JDK-7197906 : BlockOffsetArray::power_to_cards_back() needs to handle > 32 bit shifts
  • Type: Bug
  • Component: hotspot
  • Sub-Component: gc
  • Affected Version: hs25
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2012-09-12
  • Updated: 2013-09-18
  • Resolved: 2012-09-25
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7 JDK 8 Other
7u40Resolved 8Fixed hs24Fixed
Related Reports
Duplicate :  
Duplicate :  
Hal Mo reported the following issue on the hotspot-gc-dev alias:


Hi all,

This is Hal Mo<kungu.mjh at taobao.com> from Alibaba Group(with OCA).

Our hadoop namenode crashed, when we set the heap size to 135G using CMS GC.
Attached please find the crash log(hs_err_pid.log).

I can steadily reproduce the crash on a test machine with 190G physical
memory, by a simple command:
$ java -Xmx135g -XX:+UseConcMarkSweepGC

Then I build a debug jvm and use gdb to debug the problem.

call stack

C  [libc.so.6+0x7a9b0]  memset+0x40
V  [libjvm.so+0x2b6c42]
 BlockOffsetArray::set_remainder_to_point_to_start_incl(unsigned long,
unsigned long, bool)+0xce
V  [libjvm.so+0x2b7043]
 BlockOffsetArray::set_remainder_to_point_to_start(HeapWord*, HeapWord*,
V  [libjvm.so+0x2b728d]
 BlockOffsetArray::BlockOffsetArray(BlockOffsetSharedArray*, MemRegion,
V  [libjvm.so+0x3c089f]
V  [libjvm.so+0x3be56f]
MemRegion, bool, FreeBlockDictionary::DictionaryChoice)+0x9b
V  [libjvm.so+0x3fd2e1]
unsigned long, int, CardTableRS*, bool,
V  [libjvm.so+0x4dc03e]  GenerationSpec::init(ReservedSpace, int,
V  [libjvm.so+0x4ced40]  GenCollectedHeap::initialize()+0x510
V  [libjvm.so+0x7c23c3]  Universe::initialize_heap()+0x31d
V  [libjvm.so+0x7c27ec]  universe_init()+0xa6
V  [libjvm.so+0x5056e2]  init_globals()+0x34
V  [libjvm.so+0x7ac926]  Threads::create_vm(JavaVMInitArgs*, bool*)+0x23a
V  [libjvm.so+0x53f3d4]  JNI_CreateJavaVM+0x7a

in function BlockOffsetArray::set_remainder_to_point_to_start_inc, inside
the for loop:
    size_t reach = start_card - 1 + (power_to_cards_back(i+1) - 1);
when i = 7, the value of reach was 0. then the loop could not break, and
    _array->set_offset_array(start_card_for_region, reach, offset,
accessed the wrong address, and crashed.

the root cause was
static size_t power_to_cards_back(uint i) {
    return (size_t)(1 << (LogBase * i));
the literal 1 is a 32bit int, and 1<<32 overflow.

Here was my fix(has been tested), also found in attached file

+++ b/src/share/vm/memory/blockOffsetTable.hpp
@@ -289,7 +289,7 @@

static size_t power_to_cards_back(uint i) {
- return (size_t)(1 << (LogBase * i));
+ return (size_t)1 << (LogBase * i);
static size_t power_to_words_back(uint i) {
return power_to_cards_back(i) * N_words;

Contributed-by: Hal Mo <kungu.mjh at taobao.com>

Similar situation also found in G1, but the size is mega(2^20) based.
2^(32+20) is too large to overflow.

EVALUATION First cast to size_t then shift.