United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
JDK-6676175 : BigApps crash JVM Client VM in BiasedLocking::revoke_and_rebias() walking wrong stack

Details
Type:
Bug
Submit Date:
2008-03-17
Status:
Closed
Updated Date:
2012-10-08
Project Name:
JDK
Resolved Date:
2008-12-10
Component:
hotspot
OS:
solaris,generic,solaris_10,linux_2.6
Sub-Component:
runtime
CPU:
sparc,generic
Priority:
P3
Resolution:
Fixed
Affected Versions:
hs10,hs11,hs13,6u5,6u6,7
Fixed Versions:
hs14 (b09)

Related Reports
Backport:
Backport:
Backport:
Duplicate:
Duplicate:
Duplicate:

Sub Tasks

Description
BigApps VolanoTest crash JVM Client VM (build 10.0-b22, mixed mode, sharing). I can't reproduce it again. 

java version "1.6.0_06-ea"
Java(TM) SE Runtime Environment (build 1.6.0_06-ea-b01)
Java HotSpot(TM) Client VM (build 10.0-b22, mixed mode, sharing)

Mode: -client 
Adhock keys: -Xincgc

        Solaris 10 8/07 s10s_u4wos_12b SPARC
           Copyright 2007 Sun Microsystems, Inc.  All Rights Reserved.
                        Use is subject to license terms.
                            Assembled 16 August 2007


COM.volano.ao Version 2.5.0.9
Copyright (C) 1996-2002 Volano LLC.  All rights reserved.
Creating users for room number 1 ...
Creating users for room number 2 ...
Creating users for room number 3 ...
Creating users for room number 4 ...
Creating users for room number 5 ...
Creating users for room number 6 ...
Creating users for room number 7 ...
Creating users for room number 8 ...
Creating users for room number 9 ...
Creating users for room number 10 ...
Java heap:  268 KB in use, 7552 KB available (4% in use).
Running the test ...
[Wed Mar 05 19:05:41 GMT 2008] Error reading from 129.156.233.27. (java.net.SocketException: Connection reset)
#
# An unexpected error has been detected by Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xfeaaa644, pid=8597, tid=1642558
#
# Java VM: Java HotSpot(TM) Client VM (10.0-b22 mixed mode solaris-sparc)
# Problematic frame:
# V  [libjvm.so+0x2aa644]
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x008e1800):  JavaThread "Receiver-821256" [_thread_in_vm, id=1642558, stack(0xde000000,0xde080000)]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0x00000038

Registers:
 O0=0xfc400224 O1=0x005de65c O2=0xde07ee78 O3=0xfecf68bc
 O4=0x00000002 O5=0xde07ede8 O6=0xde07ed10 O7=0xfeaaa5ec
 G1=0x001d9b58 G2=0xfee3eae0 G3=0x00010ae0 G4=0xfc400224
 G5=0xde07f728 G6=0x00000000 G7=0xfbfc6800 Y=0x00000000
 PC=0xfeaaa644 nPC=0xfeaaa648


Top of Stack: (sp=0xde07ed10)
0xde07ed10:   00920d18 00017c00 00000008 fffffffc
0xde07ed20:   fee2e000 00000010 00017ce8 fee45ce8
0xde07ed30:   00010800 005de65c de07ee78 de07ede8
0xde07ed40:   005de65c 00000000 de07ed70 feaa7540
0xde07ed50:   00000000 00000000 00000000 00000000
0xde07ed60:   00000000 00000000 00000000 00000000
0xde07ed70:   00920d18 00017c00 00000010 fffffffc
0xde07ed80:   005de5d8 005de678 de07ee7c fee45ce8 

Instructions: (pc=0xfeaaa644)
0xfeaaa634:   31 00 00 42 86 1e 22 e0 fa 06 60 00 84 05 00 03
0xfeaaa644:   f0 07 60 38 c2 00 a0 00 f8 00 60 04 80 a7 00 12 

Stack: [0xde000000,0xde080000],  sp=0xde07ed10,  free space=507k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x2aa644]
V  [libjvm.so+0x2a7548]
V  [libjvm.so+0x4f18d0]
V  [libjvm.so+0x4f19c0]
V  [libjvm.so+0x1ba848]
V  [libjvm.so+0x1baba8]
V  [libjvm.so+0x1bba90]
V  [libjvm.so+0x49ee28]
V  [libjvm.so+0x18af48]
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)
V  [libjvm.so+0xdefac]
V  [libjvm.so+0x2e1488]
V  [libjvm.so+0xf14b4]
V  [libjvm.so+0xf1434]
V  [libjvm.so+0x4b2c18]
V  [libjvm.so+0x4256dc]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)

Full core file - see attach. 

