {
 896     if (peel_only)
 897       tty->print("PeelMainPost ");
 898     else
 899       tty->print("PreMainPost  ");
 900     loop->dump_head();
 901   }
 902 #endif
 903   C->set_major_progress();
 904 
 905   // Find common pieces of the loop being guarded with pre & post loops
 906   CountedLoopNode *main_head = loop->_head->as_CountedLoop();
 907   assert( main_head->is_normal_loop(), "" );


1063   _igvn.hash_delete( main_head );
1064   main_head->set_req(LoopNode::EntryControl, min_taken);
1065   set_idom(main_head, min_taken, dd_main_head);
1066 
1067   visited.Clear();
1068   clones.clear();
1069   // Step B3: Make the fall-in values to the main-loop come from the
1070   // fall-out values of the pre-loop.
1071   for (DUIterator_Fast i2max, i2 = main_head->fast_outs(i2max); i2 < i2max; i2++) {
1072     Node* main_phi = main_head->fast_out(i2);
1073     if( main_phi->is_Phi() && main_phi->in(0) == main_head && main_phi->outcnt() > 0 ) {
1074       Node *pre_phi = old_new[main_phi->_idx];
1075       Node *fallpre  = clone_up_backedge_goo(pre_head->back_control(),
1076                                              main_head->init_control(),
1077                                              pre_phi->in(LoopNode::LoopBackControl),
1078                                              visited, clones);
1079       _igvn.hash_delete(main_phi);
1080       main_phi->set_req( LoopNode::EntryControl, fallpre );
1081     }
1082   }


















1083 
1084   // Step B4: Shorten the pre-loop to run only 1 iteration (for now).
1085   // RCE and alignment may change this later.
1086   Node *cmp_end = pre_end->cmp_node();
1087   assert( cmp_end->in(2) == limit, "" );
1088   Node *pre_limit = new AddINode( init, stride );
1089 
1090   // Save the original loop limit in this Opaque1 node for
1091   // use by range check elimination.
1092   Node *pre_opaq  = new Opaque1Node(C, pre_limit, limit);
1093 
1094   register_new_node( pre_limit, pre_head->in(0) );
1095   register_new_node( pre_opaq , pre_head->in(0) );
1096 
1097   // Since no other users of pre-loop compare, I can hack limit directly
1098   assert( cmp_end->outcnt() == 1, "no other users" );
1099   _igvn.hash_delete(cmp_end);
1100   cmp_end->set_req(2, peel_only ? pre_limit : pre_opaq);
1101 
1102   // Special case for not-equal loop bounds:




  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "compiler/compileLog.hpp"
  27 #include "memory/allocation.inline.hpp"
  28 #include "opto/addnode.hpp"
  29 #include "opto/callnode.hpp"
  30 #include "opto/castnode.hpp"
  31 #include "opto/connode.hpp"
  32 #include "opto/convertnode.hpp"
  33 #include "opto/divnode.hpp"
  34 #include "opto/loopnode.hpp"
  35 #include "opto/mulnode.hpp"
  36 #include "opto/movenode.hpp"
  37 #include "opto/opaquenode.hpp"
  38 #include "opto/rootnode.hpp"
  39 #include "opto/runtime.hpp"
  40 #include "opto/subnode.hpp"
  41 
  42 //------------------------------is_loop_exit-----------------------------------
  43 // Given an IfNode, return the loop-exiting projection or NULL if both
  44 // arms remain in the loop.
  45 Node *IdealLoopTree::is_loop_exit(Node *iff) const {
  46   if( iff->outcnt() != 2 ) return NULL; // Ignore partially dead tests
  47   PhaseIdealLoop *phase = _phase;
  48   // Test is an IfNode, has 2 projections.  If BOTH are in the loop
  49   // we need loop unswitching instead of peeling.
  50   if( !is_member(phase->get_loop( iff->raw_out(0) )) )


