OpenJDK java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessFloat NullPointerException

[pshipton]

https://openj9-jenkins.osuosl.org/job/Test_openjdk11_j9_sanity.openjdk_aarch64_linux_Nightly_testList_0/66/
jdk_lang_0
java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessFloat.java

21:24:27  test VarHandleTestMethodHandleAccessFloat.testAccess("VarHandle -> MethodHandles.varHandleExactInvoker -> Instance field unsupported", VarHandleBaseTest$MethodHandleAccessTestCase@98fd470b): failure
21:24:27  java.lang.AssertionError: GET_AND_BITWISE_OR. Incorrect throwable thrown, java.lang.NullPointerException. Expected class java.lang.UnsupportedOperationException expected [true] but found [false]
21:24:27  	at org.testng.Assert.fail(Assert.java:99)
21:24:27  	at org.testng.Assert.failNotEquals(Assert.java:1037)
21:24:27  	at org.testng.Assert.assertTrue(Assert.java:45)
21:24:27  	at VarHandleBaseTest.checkWithThrowable(VarHandleBaseTest.java:133)
21:24:27  	at VarHandleBaseTest.checkUOE(VarHandleBaseTest.java:54)
21:24:27  	at VarHandleTestMethodHandleAccessFloat.testInstanceFieldUnsupported(VarHandleTestMethodHandleAccessFloat.java:320)
21:24:27  	at VarHandleTestMethodHandleAccessFloat.lambda$accessTestCaseProvider$1(VarHandleTestMethodHandleAccessFloat.java:86)
21:24:27  	at VarHandleBaseTest$AccessTestCase.testAccess(VarHandleBaseTest.java:405)
21:24:27  	at VarHandleTestMethodHandleAccessFloat.testAccess(VarHandleTestMethodHandleAccessFloat.java:116)

Perhaps related to #18246 and/or #18149
@Akira1Saitoh @knn-k

[tajila]

Grinder with OSR disabled, https://openj9-jenkins.osuosl.org/job/Grinder/2968/

[hzongaro]

I spent some time looking at this, and I believe it's the same problem seen in #18246. In a grinder run with -Xjit:verbose={osr*}, I saw OSR being induced shortly before the failure:

#OSR:  1b9400 prepareForOSR at 0000FFFF9A3B984C (startPC 0000FFFF9A3B8B18 +3380) at 31:1 numSharingSyms:2 totalSlots:7 vmThread=00000000001B9400
#OSRd: 1B9400   Jitted body:    VarHandleBaseTest.bind(Ljava/lang/invoke/VarHandle;Ljava/lang/invoke/MethodHandle;Ljava/lang/invoke/MethodType;)Ljava/lang/invoke/MethodHandle;
#OSRd: 1B9400   Inlined method: java/lang/invoke/MethodHandles$Lookup.revealDirect(Ljava/lang/invoke/MethodHandle;)Ljava/lang/invoke/MethodHandleInfo;
#OSRd: 1B9400   osrBuffer=0000FFFF280E22D8 osrFrame=0000FFFF280E22E8, osrReturnAddress=0000FFFFB3CBD7EC osrScratchBuffer=0000FFFF280E23E8 osrJittedFrameCopy=0000FFFF280E2428
#OSRd: 1B9400     OSRBuffer: numberOfFrames=2 jitPC=0000FFFF9A3B984C
#OSRd: 1B9400     OSRFrame: j9method=0000000000095040 bytecodePC=612f6b7d numberOfLocals=3 maxStack=4 pendingStackHeight=0 monitorEnterRecords=0000000000000000
#OSRd: 1B9400       local  2: 0000000000000000
#OSRd: 1B9400       local  1: 00000000FFE8E458
#OSRd: 1B9400       local  0: 00000000001BEA30
#OSRd: 1B9400   9 mappings
#OSRd: 1B9400     Skip mapping @1120 <= 3380 with 0 symbols
#OSRd: 1B9400   Found mapping @5872 > 3380
#OSRd: 1B9400   Copying 0 symbols
#OSRd: 1B9400   prepareForOSR returning
#OSR:  1b9400 prepareForOSR at 0000FFFF9A3B984C (startPC 0000FFFF9A3B8B18 +3380) at -1:1b numSharingSyms:1 totalSlots:11 vmThread=00000000001B9400
#OSRd: 1B9400   Jitted body:    VarHandleBaseTest.bind(Ljava/lang/invoke/VarHandle;Ljava/lang/invoke/MethodHandle;Ljava/lang/invoke/MethodType;)Ljava/lang/invoke/MethodHandle;
#OSRd: 1B9400   osrBuffer=0000FFFF280E22D8 osrFrame=0000FFFF280E2358, osrReturnAddress=0000FFFFB3CBD7EC osrScratchBuffer=0000FFFF280E23E8 osrJittedFrameCopy=0000FFFF280E2428
#OSRd: 1B9400     OSRBuffer: numberOfFrames=2 jitPC=0000FFFF9A3B984C
#OSRd: 1B9400     OSRFrame: j9method=00000000001AAA48 bytecodePC=7b0d8fbf numberOfLocals=4 maxStack=7 pendingStackHeight=0 monitorEnterRecords=0000000000000000
#OSRd: 1B9400       local  3: 00000000001BEA30
#OSRd: 1B9400       local  2: 00000000E01E6598
#OSRd: 1B9400       local  1: 00000000FFE8E458
#OSRd: 1B9400       local  0: 00000000E01B4968
#OSRd: 1B9400   9 mappings
#OSRd: 1B9400     Skip mapping @1120 <= 3380 with 0 symbols
#OSRd: 1B9400   Found mapping @5872 > 3380
#OSRd: 1B9400   Copying 0 symbols
#OSRd: 1B9400   prepareForOSR returning

