JDK-6306730 : Incorrect management of C-heap GrowableArrays
  • Type: Bug
  • Component: hotspot
  • Sub-Component: gc
  • Affected Version: 6
  • Priority: P2
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2005-08-05
  • Updated: 2010-04-02
  • Resolved: 2005-09-17
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other JDK 6
5.0u6Resolved 6 b52Fixed
Related Reports
Relates :  
Relates :  
Description
Certain GrowableArrays are being allocated with the "C_heap" flag set
to true but without the ResourceObj::C_HEAP flag being passed to
operator new for the GrowableArray object itself. This is a problem
because it is very easy to accidentally allocate the GrowableArray
underneath a ResourceMark which is later cleared, which will cause the
storage for the GrowableArray object itself (including nesting, arena,
and data pointer flags) to be overwritten later. This can cause
crashes in product mode and/or assertion failures in debug mode. In
the absence of assertions that the allocation class of the
GrowableArray matches that of its contained data array, these
allocation sites should be fixed to pass ResourceObj::C_HEAP as
argument to operator new. It is possible that these sites are benign
because the allocation is being done at a point where the ResourceMark
nesting is known, but if we add assertion checking later then these
allocation sites will fail.

When making this change the responsible engineer should be careful not
to introduce new memory leaks. In particular, the following cleanup
sequence for these arrays should be obeyed:

  array->clear_and_deallocate();
  delete array; // call destructors, but ResourceObj destructor
                // doesn't free memory which was allocated in 
                // the C-heap with malloc
  FreeHeap(Array);  // ... so use this to free the memory

See Label::free() in assembler.hpp for an example.

The relevant allocation sites for this group's code are attached.
src/share/vm/memory/defNewGeneration.cpp:716:    _promo_failure_scan_stack = new GrowableArray<oop>(40, true);
   - (** SERIOUS **)

Comments
EVALUATION The instances of resource allocated growableArrays in the attachment are not bugs and neither is _promo_failure_scan_stack. From Ramki: thanks for checking. Luckily, in the defNew(SerialGC) case there is no ResourceMark that gets destroyed before deallocation of the array, so i think we are fine. This need not be backported to 5.0u6. In mustang, the GrowableArray's are allocated on C_HEAP and deleted as part of bug 6306746. So this is fixed with that bug.
07-09-2005

EVALUATION ###@###.### has fixes; under review and testing.
26-08-2005