8374783: C2 compilation asserts with "slice of address and input slice don't match" by robcasloz · Pull Request #31500 · openjdk/jdk

robcasloz · 2026-06-12T12:20:21Z

This changeset forces an incremental inlining cleanup whenever an incrementally inlined call exposes an address where the offset becomes constant. This is necessary to prevent slice mismatches when parsing subsequent accesses to the address due to outdated IGVN-recorded address type information, see more details in the JBS issue. If not prevented, such mismatches can lead to e.g. incorrect memory graphs, as illustrated in the included test file.

This solution is the most effective and least intrusive one among a few evaluated options, see JBS issue.

Testing

tier1-4, stress test
original test (applications/ctw/modules/jdk_jpackage.java)
LLM-guided fuzzing (linux-x64 only)

Thanks to @iwanowww for useful discussions and suggestions!

I confirm that I make this contribution in accordance with the OpenJDK Interim AI Policy.

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed (2 reviews required, with at least 1 Reviewer, 1 Author)

Issue

JDK-8374783: C2 compilation asserts with "slice of address and input slice don't match" (Bug - P3)(⚠️ The fixVersion in this issue is [27] but the fixVersion in .jcheck/conf is 28, a new backport will be created when this pr is integrated.)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/31500/head:pull/31500
$ git checkout pull/31500

Update a local copy of the PR:
$ git checkout pull/31500
$ git pull https://git.openjdk.org/jdk.git pull/31500/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 31500

View PR using the GUI difftool:
$ git pr show -t 31500

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/31500.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2026-06-12T12:22:31Z

👋 Welcome back rcastanedalo! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2026-06-12T12:24:29Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2026-06-12T12:25:15Z

@robcasloz The following labels will be automatically applied to this pull request:

core-libs
hotspot

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

openjdk · 2026-06-12T12:25:17Z

The total number of required reviews for this PR has been set to 2 based on the presence of this label: hotspot. This can be overridden with the /reviewers command.

robcasloz · 2026-06-12T13:43:26Z

/label remove core-libs,hotspot

openjdk · 2026-06-12T13:45:02Z

@robcasloz
The core-libs label was successfully removed.

The hotspot label was successfully removed.

robcasloz · 2026-06-12T13:46:22Z

/label add hotspot-compiler

openjdk · 2026-06-12T13:47:30Z

@robcasloz
The hotspot-compiler label was successfully added.

mlbridge · 2026-06-12T14:02:39Z

Webrevs

merykitty · 2026-06-12T15:42:13Z

I think this does not cover all the cases. What if we have an Object + 8, then late inlining reveals that Object here really is an Integer, which means the access is really to Integer.value, will that raise a similar issue?

… discovered late

robcasloz · 2026-06-15T10:17:06Z

I think this does not cover all the cases. What if we have an Object + 8, then late inlining reveals that Object here really is an Integer, which means the access is really to Integer.value, will that raise a similar issue?

Thanks Quan, I have not found any case where discovering the base address type after late inlining triggers this issue, because there seems to always be some casting that blocks the reuse of the unsafe load's AddP node by the subsequent memory access. I have added a test case illustrating this scenario (commit e6bde69), here is how the addresses look like when the second memory access (154 LoadI) is parsed:

I have done some fuzzing to try to find some variant of this case where both AddP nodes can be unified but could not find any. Let me know if you had a different scenario in mind.

robcasloz · 2026-06-15T13:17:00Z

I just added yet another test variant using an array instead of a class instance (commit c605fa2). In this case, no slice mismatch occurs either, because both the offset-known and unknown address types map to the same memory slice. Even thought it is not strictly necessary, the changeset enforces a cleanup between the incremental inlining steps in this case as well.

iwanowww

Overall, looks reasonable, but I'm not persuaded yet the base case is not affected in a similar manner (Object -> A transition during late inlining).