A trace of Escape Analysis for VarHandleBaseTest.bind shows this information when the eaEscapeHelper calls are being inserted:

insertFakeEscapeForOSR:  definingMap at induceCall n4140n 31:1
# 350:{350}
# 351:{351}
# 352:{352}
# 355:{355}
# 369:{936}
# 370:{937}
# 372:{372}
# 802:{802}
# 806:{806}
# 813:{813}
# 816:{816}

and the following from induce block at [31,1,-]:

n4140n      call  jitInduceOSRAtCurrentPC[#89  helper Method] [flags 0x400 0x0 ]              [    0xfffefd36fdc0] bci=[31,1,1398] rc=1 vc=909 vn=1646 li=- udi=- nc=1
n4160n        aload  <temp slot 10>[#937  Auto] [flags 0x20000007 0x0 ] (X!=0 )               [    0xfffefd3e0410] bci=[31,1,1398] rc=1 vc=909 vn=2 li=583 udi=719 nc=0 flg=0x4
n8314n    treetop                                                                             [    0xfffefd861680] bci=[31,1,1398] rc=0 vc=909 vn=1649 li=- udi=- nc=1
n8306n      call  <eaEscapeHelper>[#310  helper Method] [flags 0x400 0x0 ] ()                 [    0xfffefd861400] bci=[31,1,1398] rc=1 vc=909 vn=1648 li=- udi=- nc=7 flg=0x20
n8307n        aload  <parm 0 Ljava/lang/invoke/VarHandle;>[#350  Parm] [flags 0x40000107 0x0 ]  [    0xfffefd861450] bci=[31,1,1398] rc=1 vc=909 vn=1 li=- udi=720 nc=0
n8308n        aload  <parm 1 Ljava/lang/invoke/MethodHandle;>[#351  Parm] [flags 0x40000107 0x0 ]  [    0xfffefd8614a0] bci=[31,1,1398] rc=1 vc=909 vn=2 li=- udi=721 nc=0
n8309n        aload  <parm 2 Ljava/lang/invoke/MethodType;>[#352  Parm] [flags 0x40000107 0x0 ]  [    0xfffefd8614f0] bci=[31,1,1398] rc=1 vc=909 vn=3 li=- udi=722 nc=0
n8310n        aload  this<'this' parm Ljava/lang/invoke/MethodHandles$Lookup;>[#369  Parm] [flags 0x40000107 0x0 ]  [    0xfffefd861540] bci=[31,1,1398] rc=1 vc=909 vn=0 li=- udi=723 nc=0
n8311n        aload  target<parm 1 Ljava/lang/invoke/MethodHandle;>[#370  Parm] [flags 0x40000107 0x0 ]  [    0xfffefd861590] bci=[31,1,1398] rc=1 vc=909 vn=0 li=- udi=724 nc=0
n8312n        aload  <temp slot 8>[#631  Auto] (obj1) [flags 0x20000007 0x0 ]                 [    0xfffefd8615e0] bci=[31,1,1398] rc=1 vc=909 vn=59 li=584 udi=725 nc=0
n8313n        aload  <temp slot 11>[#1111  Auto] (obj2) [flags 0x20000007 0x0 ]               [    0xfffefd861630] bci=[31,1,1398] rc=1 vc=909 vn=513 li=585 udi=726 nc=0

Noticed that # 369:{936} indicates that the defining symref for #369 is #936 at this point, but that an aload for #369 appears on the <eaEscapeHelper> call.

Tracing back, the value of #936 comes from the following new operation, which ends up being stack allocated, while no store to #369 appears by the time Escape Analysis runs.

n2231n      new  jitNewObject[#91  helper Method] [flags 0x400 0x0 ] (highWordZero Unsigned X!=0 allocationCanBeRemoved )  [    0xfffefd23a910] bci=[12,5,1806] rc=5 vc=909 vn=77 li=- udi=- nc=1 flg=0x4004

Final candidates
 ...
Candidate 1:  
   Node = 0000FFFEFD23A910, contiguous = 1, local = 1
   Flags = {LocalAllocation MustBeContiguous ObjectIsReferenced InsideALoop }
   Value numbers = { 77 }
   4 fields:  
      0: offset=20  size=4  vectorElem=0  symRef=null good={#657} bad={}
      1: offset=12  size=4  vectorElem=0  symRef=null good={#658} bad={}
      2: offset=8   size=4  vectorElem=0  symRef=null good={#659} bad={}
      3: offset=16  size=4  vectorElem=0  symRef=null good={#660} bad={}  

No heapification of the object appears in the induce block - only on the taken-side of guards for inlined methods.

[hzongaro]

An internal 3x5x10 grinder run of java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessFloat.java with aarch64 nightly build 535 — the build for which this problem was first reported — showed 4 failures.

An internal 3x5x10 grinder run with the recent aarch64 nightly build 556 (which contains pull request #18315) there were no failures, so I will close this issue.

[hzongaro]

Duplicate of #18246