United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-7011940 iCMS: SIGSEGV in SweepClosure::do_already_free_chunk(FreeChunk*)+0x360
JDK-7011940 : iCMS: SIGSEGV in SweepClosure::do_already_free_chunk(FreeChunk*)+0x360

Details
Type:
Bug
Submit Date:
2011-01-12
Status:
Closed
Updated Date:
2011-03-07
Project Name:
JDK
Resolved Date:
2011-03-07
Component:
hotspot
OS:
linux
Sub-Component:
gc
CPU:
x86
Priority:
P2
Resolution:
Fixed
Affected Versions:
7
Fixed Versions:
hs20 (b07)

Related Reports
Backport:
Backport:
Relates:

Sub Tasks

Description
35 Nightly test failures. All SEGVs in SweepClosure:do_already_free_chunk().

Results page can be found here:
http://sqeweb.sfbay/net/sqenfs-2/export2/results/vm/gtee/JDK7/NIGHTLY/VM/2011-01-11/GC_Baseline-Xinc/vm/linux-amd64/server/mixed/linux-amd64_vm_server_mixed_vm.parallel_class_loading.testlist/analysis.html

Results Directory:
/net/sqenfs-2.sfbay/export2/results/vm/gtee/JDK7/NIGHTLY/VM/2011-01-11/GC_Baseline-Xinc/vm/linux-amd64/server/mixed/linux-amd64_vm_server_mixed_vm.parallel_class_loading.testlist

Machine:
vm-amd64-05

Stack Trace:
Stack: [0x0000000040e9e000,0x0000000040f9f000],  sp=0x0000000040f9dae0,  free space=1022k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x5759d0]  SweepClosure::do_already_free_chunk(FreeChunk*)+0x360;;  SweepClosure::do_already_free_chunk(FreeChunk*)+0x360
V  [libjvm.so+0x59266c]  SweepClosure::do_blk_careful(HeapWord*)+0x12c;;  SweepClosure::do_blk_careful(HeapWord*)+0x12c
V  [libjvm.so+0x51b95d]  CompactibleFreeListSpace::blk_iterate_careful(BlkClosureCareful*)+0x3d;;  CompactibleFreeListSpace::blk_iterate_careful(BlkClosureCareful*)+0x3d
V  [libjvm.so+0x57ab19]  CMSCollector::sweepWork(ConcurrentMarkSweepGeneration*, bool)+0x119;;  CMSCollector::sweepWork(ConcurrentMarkSweepGeneration*, bool)+0x119
V  [libjvm.so+0x583d50]  CMSCollector::sweep(bool)+0x900;;  CMSCollector::sweep(bool)+0x900
V  [libjvm.so+0x59101d]  CMSCollector::collect_in_background(bool)+0x39d;;  CMSCollector::collect_in_background(bool)+0x39d
V  [libjvm.so+0x598ab3]  ConcurrentMarkSweepThread::run()+0x1a3;;  ConcurrentMarkSweepThread::run()+0x1a3
V  [libjvm.so+0x9c0480]  java_start(Thread*)+0xf0;;  _ZL10java_startP6Thread+0xf0

Faulting code:
Instructions: (pc=0x00002aadf456c9d0)
0x00002aadf456c9b0:   e7 48 8b 5d d8 4c 8b 65 e0 4c 8b 6d e8 4c 8b 75
0x00002aadf456c9c0:   f0 4c 8b 7d f8 c9 e9 95 b5 ff ff 0f 1f 44 00 00
0x00002aadf456c9d0:   49 8b 55 00 48 89 d0 83 e0 07 48 83 e8 01 0f 85
0x00002aadf456c9e0:   5a fe ff ff 81 e2 80 00 00 00 0f 84 4e fe ff ff 
;; 00002aadf456c9c0 f0 4c 8b 7d f8          lock mov 0xfffffffffffffff8(%rbp),%r15
;; 00002aadf456c9c5 c9                      leaveq 
;; 00002aadf456c9c6 e9 95 b5 ff ff          jmpq   0x00002aadf4567f60
;; 00002aadf456c9cb 0f 1f                   (bad)  
;; 00002aadf456c9cd 44 00 00                add    %r8b,(%rax)
;; ---------------
;; 00002aadf456c9d0 49 8b 55 00             mov    0x0(%r13),%rdx
;; 00002aadf456c9d4 48 89 d0                mov    %rdx,%rax
;; 00002aadf456c9d7 83 e0 07                and    $0x7,%eax
;; 00002aadf456c9da 48 83 e8 01             sub    $0x1,%rax
;; 00002aadf456c9de 0f 85 5a fe ff ff       jne    0x00002aadf456c83e
;; 00002aadf456c9e4 81 e2 80 00 00 00       and    $0x80,%edx
;; 00002aadf456c9ea 0f 84 4e fe ff ff       je     0x00002aadf456c83e

We die because r13 has the value:
R13=0x0000000100000000 is an unknown value

which looks like a size rather than a pointer (or it could be the end of the perm Gen according to the heap below).

