8041481: JVM crashes with collect_args_for_profiling

Summary: method handle call to c1 intrinsic tries to profile popped argument
Reviewed-by: kvn, twisti

src/share/vm/c1/c1_GraphBuilder.cpp

@@ -1697,6 +1697,15 @@ Values* GraphBuilder::args_list_for_profiling(ciMethod* target, int& start, bool
   return NULL;
 }
 
+void GraphBuilder::check_args_for_profiling(Values* obj_args, int expected) {
+#ifdef ASSERT
+  bool ignored_will_link;
+  ciSignature* declared_signature = NULL;
+  ciMethod* real_target = method()->get_method_at_bci(bci(), ignored_will_link, &declared_signature);
+  assert(expected == obj_args->length() || real_target->is_method_handle_intrinsic(), "missed on arg?");
+#endif
+}
+
 // Collect arguments that we want to profile in a list
 Values* GraphBuilder::collect_args_for_profiling(Values* args, ciMethod* target, bool may_have_receiver) {
   int start = 0;
@@ -1705,13 +1714,14 @@ Values* GraphBuilder::collect_args_for_profiling(Values* args, ciMethod* target,
     return NULL;
   }
   int s = obj_args->size();
-  for (int i = start, j = 0; j < s; i++) {
+  // if called through method handle invoke, some arguments may have been popped
+  for (int i = start, j = 0; j < s && i < args->length(); i++) {
     if (args->at(i)->type()->is_object_kind()) {
       obj_args->push(args->at(i));
       j++;
     }
   }
-  assert(s == obj_args->length(), "missed on arg?");
+  check_args_for_profiling(obj_args, s);
   return obj_args;
 }
 
@@ -3843,14 +3853,7 @@ bool GraphBuilder::try_inline_full(ciMethod* callee, bool holder_known, Bytecode
             j++;
           }
         }
-#ifdef ASSERT
-        {
-          bool ignored_will_link;
-          ciSignature* declared_signature = NULL;
-          ciMethod* real_target = method()->get_method_at_bci(bci(), ignored_will_link, &declared_signature);
-          assert(s == obj_args->length() || real_target->is_method_handle_intrinsic(), "missed on arg?");
-        }
-#endif
+        check_args_for_profiling(obj_args, s);
       }
       profile_call(callee, recv, holder_known ? callee->holder() : NULL, obj_args, true);
     }

src/share/vm/c1/c1_GraphBuilder.hpp

@@ -392,6 +392,7 @@ class GraphBuilder VALUE_OBJ_CLASS_SPEC {
 
   Values* args_list_for_profiling(ciMethod* target, int& start, bool may_have_receiver);
   Values* collect_args_for_profiling(Values* args, ciMethod* target, bool may_have_receiver);
+  void check_args_for_profiling(Values* obj_args, int expected);
 
  public:
   NOT_PRODUCT(void print_stats();)

src/share/vm/c1/c1_LIRGenerator.cpp

@@ -2634,8 +2634,10 @@ ciKlass* LIRGenerator::profile_type(ciMethodData* md, int md_base_offset, int md
       // LIR_Assembler::emit_profile_type() from emitting useless code
       profiled_k = ciTypeEntries::with_status(result, profiled_k);
     }
-    if (exact_signature_k != NULL && exact_klass != exact_signature_k) {
-      assert(exact_klass == NULL, "obj and signature disagree?");
+    // exact_klass and exact_signature_k can be both non NULL but
+    // different if exact_klass is loaded after the ciObject for
+    // exact_signature_k is created.
+    if (exact_klass == NULL && exact_signature_k != NULL && exact_klass != exact_signature_k) {
       // sometimes the type of the signature is better than the best type
       // the compiler has
       exact_klass = exact_signature_k;
@@ -2646,8 +2648,7 @@ ciKlass* LIRGenerator::profile_type(ciMethodData* md, int md_base_offset, int md
       if (improved_klass == NULL) {
         improved_klass = comp->cha_exact_type(callee_signature_k);
       }
-      if (improved_klass != NULL && exact_klass != improved_klass) {
-        assert(exact_klass == NULL, "obj and signature disagree?");
+      if (exact_klass == NULL && improved_klass != NULL && exact_klass != improved_klass) {
         exact_klass = exact_signature_k;
       }
     }

test/compiler/profiling/TestMethodHandleInvokesIntrinsic.java

+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8041458
+ * @summary profiling of arguments in C1 at MethodHandle invoke of intrinsic tries to profile popped argument.
+ * @run main/othervm -XX:-BackgroundCompilation -XX:-UseOnStackReplacement -XX:TieredStopAtLevel=3 TestMethodHandleInvokesIntrinsic
+ *
+ */
+
+import java.lang.invoke.*;
+
+public class TestMethodHandleInvokesIntrinsic {
+
+    static final MethodHandle mh_nanoTime;
+    static final MethodHandle mh_getClass;
+    static {
+        MethodHandles.Lookup lookup = MethodHandles.lookup();
+        MethodType mt = MethodType.methodType(long.class);
+        MethodHandle MH = null;
+        try {
+            MH = lookup.findStatic(System.class, "nanoTime", mt);
+        } catch(NoSuchMethodException nsme) {
+            nsme.printStackTrace();
+            throw new RuntimeException("TEST FAILED", nsme);
+        } catch(IllegalAccessException iae) {
+            iae.printStackTrace();
+            throw new RuntimeException("TEST FAILED", iae);
+        }
+        mh_nanoTime = MH;
+
+        mt = MethodType.methodType(Class.class);
+        MH = null;
+        try {
+            MH = lookup.findVirtual(Object.class, "getClass", mt);
+        } catch(NoSuchMethodException nsme) {
+            nsme.printStackTrace();
+            throw new RuntimeException("TEST FAILED", nsme);
+        } catch(IllegalAccessException iae) {
+            iae.printStackTrace();
+            throw new RuntimeException("TEST FAILED", iae);
+        }
+        mh_getClass = MH;
+    }
+
+    static long m1() throws Throwable {
+        return (long)mh_nanoTime.invokeExact();
+    }
+
+    static Class m2(Object o) throws Throwable {
+        return (Class)mh_getClass.invokeExact(o);
+    }
+
+    static public void main(String[] args) {
+        try {
+            for (int i = 0; i < 20000; i++) {
+                m1();
+            }
+            TestMethodHandleInvokesIntrinsic o = new TestMethodHandleInvokesIntrinsic();
+            for (int i = 0; i < 20000; i++) {
+                m2(o);
+            }
+        } catch(Throwable t) {
+            System.out.println("Unexpected exception");
+            t.printStackTrace();
+            throw new RuntimeException("TEST FAILED", t);
+        }
+
+        System.out.println("TEST PASSED");
+    }
+}