Bug ID: JDK-6990933 assert(sender_cb) failed: sanity in frame::sender_for_interpreter

Type: Bug
Component: hotspot
Sub-Component: compiler
Affected Version: hs20

Priority: P3
Status: Closed
Resolution: Fixed
OS: generic
CPU: generic

Submitted: 2010-10-11
Updated: 2012-02-01
Resolved: 2011-03-08

JDK 6	JDK 7	Other
6u25Fixed	7Fixed	hs20Fixed

Test
	java/dyn/MethodHandlesTest.java

fails with 

# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/tmp/jprt/P1/B/094452.ct232829/source/src/cpu/x86/vm/frame_x86.cpp:364), pid=23754, tid=5
#  assert(sender_cb) failed: sanity

Stack: [0xfffffd7fd3f48000,0xfffffd7fd4048000],  sp=0xfffffd7fd4045370,  free space=1012k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x2454529];;  void VMError::report(outputStream*)+0x6c5
V  [libjvm.so+0x24555d0];;  void VMError::report_and_die()+0x4d8
V  [libjvm.so+0xdda683];;  void report_vm_error(const char*,int,const char*,const char*)+0x55f
V  [libjvm.so+0xf2e1b6];;  frame frame::sender_for_interpreter_frame(RegisterMap*)const+0xd2
V  [libjvm.so+0xf2f067];;  frame frame::sender(RegisterMap*)const+0x73
V  [libjvm.so+0xf1d602];;  void frame::deoptimize(JavaThread*)+0x4de
V  [libjvm.so+0xe26bc4];;  void Deoptimization::deoptimize(JavaThread*,frame,RegisterMap*)+0x1d4
V  [libjvm.so+0x23195d3];;  void JavaThread::deoptimize()+0xb9b
V  [libjvm.so+0x2493207];;  void VM_DeoptimizeAll::doit()+0x237
V  [libjvm.so+0x2492a61];;  void VM_Operation::evaluate()+0xf9
V  [libjvm.so+0x2490d0e];;  void VMThread::loop()+0x852
V  [libjvm.so+0x248fe32];;  void VMThread::run()+0xb6
V  [libjvm.so+0x1e947ba];;  java_start+0x6a6
C  [libc.so.1+0xd6e3b]  _thr_slot_offset+0x31b;;  _thr_setup+0x5b
C  [libc.so.1+0xd7070]  _thr_slot_offset+0x550;;  _lwp_start+0x0

VM_Operation (0xfffffd7fd350c610): DeoptimizeAll, mode: safepoint, requested by thread 0x0000000000db9000

