8370332: C2 SuperWord: SIGSEGV because PhaseIdealLoop::split_thru_phi left dead nodes in loop _body

Reviewed-by: chagedorn, roland

Author: eme64

src/hotspot/share/opto/loopnode.hpp

@@ -1742,6 +1742,9 @@ class PhaseIdealLoop : public PhaseTransform {
     }
   };
 
+
+  void split_thru_phi_yank_old_nodes(Node* n, Node* region);
+
 public:
 
   // Conversion of fill/copy patterns into intrinsic versions

src/hotspot/share/opto/loopopts.cpp

@@ -228,6 +228,9 @@ Node* PhaseIdealLoop::split_thru_phi(Node* n, Node* region, int policy) {
     }
   }
 
+  split_thru_phi_yank_old_nodes(n, region);
+  _igvn.replace_node(n, phi);
+
 #ifndef PRODUCT
   if (TraceLoopOpts) {
     tty->print_cr("Split %d %s through %d Phi in %d %s",
@@ -238,6 +241,28 @@ Node* PhaseIdealLoop::split_thru_phi(Node* n, Node* region, int policy) {
   return phi;
 }
 
+// If the region is a Loop, we are removing the old n,
+// and need to yank it from the _body. If any phi we
+// just split through now has no use any more, it also
+// has to be removed.
+void PhaseIdealLoop::split_thru_phi_yank_old_nodes(Node* n, Node* region) {
+  IdealLoopTree* region_loop = get_loop(region);
+  if (region->is_Loop() && region_loop->is_innermost()) {
+    region_loop->_body.yank(n);
+    for (uint j = 1; j < n->req(); j++) {
+      PhiNode* phi = n->in(j)->isa_Phi();
+      // Check that phi belongs to the region and only has n as a use.
+      if (phi != nullptr &&
+          phi->in(0) == region &&
+          phi->unique_multiple_edges_out_or_null() == n) {
+        assert(get_ctrl(phi) == region, "sanity");
+        assert(get_ctrl(n) == region, "sanity");
+        region_loop->_body.yank(phi);
+      }
+    }
+  }
+}
+
 // Test whether node 'x' can move into an inner loop relative to node 'n'.
 // Note: The test is not exact. Returns true if 'x' COULD end up in an inner loop,
 // BUT it can also return true and 'x' is in the outer loop
@@ -1207,13 +1232,10 @@ Node *PhaseIdealLoop::split_if_with_blocks_pre( Node *n ) {
 
   if (must_throttle_split_if()) return n;
 
-  // Split 'n' through the merge point if it is profitable
-  Node *phi = split_thru_phi( n, n_blk, policy );
-  if (!phi) return n;
+  // Split 'n' through the merge point if it is profitable, replacing it with a new phi.
+  Node* phi = split_thru_phi(n, n_blk, policy);
+  if (phi == nullptr) { return n; }
 
-  // Found a Phi to split thru!
-  // Replace 'n' with the new phi
-  _igvn.replace_node( n, phi );
   // Moved a load around the loop, 'en-registering' something.
   if (n_blk->is_Loop() && n->is_Load() &&
       !phi->in(LoopNode::LoopBackControl)->is_Load())
@@ -1444,15 +1466,9 @@ void PhaseIdealLoop::split_if_with_blocks_post(Node *n) {
       return;
     }
 
-    // Found a Phi to split thru!
-    // Replace 'n' with the new phi
-    _igvn.replace_node(n, phi);
-
     // Now split the bool up thru the phi
-    Node *bolphi = split_thru_phi(bol, n_ctrl, -1);
+    Node* bolphi = split_thru_phi(bol, n_ctrl, -1);
     guarantee(bolphi != nullptr, "null boolean phi node");
-
-    _igvn.replace_node(bol, bolphi);
     assert(iff->in(1) == bolphi, "");
 
     if (bolphi->Value(&_igvn)->singleton()) {
@@ -1461,8 +1477,7 @@ void PhaseIdealLoop::split_if_with_blocks_post(Node *n) {
 
     // Conditional-move?  Must split up now
     if (!iff->is_If()) {
-      Node *cmovphi = split_thru_phi(iff, n_ctrl, -1);
-      _igvn.replace_node(iff, cmovphi);
+      Node* cmovphi = split_thru_phi(iff, n_ctrl, -1);
       return;
     }
 

src/hotspot/share/opto/node.cpp

@@ -2889,6 +2889,20 @@ Node* Node::find_similar(int opc) {
   return nullptr;
 }
 
+Node* Node::unique_multiple_edges_out_or_null() const {
+  Node* use = nullptr;
+  for (DUIterator_Fast kmax, k = fast_outs(kmax); k < kmax; k++) {
+    Node* u = fast_out(k);
+    if (use == nullptr) {
+      use = u; // first use
+    } else if (u != use) {
+      return nullptr; // not unique
+    } else {
+      // secondary use
+    }
+  }
+  return use;
+}
 
 //--------------------------unique_ctrl_out_or_null-------------------------
 // Return the unique control out if only one. Null if none or more than one.

src/hotspot/share/opto/node.hpp

@@ -422,6 +422,13 @@ class Node {
   Node* raw_out(uint i) const { assert(i < _outcnt,"oob"); return _out[i]; }
   // Return the unique out edge.
   Node* unique_out() const { assert(_outcnt==1,"not unique"); return _out[0]; }
+
+  // In some cases, a node n is only used by a single use, but the use may use
+  // n once or multiple times:
+  //   use = ConvF2I(this)
+  //   use = AddI(this, this)
+  Node* unique_multiple_edges_out_or_null() const;
+
   // Delete out edge at position 'i' by moving last out edge to position 'i'
   void  raw_del_out(uint i) {
     assert(i < _outcnt,"oob");

test/hotspot/jtreg/compiler/loopopts/TestSplitThruPhiRemoveDeadNodesFromLoopBody.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test id=with-flags
+ * @bug 8370332
+ * @summary This test shows a case where split_if split a node through a phi, but left the
+ *          dead node and a dead phi in the loop _body. Subsequently, SuperWord was run, and
+ *          found the dead nodes in the _body, which is not expected.
+ * @run main/othervm
+ *      -XX:CompileCommand=compileonly,*TestSplitThruPhiRemoveDeadNodesFromLoopBody::test
+ *      -Xbatch
+ *      compiler.loopopts.superword.TestSplitThruPhiRemoveDeadNodesFromLoopBody
+ */
+
+/*
+ * @test id=vanilla
+ * @bug 8370332
+ * @run main compiler.loopopts.superword.TestSplitThruPhiRemoveDeadNodesFromLoopBody
+ */
+
+package compiler.loopopts.superword;
+
+public class TestSplitThruPhiRemoveDeadNodesFromLoopBody {
+    static int N = 400;
+    static float floatZero = 0;
+    static boolean falseFlag = false;;
+
+    static int fieldStore = 0;
+    static int fieldIncr = 0;
+    static int arrayI[] = new int[N];
+
+    static void inlined() {
+        int x = 0;
+        for (int i = 0; i < 100; i++) {
+            fieldStore = 42;
+            if (falseFlag) {
+                for (int k = 0; k < 20; k++) {
+                    x += i;
+                }
+            }
+        }
+    }
+
+    static void test() {
+        inlined();
+        for (int k = 0; k < 10; k++) {
+            for (int j = 0; j < 100; j++) {
+                fieldIncr += floatZero;
+                arrayI[j] = 42; // SuperWord happens here -> SIGSEGV
+            }
+        }
+    }
+
+    public static void main(String[] strArr) {
+        for (int i = 0; i < 1_000; i++) {
+            test();
+        }
+    }
+}