JDK-6676175 : BigApps crash JVM Client VM in BiasedLocking::revoke_and_rebias() walking wrong stack
  • Type: Bug
  • Component: hotspot
  • Sub-Component: runtime
  • Affected Version: hs10,hs11,hs13,6u5,6u6,7
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS:
    generic,linux_2.6,solaris,solaris_10 generic,linux_2.6,solaris,solaris_10
  • CPU: generic,sparc
  • Submitted: 2008-03-17
  • Updated: 2012-10-08
  • Resolved: 2008-12-10
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7 Other
6-poolResolved 7Fixed hs14Fixed
Related Reports
Duplicate :  
JDK-6708617 - Segv in frame::sender with java application running 6u5 after upgrading from 5.0
Duplicate :  
JDK-6649401 - guarantee(Thread::current() == (Thread*)thread, "only current thread can flush its registers")
Duplicate :  
JDK-6735499 - crash in 1.6.0_04 in libjvm.so:revoke_bias()
Description
BigApps VolanoTest crash JVM Client VM (build 10.0-b22, mixed mode, sharing). I can't reproduce it again. 

java version "1.6.0_06-ea"
Java(TM) SE Runtime Environment (build 1.6.0_06-ea-b01)
Java HotSpot(TM) Client VM (build 10.0-b22, mixed mode, sharing)

Mode: -client 
Adhock keys: -Xincgc

        Solaris 10 8/07 s10s_u4wos_12b SPARC
           Copyright 2007 Sun Microsystems, Inc.  All Rights Reserved.
                        Use is subject to license terms.
                            Assembled 16 August 2007


COM.volano.ao Version 2.5.0.9
Copyright (C) 1996-2002 Volano LLC.  All rights reserved.
Creating users for room number 1 ...
Creating users for room number 2 ...
Creating users for room number 3 ...
Creating users for room number 4 ...
Creating users for room number 5 ...
Creating users for room number 6 ...
Creating users for room number 7 ...
Creating users for room number 8 ...
Creating users for room number 9 ...
Creating users for room number 10 ...
Java heap:  268 KB in use, 7552 KB available (4% in use).
Running the test ...
[Wed Mar 05 19:05:41 GMT 2008] Error reading from 129.156.233.27. (java.net.SocketException: Connection reset)
#
# An unexpected error has been detected by Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xfeaaa644, pid=8597, tid=1642558
#
# Java VM: Java HotSpot(TM) Client VM (10.0-b22 mixed mode solaris-sparc)
# Problematic frame:
# V  [libjvm.so+0x2aa644]
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x008e1800):  JavaThread "Receiver-821256" [_thread_in_vm, id=1642558, stack(0xde000000,0xde080000)]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0x00000038

Registers:
 O0=0xfc400224 O1=0x005de65c O2=0xde07ee78 O3=0xfecf68bc
 O4=0x00000002 O5=0xde07ede8 O6=0xde07ed10 O7=0xfeaaa5ec
 G1=0x001d9b58 G2=0xfee3eae0 G3=0x00010ae0 G4=0xfc400224
 G5=0xde07f728 G6=0x00000000 G7=0xfbfc6800 Y=0x00000000
 PC=0xfeaaa644 nPC=0xfeaaa648


Top of Stack: (sp=0xde07ed10)
0xde07ed10:   00920d18 00017c00 00000008 fffffffc
0xde07ed20:   fee2e000 00000010 00017ce8 fee45ce8
0xde07ed30:   00010800 005de65c de07ee78 de07ede8
0xde07ed40:   005de65c 00000000 de07ed70 feaa7540
0xde07ed50:   00000000 00000000 00000000 00000000
0xde07ed60:   00000000 00000000 00000000 00000000
0xde07ed70:   00920d18 00017c00 00000010 fffffffc
0xde07ed80:   005de5d8 005de678 de07ee7c fee45ce8 

Instructions: (pc=0xfeaaa644)
0xfeaaa634:   31 00 00 42 86 1e 22 e0 fa 06 60 00 84 05 00 03
0xfeaaa644:   f0 07 60 38 c2 00 a0 00 f8 00 60 04 80 a7 00 12 

Stack: [0xde000000,0xde080000],  sp=0xde07ed10,  free space=507k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x2aa644]
V  [libjvm.so+0x2a7548]
V  [libjvm.so+0x4f18d0]
V  [libjvm.so+0x4f19c0]
V  [libjvm.so+0x1ba848]
V  [libjvm.so+0x1baba8]
V  [libjvm.so+0x1bba90]
V  [libjvm.so+0x49ee28]
V  [libjvm.so+0x18af48]
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)
V  [libjvm.so+0xdefac]
V  [libjvm.so+0x2e1488]
V  [libjvm.so+0xf14b4]
V  [libjvm.so+0xf1434]
V  [libjvm.so+0x4b2c18]
V  [libjvm.so+0x4256dc]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)

Full core file - see attach. 