Heap:
Heap
 par new generation   total 19136K, used 12970K [0x00000000f3000000, 0x00000000f44c0000, 0x00000000f44c0000)
  eden space 17024K,  74% used [0x00000000f3000000, 0x00000000f3c54078, 0x00000000f40a0000)
  from space 2112K,  16% used [0x00000000f40a0000, 0x00000000f40f6988, 0x00000000f42b0000)
  to   space 2112K,   0% used [0x00000000f42b0000, 0x00000000f42b0000, 0x00000000f44c0000)
 concurrent mark-sweep generation total 63872K, used 167K [0x00000000f44c0000, 0x00000000f8320000, 0x00000000fae00000)
 concurrent-mark-sweep perm gen total 83968K, used 72671K [0x00000000fae00000, 0x0000000100000000, 0x0000000100000000)


Failing tests:
runtime/ParallelClassLoading/stress-redefine/freeLock/reflect/inner-complex
runtime/ParallelClassLoading/stress-redefine/freeLock/reflect/inner-simple
runtime/ParallelClassLoading/stress-redefine/holdLock/reflect/inner-simple
runtime/ParallelClassLoading/mixed/systemloader/forName/anonymous-complex
runtime/ParallelClassLoading/mixed/systemloader/forName/anonymous-simple
runtime/ParallelClassLoading/mixed/systemloader/forName/dynamic-init/anonymous-simple
runtime/ParallelClassLoading/mixed/systemloader/forName/independent
runtime/ParallelClassLoading/mixed/systemloader/forName/init-simple
runtime/ParallelClassLoading/mixed/systemloader/loadClass/init-simple
runtime/ParallelClassLoading/mixed/systemloader/loadClass/tree
runtime/ParallelClassLoading/stress-redefine/holdLock/loadClass/dynamic-init/interface
runtime/ParallelClassLoading/stress-redefine/holdLock/loadClass/dynamic-init/interface
runtime/ParallelClassLoading/std_CLs/MLet/loadClass/redefine/dynamic-init/inner-complex	
runtime/ParallelClassLoading/std_CLs/MLet/loadClass/redefine/dynamic-init/inner-simple
runtime/ParallelClassLoading/std_CLs/MLet/reflect/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/URLClassLoader/forName/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/URLClassLoader/forName/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/PrivateMLet/loadClass/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/PrivateMLet/forName/redefine/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/dynamic-init/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/dynamic-init/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/dynamic-init/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/dynamic-init/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/dynamic-init/init-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/init-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/dynamic-init/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/dynamic-init/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/dynamic-init/init-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/inner-simple

                                    

Comments
EVALUATION

The sweeping code was attempting to indirect from an address
at the (exclusive) end of the space when checking for a condition.
Introduced in the fix for 7008136.

I left the "Introduced in Release" filed empty because the bug
did not (so far) make it out of the GC baseline repo.
                                     
2011-01-12
SUGGESTED FIX

diff --git a/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp b/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
--- a/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
+++ b/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
@@ -8119,8 +8119,10 @@ void SweepClosure::do_already_free_chunk
         // if the next chunk is a free block that can't be coalesced
         // it doesn't make sense to remove this chunk from the free lists
         FreeChunk* nextChunk = (FreeChunk*)(addr + size);
-        if (nextChunk->isFree()    &&            // The next chunk is free...
-            nextChunk->cantCoalesce()) {         // ... but cant be coalesced
+        assert((HeapWord*)nextChunk <= _sp->end(), "Chunk size out of bounds?");
+        if ((HeapWord*)nextChunk < _sp->end() &&     // There is another free chunk to the right ...
+            nextChunk->isFree()               &&     // ... which is free...
+            nextChunk->cantCoalesce()) {             // ... but can't be coalesced
           // nothing to do
         } else {
           // Potentially the start of a new free range:
                                     
2011-01-12
EVALUATION

http://hg.openjdk.java.net/jdk7/hotspot-gc/hotspot/rev/c91cc404ca46
                                     
2011-01-14



Hardware and Software, Engineered to Work Together