EVALUATION http://hg.openjdk.java.net/jdk7/hotspot-comp/hotspot/rev/7d9caaedafce
18-12-2010
SUGGESTED FIX Don't use has_method_handle_invokes but check if CodeOffsets::DeoptMH is set: - if (has_method_handle_invokes()) { + if (offsets->value(CodeOffsets::DeoptMH) != -1) {
16-12-2010
EVALUATION The bug is that the nmethod constructor uses nmethod::has_method_handle_invokes but the _has_method_handle_invokes flag is not initialized until nmethod::copy_scopes_pcs is called and thus always returns false. This results in _deoptimize_mh_offset to be -1 and so deopt_mh_handler_begin points 1 byte before the nmethod pointer resulting in the assert.
16-12-2010
EVALUATION Disabling DeoptimizeALot results in a different crash. Not sure yet if these are related. $ gamma -Xcomp -XX:+UnlockExperimentalVMOptions -XX:+EnableMethodHandles -XX:+EnableInvokeDynamic -XX:-UseCompressedOops -cp /java/devtools/share/junit/latest/junit.jar:. org.junit.runner.JUnitCore test.java.dyn.MethodHandlesTest VM option '+UnlockExperimentalVMOptions' VM option '+EnableMethodHandles' VM option '+EnableInvokeDynamic' VM option '-UseCompressedOops' JUnit version 4.4 .IIIIII...........................# # A fatal error has been detected by the Java Runtime Environment: # # SIGSEGV (0xb) at pc=0xfffffd7ffb11142c, pid=8672, tid=1 # # JRE version: 7.0 # Java VM: OpenJDK 64-Bit Server VM (20.0-b01-internal-jvmg compiled mode solaris-amd64 ) # Problematic frame: # J java.util.concurrent.ConcurrentHashMap$Segment.put(Ljava/lang/Object;ILjava/lang/Object;Z)Ljava/lang/Object; # # An error report file with more information is saved as: # /home/ct232829/jdk7/jdk7/jdk/hs_err_pid8672.log # # If you would like to submit a bug report, please visit: # http://java.sun.com/webapps/bugreport/crash.jsp # Current thread is 1 Dumping core ...
11-10-2010
EVALUATION I can reproduce the assert doing: $ gamma -XX:+ShowMessageBoxOnError -Xcomp -XX:+DeoptimizeALot -XX:+UnlockExperimentalVMOptions -XX:+EnableMethodHandles -XX:+EnableInvokeDynamic -XX:-UseCompressedOops -cp /java/devtools/share/junit/latest/junit.jar:. org.junit.runner.JUnitCore test.java.dyn.MethodHandlesTest VM option '+ShowMessageBoxOnError' VM option '+DeoptimizeALot' VM option '+UnlockExperimentalVMOptions' VM option '+EnableMethodHandles' VM option '+EnableInvokeDynamic' VM option '-UseCompressedOops' JUnit version 4.4 .IIIIII.# To suppress the following error report, specify this argument # after -XX: or in .hotspotrc: SuppressErrorAt=/frame_x86.cpp:364 ============================================================================== Unexpected Error ------------------------------------------------------------------------------ Internal Error at frame_x86.cpp:364, pid=8661, tid=15 assert(sender_cb) failed: sanity Do you want to debug the problem? To debug, run 'dbx - 8661'; then switch to thread 15 Enter 'yes' to launch dbx automatically (PATH must include dbx) Otherwise, press RETURN to abort... ============================================================================== (dbx) where current thread: t@15 [1] __waitid(0x0, 0x21d6, 0xfffffd7ffac86640, 0x3, 0xfffffd7fff2fdfc4, 0xfffffd7ffefc6a00), at 0xfffffd7fff26461a [2] waitid(0x0, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfffffd7fff24d35b [3] waitpid(0x0, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfffffd7fff20ef94 =>[4] os::fork_and_exec(cmd = 0xfffffd7fa3d03c74 "dbx - 8661"), line 5978 in "os_solaris.cpp" [5] VMError::show_message_box(this = 0xfffffd7ffac869d0, buf = 0xfffffd7fa3d03c74 "dbx - 8661", buflen = 2000), line 53 in "vmError_solaris.cpp" [6] VMError::report_and_die(this = 0xfffffd7ffac869d0), line 725 in "vmError.cpp" [7] report_vm_error(file = 0xfffffd7fa37e901d "/home/ct232829/hotspot-comp/hotspot/src/cpu/x86/vm/frame_x86.cpp", line = 364, error_msg = 0xfffffd7fa37e905e "assert(sender_cb) failed", detail_msg = 0xfffffd7fa37e9077 "sanity"), line 176 in "debug.cpp" [8] frame::sender_for_interpreter_frame(this = 0xfffffd7ffac86c88, map = 0xfffffd7ffac86cb8), line 364 in "frame_x86.cpp" [9] frame::sender(this = 0xfffffd7ffac86c88, map = 0xfffffd7ffac86cb8), line 487 in "frame_x86.cpp" [10] frame::deoptimize(this = 0xfffffd7ffac87350, thread = 0x447800), line 293 in "frame.cpp" [11] Deoptimization::deoptimize_single_frame(thread = 0x447800, fr = CLASS), line 1048 in "deoptimization.cpp" [12] Deoptimization::deoptimize(thread = 0x447800, fr = CLASS, map = 0xfffffd7ffac874c0), line 1063 in "deoptimization.cpp" [13] JavaThread::deoptimize(this = 0x447800), line 2319 in "thread.cpp" [14] VM_DeoptimizeAll::doit(this = 0xfffffd7fffdfcf78), line 115 in "vm_operations.cpp" [15] VM_Operation::evaluate(this = 0xfffffd7fffdfcf78), line 46 in "vm_operations.cpp" [16] VMThread::evaluate_operation(this = 0x13b8000, op = 0xfffffd7fffdfcf78), line 338 in "vmThread.cpp" [17] VMThread::loop(this = 0x13b8000), line 444 in "vmThread.cpp" [18] VMThread::run(this = 0x13b8000), line 251 in "vmThread.cpp" [19] java_start(thread_addr = 0x13b8000), line 1010 in "os_solaris.cpp" [20] _thrp_setup(0x0, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfffffd7fff25acf5 [21] _lwp_start(0x0, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfffffd7fff25afb0 (dbx) fr 8 Current function is frame::sender_for_interpreter_frame 364 assert(sender_cb, "sanity"); (dbx) p this this = { _sp = 0xfffffd7fffdfd360 _pc = 0xfffffd7ffb005dd4 "H\x8be��H��E��" _cb = 0xfffffd7ffb004dd0 _deopt_state = not_deoptimized _fp = 0xfffffd7fffdfd3d0 _unextended_sp = 0xfffffd7fffdfd360 _check_value = class frame::CheckValueClosure /* STATIC CLASS / _check_oop = class frame::CheckOopClosure / STATIC CLASS / _zap_dead = class frame::ZapDeadClosure / STATIC CLASS */ } (dbx) p findpc((intptr_t) sender_pc) "Executing findpc" 0xfffffd7ffb370acf is pointing to unknown location findpc((intptr_t ) sender_pc) = (void)
11-10-2010