Full logs: 

http://latte.ireland/results/1.6.0_06/Build01/VolanoTestrun.8574.-client/hs_err_pid8597.log 
http://latte.ireland/results/1.6.0_06/Build01/VolanoTestrun.8574.-client/
Stack trace added to description to help others find same bug.

--------------------------------------------------------------
Stack: [0xde000000,0xde080000],  sp=0xde07ed10,  free space=507k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x2aa644];;  __1cFframeGsender6kMpnLRegisterMap__0_+0x5c
V  [libjvm.so+0x2a7548];;  __1cFframeLreal_sender6kMpnLRegisterMap__0_+0x18
V  [libjvm.so+0x4f18d0];;  __1cGvframeGsender6kM_p0_+0xb4
V  [libjvm.so+0x4f19c0];;  __1cGvframeLjava_sender6kM_pnKjavaVFrame__+0x48
V  [libjvm.so+0x1ba848];;  __1cbBget_or_compute_monitor_info6FpnKJavaThread__pnNGrowableArray4CpnLMonitorInfo____+0x2a4
V  [libjvm.so+0x1baba8];;  __1cLrevoke_bias6FpnHoopDesc_bbpnKJavaThread__nNBiasedLockingJCondition__+0x338
V  [libjvm.so+0x1bba90];;  __1cNBiasedLockingRrevoke_and_rebias6FnGHandle_bpnGThread__n0AJCondition__+0x29c
V  [libjvm.so+0x49ee28];;  __1cSObjectSynchronizerKfast_enter6FnGHandle_pnJBasicLock_bpnGThread__v_+0x74
V  [libjvm.so+0x18af48];;  __1cIRuntime1Mmonitorenter6FpnKJavaThread_pnHoopDesc_pnPBasicObjectLock__v_+0xe0
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)
V  [libjvm.so+0xdefac];;  __1cJJavaCallsLcall_helper6FpnJJavaValue_pnMmethodHandle_pnRJavaCallArguments_pnGThread__v_+0x1dc
V  [libjvm.so+0x2e1488];;  __1cJJavaCallsMcall_virtual6FpnJJavaValue_nLKlassHandle_nMsymbolHandle_4pnRJavaCallArguments_pnGThread__v_+0xf8
V  [libjvm.so+0xf14b4];;  __1cJJavaCallsMcall_virtual6FpnJJavaValue_nGHandle_nLKlassHandle_nMsymbolHandle_5pnGThread__v_+0x70
V  [libjvm.so+0xf1434];;  __1cMthread_entry6FpnKJavaThread_pnGThread__v_+0x110
V  [libjvm.so+0x4b2c18];;  __1cKJavaThreadRthread_main_inner6M_v_+0x50
V  [libjvm.so+0x4256dc];;  java_start+0x178

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)
Comments
EVALUATION Renamed for better pattern matching.
14-01-2009
EVALUATION 6676175: BigApps crash JVM Client VM (build 10.0-b22, mixed mode, sharing) with SIGSEGV (0xb) Summary: Add test for biased locking epoch before walking own thread stack in case of rare race Reviewed-by: phh, never (guessing build number fixed in again).
24-11-2008
EVALUATION http://hg.openjdk.java.net/jdk7/hotspot-rt/hotspot/rev/2b42b31e7928
21-11-2008
SUGGESTED FIX --- old/src/share/vm/runtime/biasedLocking.cpp Fri Mar 28 11:59:14 2008 +++ new/src/share/vm/runtime/biasedLocking.cpp Fri Mar 28 11:59:14 2008 @@ -579,7 +579,10 @@ if (heuristics == HR_NOT_BIASED) { return NOT_BIASED; } else if (heuristics == HR_SINGLE_REVOKE) { - if (mark->biased_locker() == THREAD) { + Klass* k = Klass::cast(obj->klass()); + markOop prototype_header = k->prototype_header(); + if (mark->biased_locker() == THREAD && + prototype_header->bias_epoch() == mark->bias_epoch()) { // A thread is trying to revoke the bias of an object biased // toward it, again likely due to an identity hash code // computation. We can again avoid a safepoint in this case
30-05-2008
EVALUATION See comments.
30-05-2008