On Tue, 19 May 2026 14:34:57 GMT, Tobias Hartmann <[email protected]> wrote:
> C1/interpreter array-access profiling is racy and can publish the exact array > klass before the flat/null-free flag is visible: > https://github.com/openjdk/valhalla/blob/f87d6d1cea3b578b458075a411f7aaa5dddb2cd9/src/hotspot/share/c1/c1_LIRGenerator.cpp#L1968-L1971 > > C2 reads profile information lock-free and can therefore, in rare cases, > observe the inconsistencies reported in the JBS issue. For example, it can > observe profiling for an array load with an `array_type` that is knowingly > flat but does not have the `flat_array` property set (yet). The new > regression test reliably reproduces such inconsistencies for array loads and > stores. > > Since a valid profiled flat array klass is stronger information than the flat > flag, the fix is to prefer that information if available. With that fix, the > asserts don't make much sense anymore, so I removed them. > > Thanks, > Tobias > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). src/hotspot/share/ci/ciMethod.cpp line 669: > 667: // MDO updates are racy. C2 can observe the array type before the > profiling code has updated the > 668: // corresponding flat/null-free flags. If the array type is known, > prefer the properties it provides. > 669: static void sanitize_array_access_profile(ciKlass* array_type, bool& > flat_array, bool& null_free_array) { Having "sanitize" in the name feels like it implies a level of confidence in the values that isn't really warranted. We can miss flags updates as well as type updates, so the combined result is still best effort, therefore I would not call it sanitized. Maybe something like "update_flags_from_type" is closer to the truth? ------------- PR Review Comment: https://git.openjdk.org/valhalla/pull/2452#discussion_r3270820058
