8375010: C2 VectorAPI: assert(vbox->is_CheckCastPP()) failed: should be expanded

8374903: C2 VectorAPI: assert(vbox->as_Phi()->region() == vect->as_Phi()->region()) failed

Reviewed-by: qamai, vlivanov

src/hotspot/share/opto/vector.cpp

@@ -326,37 +326,15 @@ Node* PhaseVector::expand_vbox_node_helper(Node* vbox,
     return expand_vbox_alloc_node(vbox_alloc, vect, box_type, vect_type);
   }
 
-  // Handle the case when both the allocation input and vector input to
-  // VectorBoxNode are Phi. This case is generated after the transformation of
-  // Phi: Phi (VectorBox1 VectorBox2) => VectorBox (Phi1 Phi2).
-  // With this optimization, the relative two allocation inputs of VectorBox1 and
-  // VectorBox2 are gathered into Phi1 now. Similarly, the original vector
-  // inputs of two VectorBox nodes are in Phi2.
-  //
-  // See PhiNode::merge_through_phi in cfg.cpp for more details.
-  if (vbox->is_Phi() && vect->is_Phi()) {
-    assert(vbox->as_Phi()->region() == vect->as_Phi()->region(), "");
+  // Handle the case when the allocation input to VectorBoxNode is a Phi.
+  // This is generated after the transformation in PhiNode::merge_through_phi:
+  //   Phi (VectorBox1 VectorBox2) => VectorBox (Phi1 Phi2)
+  // The vector input may also be a Phi (Phi2 above), or it may have been
+  // value-numbered to a single node if all inputs were identical.
+  if (vbox->is_Phi()) {
+    bool same_region = vect->is_Phi() && vbox->as_Phi()->region() == vect->as_Phi()->region();
     for (uint i = 1; i < vbox->req(); i++) {
-      Node* new_box = expand_vbox_node_helper(vbox->in(i), vect->in(i),
-                                              box_type, vect_type, visited);
-      if (!new_box->is_Phi()) {
-        C->initial_gvn()->hash_delete(vbox);
-        vbox->set_req(i, new_box);
-      }
-    }
-    return C->initial_gvn()->transform(vbox);
-  }
-
-  // Handle the case when the allocation input to VectorBoxNode is a phi
-  // but the vector input is not, which can definitely be the case if the
-  // vector input has been value-numbered. It seems to be safe to do by
-  // construction because VectorBoxNode and VectorBoxAllocate come in a
-  // specific order as a result of expanding an intrinsic call. After that, if
-  // any of the inputs to VectorBoxNode are value-numbered they can only
-  // move up and are guaranteed to dominate.
-  if (vbox->is_Phi() && (vect->is_Vector() || vect->is_LoadVector())) {
-    for (uint i = 1; i < vbox->req(); i++) {
-      Node* new_box = expand_vbox_node_helper(vbox->in(i), vect,
+      Node* new_box = expand_vbox_node_helper(vbox->in(i), same_region ? vect->in(i) : vect,
                                               box_type, vect_type, visited);
       if (!new_box->is_Phi()) {
         C->initial_gvn()->hash_delete(vbox);

test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandPhi.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package compiler.vectorapi;
+
+import jdk.incubator.vector.*;
+
+/*
+ * @test
+ * @bug 8374903
+ * @summary C2 crashes when VectorBox Phi and vector Phi have different regions
+ * @modules jdk.incubator.vector
+ * @library /test/lib
+ *
+ * @run main/othervm -Xbatch -XX:CompileCommand=compileonly,compiler.vectorapi.VectorBoxExpandPhi::test compiler.vectorapi.VectorBoxExpandPhi
+ */
+public class VectorBoxExpandPhi {
+    public static void main(String[] args) {
+        for (int i = 0; i < 10_000; i++) {
+            test();
+        }
+    }
+
+    public static Object test() {
+        var v0 = DoubleVector.broadcast(DoubleVector.SPECIES_128, 1.0);
+        var v1 = (FloatVector)v0.convertShape(VectorOperators.Conversion.ofCast(double.class, float.class), FloatVector.SPECIES_64, 0);
+        var v2 = (FloatVector)v1.convertShape(VectorOperators.Conversion.ofReinterpret(float.class, float.class), FloatVector.SPECIES_64, 0);
+        return v2;
+    }
+}

test/hotspot/jtreg/compiler/vectorapi/VectorBoxExpandProj.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package compiler.vectorapi;
+
+import jdk.incubator.vector.*;
+
+/*
+ * @test
+ * @bug 8375010
+ * @summary C2 crashes when expanding VectorBox with Proj input from vector math call
+ * @modules jdk.incubator.vector
+ * @library /test/lib
+ *
+ * @run main/othervm -Xbatch -XX:CompileCommand=compileonly,compiler.vectorapi.VectorBoxExpandProj::test compiler.vectorapi.VectorBoxExpandProj
+ */
+public class VectorBoxExpandProj {
+    static boolean b;
+
+    public static void main(String[] args) {
+        for (int i = 0; i < 20_000; i++) {
+            b = !b;
+            test();
+        }
+        System.out.println("PASS");
+    }
+
+    // TAN returns Proj (not VectorNode). Phi merging creates VectorBox(Phi, Proj).
+    // expand_vbox_node_helper must handle Proj inputs with vector type.
+    static Object test() {
+        var t = DoubleVector.broadcast(DoubleVector.SPECIES_128, 1.0).lanewise(VectorOperators.TAN);
+        return b ? t.convertShape(VectorOperators.Conversion.ofCast(double.class, double.class), DoubleVector.SPECIES_128, 0) : t;
+    }
+}