United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-7158988 jvm crashes while debugging on x86_32 and x86_64
JDK-7158988 : jvm crashes while debugging on x86_32 and x86_64

Details
Type:
Bug
Submit Date:
2012-04-04
Status:
Closed
Updated Date:
2013-07-18
Project Name:
JDK
Resolved Date:
2012-04-25
Component:
hotspot
OS:
os_x,generic
Sub-Component:
runtime
CPU:
x86,generic
Priority:
P3
Resolution:
Fixed
Affected Versions:
7
Fixed Versions:
hs24 (b08)

Related Reports
Backport:
Backport:
Backport:
Relates:

Sub Tasks

Description
Hi All,
we encountered a JVM crash while debugging a Java program under load.We set a watch point to a variable using eclipse, so that the watchpoint suspends just the thread. As a result, the jvm crashes with a corrupted oop.
I attached two java files to reproduce the bug. TestPostFieldModification starts two threads. One thread modifies the String 'value'. The other thread triggers a GC periodically. In order to reproduce, run the program in a debugger, set a modification watch point for the field value and you should be able to crash the jvm.

The second java file I attached plays the part of the debugger to reproduce the bug without eclipse.. The program launches a second jvm via jdi and sets the watchpoint.
Command line:

$TEST_JDK/bin/java -cp $TEST_JDK/lib/tools.jar:. FieldMonitor

The problem is in the template table in jvmti_post_fast_field_mod(). At the entry of that function, the top of the java expression stack (tos) is already popped to rax or xmm0. Before the call to InterpreterRuntime::post_field_modification() the value is pushed back to the stack.
A pointer to this value is passed as argument jvalue to the runtime call. After pushing tos back to the stack, rax is pushed again to the stack and rax is restored with that value.

This value will not be updated during a GC and rax will be restored with a corrupted oop.
Another problem is that xmm0 will not be restored after the call.

False stack layout:

   :     :
   +-----+
   | ... |
   | rax | <- Top of expression stack updated by GC
   | rax | <- another copy of rax, not updated by GC, used to restore
              rax after call_VM()

Expected stack layout:

   :     :
   +-----+
   | ... |
   | rax | <- Top of expression stack, updated by GC, used to
              restore rax after call_VM()

The following webrev suggests a fix:

http://sapjvm.com/as/webrevs/post_field_modification/

The fix is based on the code on sparc, push tos values to the stack and restore it after the call, so that the expression stack has the expected layout and oops can be handled correctly during a GC.

Regards,
Axel

                                    

Comments
EVALUATION

http://hg.openjdk.java.net/hsx/hotspot-main/hotspot/rev/19e197e2a1af
                                     
2012-04-11
EVALUATION

http://hg.openjdk.java.net/lambda/lambda/hotspot/rev/19e197e2a1af
                                     
2012-06-29
EVALUATION

http://hg.openjdk.java.net/hsx/hotspot-rt/hotspot/rev/19e197e2a1af
                                     
2012-04-05
RULE runtime/7158988/FieldMonitor.java Crash SIGSEGV
                                     
2012-10-22
RULE runtime/7158988/FieldMonitor.java Crash EXCEPTION_ACCESS_VIOLATION 
                                     
2012-10-22



Hardware and Software, Engineered to Work Together