JDK-6888111 : JIT bug: local constant variable value altered
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 6u14
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2009-10-05
  • Updated: 2011-02-16
  • Resolved: 2009-10-05
Related Reports
Duplicate :  
Description
FULL PRODUCT VERSION :
java version "1.6.0_16"
Java(TM) SE Runtime Environment (build 1.6.0_16-b01)
Java HotSpot(TM) 64-Bit Server VM (build 14.2-b01, mixed mode)

FULL OS VERSION :
Windows 7: Microsoft Windows [Version 6.1.7600]
Windows Vista 64bit Service pack 1 Microsoft Windows [Version 6.0.6001]
MacOS: Darwin gozer.thetuscorp.com 10.0.0 Darwin Kernel Version 10.0.0: Fri Jul 31 22:47:34 PDT 2009; root:xnu-1456.1.25~1/RELEASE_I386 i386 (snow leopard)
Linux fittycentos.thetuscorp.com 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:10:25 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux

A DESCRIPTION OF THE PROBLEM :
It appears that the 64-bit JIT, starting in 1.6 update 14 (and still present in update 16), has a problem where the value of a local constant variable is being silently modified in some circumstances.  Disabling JIT (-Xint) makes the problem go away.

It also appears to be timing related.  On some machines you need to run the repro many times to get a failure.

Look at the partition() method in the attached test case.  The comments there describe further adjustments which narrow down the problem.

THE PROBLEM WAS REPRODUCIBLE WITH -Xint FLAG: No

THE PROBLEM WAS REPRODUCIBLE WITH -server FLAG: Yes

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Compile and run attached test case.  You may need to run several times to see a failure.

EXPECTED VERSUS ACTUAL BEHAVIOR :
With JIT disabled, no error occurs:

        $ java -Xint JavaU14JitProblem

        ******** LOOP 1

        ******** LOOP 2

        ******** LOOP 3

        ******** LOOP 4

        ******** LOOP 5

With JIT enabled, "Array out of order" error messages appear:
  (Note: You may need to try running several times to see a failure.)

        $ java JavaU14JitProblem

        ******** LOOP 1

        ******** LOOP 2
        simple quicksort: Array out of order at index 3
        [804, 805, 808, 809, 806, 807, 810, 811, 812, 813, 814, 815, 816, 817, 818]
        simple quicksort: Original unsorted array:
        [808, 810, 809, 804, 805, 806, 807, 811, 812, 813, 814, 815, 816, 817, 818]


        ******** LOOP 3
        simple quicksort: Array out of order at index 5
        [175, 176, 177, 178, 448, 1006, 451, 476, 1006, 1007]
        simple quicksort: Original unsorted array:
        [1006, 1007, 176, 175, 177, 178, 448, 451, 476, 1006]

        simple quicksort: Array out of order at index 3
        [804, 805, 808, 809, 806, 807, 810, 811, 812, 813, 814, 815, 816, 817, 818]
        simple quicksort: Original unsorted array:
        [808, 810, 809, 804, 805, 806, 807, 811, 812, 813, 814, 815, 816, 817, 818]

        simple quicksort: Array out of order at index 5
        [804, 805, 806, 811, 815, 817, 807, 808, 812, 813, 814, 816, 818]
        simple quicksort: Original unsorted array:
        [818, 804, 815, 817, 805, 811, 806, 812, 808, 814, 813, 816, 807]

                ... error output continues ...

REPRODUCIBILITY :
This bug can be reproduced often.

---------- BEGIN SOURCE ----------
Attached seperatly
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Look at the partition() method in the attached test case.  The comments there describe further adjustments which narrow down the problem.

In short, wokrarounds appear to include any of:

- use 32-bit JVM
- disable JIT (-Xint)
- refrain from using local variables in methods
- local variables are immediately modified after initial values assigned

Release Regression From : 6u14
The above release value was the last known release where this 
bug was not reproducible. Since then there has been a regression.

Comments
EVALUATION I looked on the generated code and verified that the fix for 6843752 fixed this problem.
05-10-2009