EVALUATION

http://hg.openjdk.java.net/jdk7/hotspot-comp/hotspot/rev/ab075d07f1ba
                                     

SUGGESTED FIX

- Check the result of step_through_mergemem() and remove_dead_region()
methods and stop further transformations if the node become dead.
- Add the assert to transform_old() after the call to Ideal()
to verify that it does not return a dead node.
                                     

EVALUATION

Originally I though this was caused by order in which LoadNode::Ideal was called relative to the transforms in LoadBNode::Ideal but I realized that would have hidden this problem but wasn't actually the cause.

I believe the problem is that step_through_mergemem can cause the node to go dead but that isn't being checked for.  The nodes inputs are all killed to NULL in subsume_node and step_through_mergemem return top, so we set the memory to top and reprocess the node.

  if (mem->is_MergeMem()) {
    MergeMemNode* mmem = mem->as_MergeMem();
    const TypePtr *tp = t_adr->is_ptr();

    mem = step_through_mergemem(phase, mmem, tp, adr_type(), tty);
  }

  if (mem != old_mem) {
    set_req(MemNode::Memory, mem);
    return this;
  }

We probably need to detect that outcnt() == 0 and return NodeSentinel.  I think every use of step_through_mergemem including optimize_memory_chain is exposed to the exact same problem.  There also should be an assert that Ideal doesn't return dead nodes.