 869   for( uint i = 1; i < n->req(); i++ ) {
 870     Node *g = clone_up_backedge_goo( back_ctrl, preheader_ctrl, n->in(i), visited, clones );
 871     if( g != n->in(i) ) {
 872       if( !x ) {
 873         assert(clones.find(n->_idx) == NULL, "dead loop");
 874         x = n->clone();
 875         clones.push(x, n->_idx);
 876       }
 877       x->set_req(i, g);
 878     }
 879   }
 880   if( x ) {                     // x can legally float to pre-header location
 881     register_new_node( x, preheader_ctrl );
 882     return x;
 883   } else {                      // raise n to cover LCA of uses
 884     set_ctrl( n, find_non_split_ctrl(back_ctrl->in(0)) );
 885   }
 886   return n;
 887 }
 888 
 889 bool PhaseIdealLoop::cast_incr_before_loop(Node* incr, Node* ctrl, Node* loop) {
 890   Node* castii = new CastIINode(incr, TypeInt::INT, true);
 891   castii->set_req(0, ctrl);
 892   register_new_node(castii, ctrl);
 893   for (DUIterator_Fast imax, i = incr->fast_outs(imax); i < imax; i++) {
 894     Node* n = incr->fast_out(i);
 895     if (n->is_Phi() && n->in(0) == loop) {
 896       int nrep = n->replace_edge(incr, castii);
 897       return true;
 898     }
 899   }
 900   return false;
 901 }
 902 
 903 //------------------------------insert_pre_post_loops--------------------------
 904 // Insert pre and post loops.  If peel_only is set, the pre-loop can not have
 905 // more iterations added.  It acts as a 'peel' only, no lower-bound RCE, no
 906 // alignment.  Useful to unroll loops that do no array accesses.
 907 void PhaseIdealLoop::insert_pre_post_loops( IdealLoopTree *loop, Node_List &old_new, bool peel_only ) {
 908 
 909 #ifndef PRODUCT
 910   if (TraceLoopOpts) {
 911     if (peel_only)
 912       tty->print("PeelMainPost ");
 913     else
 914       tty->print("PreMainPost  ");
 915     loop->dump_head();
 916   }
 917 #endif
 918   C->set_major_progress();
 919 
 920   // Find common pieces of the loop being guarded with pre & post loops
 921   CountedLoopNode *main_head = loop->_head->as_CountedLoop();
 922   assert( main_head->is_normal_loop(), "" );


1078   _igvn.hash_delete( main_head );
1079   main_head->set_req(LoopNode::EntryControl, min_taken);
1080   set_idom(main_head, min_taken, dd_main_head);
1081 
1082   visited.Clear();
1083   clones.clear();
1084   // Step B3: Make the fall-in values to the main-loop come from the
1085   // fall-out values of the pre-loop.
1086   for (DUIterator_Fast i2max, i2 = main_head->fast_outs(i2max); i2 < i2max; i2++) {
1087     Node* main_phi = main_head->fast_out(i2);
1088     if( main_phi->is_Phi() && main_phi->in(0) == main_head && main_phi->outcnt() > 0 ) {
1089       Node *pre_phi = old_new[main_phi->_idx];
1090       Node *fallpre  = clone_up_backedge_goo(pre_head->back_control(),
1091                                              main_head->init_control(),
1092                                              pre_phi->in(LoopNode::LoopBackControl),
1093                                              visited, clones);
1094       _igvn.hash_delete(main_phi);
1095       main_phi->set_req( LoopNode::EntryControl, fallpre );
1096     }
1097   }
1098 
1099   // Nodes inside the loop may be control dependent on a predicate
1100   // that was moved before the preloop. If the back branch of the main
1101   // or post loops becomes dead, those nodes won't be dependent on the
1102   // test that guards that loop nest anymore which could lead to an
1103   // incorrect array access because it executes independently of the
1104   // test that was guarding the loop nest. We add a special CastII on
1105   // the if branch that enters the loop, between the input induction
1106   // variable value and the induction variable Phi to preserve correct
1107   // dependencies.
1108 
1109   // CastII for the post loop:
1110   bool inserted = cast_incr_before_loop(zer_opaq->in(1), zer_taken, post_head);
1111   assert(inserted, "no castII inserted");
1112 
1113   // CastII for the main loop:
1114   inserted = cast_incr_before_loop(pre_incr, min_taken, main_head);
1115   assert(inserted, "no castII inserted");
1116 
1117   // Step B4: Shorten the pre-loop to run only 1 iteration (for now).
1118   // RCE and alignment may change this later.
1119   Node *cmp_end = pre_end->cmp_node();
1120   assert( cmp_end->in(2) == limit, "" );
1121   Node *pre_limit = new AddINode( init, stride );
1122 
1123   // Save the original loop limit in this Opaque1 node for
1124   // use by range check elimination.
1125   Node *pre_opaq  = new Opaque1Node(C, pre_limit, limit);
1126 
1127   register_new_node( pre_limit, pre_head->in(0) );
1128   register_new_node( pre_opaq , pre_head->in(0) );
1129 
1130   // Since no other users of pre-loop compare, I can hack limit directly
1131   assert( cmp_end->outcnt() == 1, "no other users" );
1132   _igvn.hash_delete(cmp_end);
1133   cmp_end->set_req(2, peel_only ? pre_limit : pre_opaq);
1134 
1135   // Special case for not-equal loop bounds:


src/share/vm/opto/loopTransform.cpp
Index Unified diffs Context diffs Sdiffs Patch New Old Previous File Next File