Avoid analyzing OSR guards as virtual guards in versioner - #6797
Merged
Conversation
It used to be that a standalone OSR guard could not target a cold call. However, virtual guards target cold calls even when they are merged with OSR guards. Recently, VP learned to remove the virtual part of a virtual guard despite any merged guards (3d1fec9). The merged HCR or OSR guard is promoted to a standalone HCR or OSR guard, and any standalone OSR guard produced in this way does target a cold call. It was possible for such an OSR guard to be confused for a virtual guard, and therefore for loop versioner to try to version it as though it were a virtual guard, resulting in an assertion failure: guardOkForExpr: should not intern OSR guard ... This happened only very rarely because the OSR guard does not use VFT test or method test, so in order to confuse it for a virtual guard, the OSR guard's BCI must correspond to that of the cold call in the same way as it would for a virtual guard. An OSR guard's inlined call site index is copied from the BBStart on the taken side, which usually identifies the caller rather than the callee, but the latter is required in order to provoke the bug. Additionally, buildConditionalTree() had a path that excluded HCR guard but not direct method guard. It shouldn't matter, since neither should be considered an invariant conditional there, but that path now also excludes direct method guard for consistency.
An OSR guard does not correspond to any inlined call site in particular. The OSR assumptions are made throughout the method in a generalized way. Using -1 as the call site index helps to prevent later analyses from confusing an OSR guard for a virtual guard, since it will not be possible to find a call that appears to have corresponding BCI.
jdmpapin
requested review from
0xdaryl,
mstoodle and
vijaysun-omr
as code owners
November 3, 2022 21:41
vijaysun-omr
approved these changes
Nov 4, 2022
vijaysun-omr
approved these changes
Nov 4, 2022
Contributor
|
Jenkins build all |
Contributor
Author
Contributor
|
Merging since both failures are known ones and reviews are done. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
It used to be that a standalone OSR guard could not target a cold call. However, virtual guards target cold calls even when they are merged with OSR guards. Recently, VP learned to remove the virtual part of a virtual guard despite any merged guards (3d1fec9, #6762). The merged HCR or OSR guard is promoted to a standalone HCR or OSR guard, and any standalone OSR guard produced in this way does target a cold call.
It was possible for such an OSR guard to be confused for a virtual guard, and therefore for loop versioner to try to version it as though it were a virtual guard, resulting in an assertion failure:
This happened only very rarely because the OSR guard does not use VFT test or method test, so in order to confuse it for a virtual guard, the OSR guard's BCI must correspond to that of the cold call in the same way as it would for a virtual guard. An OSR guard's inlined call site index is copied from the BBStart on the taken side, which usually identifies the caller rather than the callee, but the latter is required in order to provoke the bug.
Additionally,
buildConditionalTree()had a path that excluded HCR guard but not direct method guard. It shouldn't matter, since neither should be considered an invariant conditional there, but that path now also excludes direct method guard for consistency.There is an additional commit to prevent this confusion in another way:
Fixes eclipse-openj9/openj9#16115