Full logs: 

http://latte.ireland/results/1.6.0_06/Build01/VolanoTestrun.8574.-client/hs_err_pid8597.log 
http://latte.ireland/results/1.6.0_06/Build01/VolanoTestrun.8574.-client/
Stack trace added to description to help others find same bug.

--------------------------------------------------------------
Stack: [0xde000000,0xde080000],  sp=0xde07ed10,  free space=507k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x2aa644];;  __1cFframeGsender6kMpnLRegisterMap__0_+0x5c
V  [libjvm.so+0x2a7548];;  __1cFframeLreal_sender6kMpnLRegisterMap__0_+0x18
V  [libjvm.so+0x4f18d0];;  __1cGvframeGsender6kM_p0_+0xb4
V  [libjvm.so+0x4f19c0];;  __1cGvframeLjava_sender6kM_pnKjavaVFrame__+0x48
V  [libjvm.so+0x1ba848];;  __1cbBget_or_compute_monitor_info6FpnKJavaThread__pnNGrowableArray4CpnLMonitorInfo____+0x2a4
V  [libjvm.so+0x1baba8];;  __1cLrevoke_bias6FpnHoopDesc_bbpnKJavaThread__nNBiasedLockingJCondition__+0x338
V  [libjvm.so+0x1bba90];;  __1cNBiasedLockingRrevoke_and_rebias6FnGHandle_bpnGThread__n0AJCondition__+0x29c
V  [libjvm.so+0x49ee28];;  __1cSObjectSynchronizerKfast_enter6FnGHandle_pnJBasicLock_bpnGThread__v_+0x74
V  [libjvm.so+0x18af48];;  __1cIRuntime1Mmonitorenter6FpnKJavaThread_pnHoopDesc_pnPBasicObjectLock__v_+0xe0
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)
V  [libjvm.so+0xdefac];;  __1cJJavaCallsLcall_helper6FpnJJavaValue_pnMmethodHandle_pnRJavaCallArguments_pnGThread__v_+0x1dc
V  [libjvm.so+0x2e1488];;  __1cJJavaCallsMcall_virtual6FpnJJavaValue_nLKlassHandle_nMsymbolHandle_4pnRJavaCallArguments_pnGThread__v_+0xf8
V  [libjvm.so+0xf14b4];;  __1cJJavaCallsMcall_virtual6FpnJJavaValue_nGHandle_nLKlassHandle_nMsymbolHandle_5pnGThread__v_+0x70
V  [libjvm.so+0xf1434];;  __1cMthread_entry6FpnKJavaThread_pnGThread__v_+0x110
V  [libjvm.so+0x4b2c18];;  __1cKJavaThreadRthread_main_inner6M_v_+0x50
V  [libjvm.so+0x4256dc];;  java_start+0x178

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
v  ~RuntimeStub::monitorenter_nofpu Runtime1 stub
J  COM.volano.p.a(LCOM/volano/e;LCOM/volano/as;)V
J  COM.volano.p.update(Ljava/util/Observable;Ljava/lang/Object;)V
J  java.util.Observable.notifyObservers(Ljava/lang/Object;)V
J  COM.volano.e.run()V
J  java.lang.Thread.run()V
v  ~BufferBlob::StubRoutines (1)

                                    

Comments
EVALUATION

Renamed for better pattern matching.
                                     
2009-01-14
EVALUATION

6676175: BigApps crash JVM Client VM (build 10.0-b22, mixed mode, sharing) with SIGSEGV (0xb)
Summary: Add test for biased locking epoch before walking own thread stack in case of rare race
Reviewed-by: phh, never

(guessing build number fixed in again).
                                     
2008-11-24
EVALUATION

http://hg.openjdk.java.net/jdk7/hotspot-rt/hotspot/rev/2b42b31e7928
                                     
2008-11-21
SUGGESTED FIX

--- old/src/share/vm/runtime/biasedLocking.cpp	Fri Mar 28 11:59:14 2008
+++ new/src/share/vm/runtime/biasedLocking.cpp	Fri Mar 28 11:59:14 2008
@@ -579,7 +579,10 @@
   if (heuristics == HR_NOT_BIASED) {
     return NOT_BIASED;
   } else if (heuristics == HR_SINGLE_REVOKE) {
-    if (mark->biased_locker() == THREAD) {
+    Klass* k = Klass::cast(obj->klass());
+    markOop prototype_header = k->prototype_header();
+    if (mark->biased_locker() == THREAD && 
+        prototype_header->bias_epoch() == mark->bias_epoch()) {
       // A thread is trying to revoke the bias of an object biased
       // toward it, again likely due to an identity hash code
       // computation. We can again avoid a safepoint in this case
                                     
2008-05-30
EVALUATION

See comments.
                                     
2008-05-30



Hardware and Software, Engineered to Work Together