United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-6540288 IterateThroughHeap crash when primitive field callback enabled
JDK-6540288 : IterateThroughHeap crash when primitive field callback enabled

Details
Type:
Bug
Submit Date:
2007-03-29
Status:
Resolved
Updated Date:
2010-04-03
Project Name:
JDK
Resolved Date:
2007-06-20
Component:
hotspot
OS:
generic
Sub-Component:
jvmti
CPU:
generic
Priority:
P2
Resolution:
Fixed
Affected Versions:
7
Fixed Versions:
hs10 (b14)

Related Reports
Backport:
Backport:

Sub Tasks

Description
A profiler vendor reports a crash using IterateThroughHeap when the primtive field callback enabled.

The crash is hard to duplicate but the following has observed to crash on windows-i586 about 1 in 50 runs:

java -mx512m -agentlib:SmallAgent -jar $JDK_HOME/jfc/SwingSet2/SwingSet2.jar

The test creates an agent thread and invokes IterateOverHeap and IterateThroughHeap in a loop (with a 100ms pause between each iteration). When the crash occurs it typically happens when the counter is <20 which suggests the problem is that the heap iteration is encountering an object that is only partially initialized or an internal object.

                                    

Comments
EVALUATION

This bug is very hard to reproduce it. I tried it on a three different
windows box and still not able to reproduce it. I am going to let
this test run in a loop for a day. If we do not get a good 
crash dump then it is difficult find out the cause of the problem.
                                     
2007-04-06
EVALUATION

Bad memory access problem in invoke_primitive_field_callback_for_instance_fields.

Problematic code is shown below:

  jvalue* value = (jvalue*)addr;

    // invoke the callback
    jint res = (*cb)(JVMTI_HEAP_REFERENCE_FIELD,
                     &reference_info,
                     wrapper->klass_tag(),
                     wrapper->obj_tag_p(),
                     *value,          <======= May access bad memory 
				       because it copies 8 bytes from 
				       location "addr" when it needs to
				       copy less than 8 bytes for char, short 
				       int types.
                     value_type,
                                     
2007-05-18



Hardware and Software, Engineered to Work Together