As an alternative way to fix the problem, the result can be wrapped into an Opaque flavor which vanished during the very first IGVN pass. In general, it would provoke fewer cleanup passes and can be applied in broader than strictly required scenarios (if it turns out it's tricky to detect affected cases).

iwanowww · 2026-06-15T18:50:22Z

+    // memory slice corresponding to *any* field of a class K is not the same as
+    // the slice corresponding to a specific field of K. This mismatch can in
+    // its turn lead to e.g. incorrect memory graphs.
+    if (C->inlining_incrementally() &&


Is C->inlining_incrementally() == true? It's CallGenerator::do_late_inline_helper() after all.

iwanowww · 2026-06-15T18:54:17Z

+    // the slice corresponding to a specific field of K. This mismatch can in
+    // its turn lead to e.g. incorrect memory graphs.
+    if (C->inlining_incrementally() &&
+        !result->is_top() && result->is_Con() && result->bottom_type()->isa_intptr_t()) {


isa_intptr_t() looks fishy. I don't see how it depends on bitness. It originates from byte codes where sizes are explicit and hard-coded (Java int vs long).

What about cases involving int->long casts? Does it catch them?

iwanowww · 2026-06-15T18:55:54Z

@@ -729,6 +729,27 @@ void CallGenerator::do_late_inline_helper() {
    }
    C->set_inlining_progress(true);
    C->set_do_cleanup(kit.stopped()); // path is dead; needs cleanup


I suggest to extract the code into a helper method (e.g., needs_cleanup) and call it from here (C->set_do_cleanup(needs_cleanup(...));)

robcasloz added 8 commits June 12, 2026 12:24

Add some basic test cases

3cde231

Add basic fix, guarded with UseNewCode (disabled by default)

782163b

Rename test methods for clarity

61fdb59

Add test case to cover assert in getfield parsing logic

5d86e81

Comment test cases

f4af3e8

Add comment, reduce amount of cleanup

d0e2759

Remove temporary guard

60587fc

Fix grammar glitch

aca441c

openjdk Bot added hotspot [email protected] core-libs [email protected] labels Jun 12, 2026

robcasloz force-pushed the JDK-8374783-slices-do-not-match-selective-cleanup branch from 52ad24a to aca441c Compare June 12, 2026 12:25

openjdk Bot removed core-libs [email protected] hotspot [email protected] labels Jun 12, 2026

openjdk Bot added the hotspot-compiler [email protected] label Jun 12, 2026

robcasloz marked this pull request as ready for review June 12, 2026 13:56

openjdk Bot added the rfr Pull request is ready for review label Jun 12, 2026

Add test case where the base address type, rather than the offset, is…

e6bde69

… discovered late

Add test case using an array rather than a class instance

c605fa2

iwanowww reviewed Jun 15, 2026

View reviewed changes

Conversation

robcasloz commented Jun 12, 2026 • edited by openjdk Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Progress

Issue

Reviewing

Uh oh!

bridgekeeper Bot commented Jun 12, 2026

Uh oh!

openjdk Bot commented Jun 12, 2026

Uh oh!

openjdk Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk Bot commented Jun 12, 2026

Uh oh!

robcasloz commented Jun 12, 2026

Uh oh!

openjdk Bot commented Jun 12, 2026

Uh oh!

robcasloz commented Jun 12, 2026

Uh oh!

openjdk Bot commented Jun 12, 2026

Uh oh!

mlbridge Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

merykitty commented Jun 12, 2026

Uh oh!

robcasloz commented Jun 15, 2026

Uh oh!

robcasloz commented Jun 15, 2026

Uh oh!

iwanowww left a comment

Choose a reason for hiding this comment

Uh oh!

iwanowww Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

iwanowww Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

iwanowww Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

robcasloz commented Jun 12, 2026 •

edited by openjdk Bot

Loading

openjdk Bot commented Jun 12, 2026 •

edited

Loading

mlbridge Bot commented Jun 12, 2026 •

edited

Loading