8370332: C2 SuperWord: SIGSEGV because PhaseIdealLoop::split_thru_phi left dead nodes in loop _body

src/hotspot/share/opto/loopopts.cpp

@@ -228,6 +228,40 @@ Node* PhaseIdealLoop::split_thru_phi(Node* n, Node* region, int policy) {
     }
   }
 
+  // If the region is a Loop, we are removing the old n,
+  // and need to yank it from the _body. If any phi we
+  // just split through now has no use any more, it also
+  // has to be removed.
+  IdealLoopTree* region_loop = get_loop(region);
+  if (region->is_Loop() && region_loop->_child == nullptr) {
+    region_loop->_body.yank(n);
+    for (uint j = 1; j < n->req(); j++) {
+      PhiNode* phi = n->in(j)->isa_Phi();
+      // Check that phi belongs to the region and only has n as a use.
+      if (phi != nullptr && phi->in(0) == region) {
+        bool found_n = false;
+        bool found_other = false;
+        for (DUIterator_Fast kmax, k = phi->fast_outs(kmax); k < kmax; k++) {
+          Node* u = phi->fast_out(k);
+          if (u == n) {
+            // Single and multiple use are allowed:
+            //   n = ConvF2I(phi)
+            //   n = AddI(phi, phi)
+            found_n = true;
+          } else {
+            found_other = true;
+          }
+        }
+        if (found_n && !found_other) {
+          assert(get_ctrl(phi) == region, "sanity");
+          assert(get_ctrl(n) == region, "sanity");
+          region_loop->_body.yank(phi);
+        }
+      }
+    }
+  }
+  _igvn.replace_node(n, phi);
+
 #ifndef PRODUCT
   if (TraceLoopOpts) {
     tty->print_cr("Split %d %s through %d Phi in %d %s",
@@ -1207,13 +1241,10 @@ Node *PhaseIdealLoop::split_if_with_blocks_pre( Node *n ) {
 
   if (must_throttle_split_if()) return n;
 
-  // Split 'n' through the merge point if it is profitable
-  Node *phi = split_thru_phi( n, n_blk, policy );
-  if (!phi) return n;
+  // Split 'n' through the merge point if it is profitable, replacing it with a new phi.
+  Node* phi = split_thru_phi(n, n_blk, policy);
+  if (phi == nullptr) { return n; }
 
-  // Found a Phi to split thru!
-  // Replace 'n' with the new phi
-  _igvn.replace_node( n, phi );
   // Moved a load around the loop, 'en-registering' something.
   if (n_blk->is_Loop() && n->is_Load() &&
       !phi->in(LoopNode::LoopBackControl)->is_Load())
@@ -1444,15 +1475,9 @@ void PhaseIdealLoop::split_if_with_blocks_post(Node *n) {
       return;
     }
 
-    // Found a Phi to split thru!
-    // Replace 'n' with the new phi
-    _igvn.replace_node(n, phi);
-
     // Now split the bool up thru the phi
-    Node *bolphi = split_thru_phi(bol, n_ctrl, -1);
+    Node* bolphi = split_thru_phi(bol, n_ctrl, -1);
     guarantee(bolphi != nullptr, "null boolean phi node");
-
-    _igvn.replace_node(bol, bolphi);
     assert(iff->in(1) == bolphi, "");
 
     if (bolphi->Value(&_igvn)->singleton()) {
@@ -1461,8 +1486,7 @@ void PhaseIdealLoop::split_if_with_blocks_post(Node *n) {
 
     // Conditional-move?  Must split up now
     if (!iff->is_If()) {
-      Node *cmovphi = split_thru_phi(iff, n_ctrl, -1);
-      _igvn.replace_node(iff, cmovphi);
+      Node* cmovphi = split_thru_phi(iff, n_ctrl, -1);
       return;
     }
 

test/hotspot/jtreg/compiler/loopopts/TestSplitThruPhiRemoveDeadNodesFromLoopBody.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test id=with-flags
+ * @bug 8370332
+ * @summary This test shows a case where split_if split a node through a phi, but left the
+ *          dead node and a dead phi in the loop _body. Subsequently, SuperWord was run, and
+ *          found the dead nodes in the _body, which is not expected.
+ * @run main/othervm
+ *      -XX:CompileCommand=compileonly,*TestSplitThruPhiRemoveDeadNodesFromLoopBody::test
+ *      -Xbatch
+ *      compiler.loopopts.superword.TestSplitThruPhiRemoveDeadNodesFromLoopBody
+ */
+
+/*
+ * @test id=vanilla
+ * @bug 8370332
+ * @run main compiler.loopopts.superword.TestSplitThruPhiRemoveDeadNodesFromLoopBody
+ */
+
+package compiler.loopopts.superword;
+
+public class TestSplitThruPhiRemoveDeadNodesFromLoopBody {
+    static int N = 400;
+    static float floatZero = 0;
+    static boolean falseFlag = false;;
+
+    static int fieldStore = 0;
+    static int fieldIncr = 0;
+    static int arrayI[] = new int[N];
+
+    static void inlined() {
+        int x = 0;
+        for (int i = 0; i < 100; i++) {
+            fieldStore = 42;
+            if (falseFlag) {
+                for (int k = 0; k < 20; k++) {
+                    x += i;
+                }
+            }
+        }
+    }
+
+    static void test() {
+        inlined();
+        for (int k = 0; k < 10; k++) {
+            for (int j = 0; j < 100; j++) {
+                fieldIncr += floatZero;
+                arrayI[j] = 42; // SuperWord happens here -> SIGSEGV
+            }
+        }
+    }
+
+    public static void main(String[] strArr) {
+        for (int i = 0; i < 1_000; i++) {
+            test();
+        }
+    }
+}