Bug ID: JDK-7011940 iCMS: SIGSEGV in SweepClosure::do_already_free

Type: Bug
Component: hotspot
Sub-Component: gc
Affected Version: 7

Priority: P2
Status: Closed
Resolution: Fixed
OS: linux
CPU: x86

Submitted: 2011-01-12
Updated: 2011-03-07
Resolved: 2011-03-07

JDK 6	JDK 7	Other
6u25Fixed	7Fixed	hs20Fixed

35 Nightly test failures. All SEGVs in SweepClosure:do_already_free_chunk().

Results page can be found here:
http://sqeweb.sfbay/net/sqenfs-2/export2/results/vm/gtee/JDK7/NIGHTLY/VM/2011-01-11/GC_Baseline-Xinc/vm/linux-amd64/server/mixed/linux-amd64_vm_server_mixed_vm.parallel_class_loading.testlist/analysis.html

Results Directory:
/net/sqenfs-2.sfbay/export2/results/vm/gtee/JDK7/NIGHTLY/VM/2011-01-11/GC_Baseline-Xinc/vm/linux-amd64/server/mixed/linux-amd64_vm_server_mixed_vm.parallel_class_loading.testlist

Machine:
vm-amd64-05

Stack Trace:
Stack: [0x0000000040e9e000,0x0000000040f9f000],  sp=0x0000000040f9dae0,  free space=1022k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x5759d0]  SweepClosure::do_already_free_chunk(FreeChunk*)+0x360;;  SweepClosure::do_already_free_chunk(FreeChunk*)+0x360
V  [libjvm.so+0x59266c]  SweepClosure::do_blk_careful(HeapWord*)+0x12c;;  SweepClosure::do_blk_careful(HeapWord*)+0x12c
V  [libjvm.so+0x51b95d]  CompactibleFreeListSpace::blk_iterate_careful(BlkClosureCareful*)+0x3d;;  CompactibleFreeListSpace::blk_iterate_careful(BlkClosureCareful*)+0x3d
V  [libjvm.so+0x57ab19]  CMSCollector::sweepWork(ConcurrentMarkSweepGeneration*, bool)+0x119;;  CMSCollector::sweepWork(ConcurrentMarkSweepGeneration*, bool)+0x119
V  [libjvm.so+0x583d50]  CMSCollector::sweep(bool)+0x900;;  CMSCollector::sweep(bool)+0x900
V  [libjvm.so+0x59101d]  CMSCollector::collect_in_background(bool)+0x39d;;  CMSCollector::collect_in_background(bool)+0x39d
V  [libjvm.so+0x598ab3]  ConcurrentMarkSweepThread::run()+0x1a3;;  ConcurrentMarkSweepThread::run()+0x1a3
V  [libjvm.so+0x9c0480]  java_start(Thread*)+0xf0;;  _ZL10java_startP6Thread+0xf0

Faulting code:
Instructions: (pc=0x00002aadf456c9d0)
0x00002aadf456c9b0:   e7 48 8b 5d d8 4c 8b 65 e0 4c 8b 6d e8 4c 8b 75
0x00002aadf456c9c0:   f0 4c 8b 7d f8 c9 e9 95 b5 ff ff 0f 1f 44 00 00
0x00002aadf456c9d0:   49 8b 55 00 48 89 d0 83 e0 07 48 83 e8 01 0f 85
0x00002aadf456c9e0:   5a fe ff ff 81 e2 80 00 00 00 0f 84 4e fe ff ff 
;; 00002aadf456c9c0 f0 4c 8b 7d f8          lock mov 0xfffffffffffffff8(%rbp),%r15
;; 00002aadf456c9c5 c9                      leaveq 
;; 00002aadf456c9c6 e9 95 b5 ff ff          jmpq   0x00002aadf4567f60
;; 00002aadf456c9cb 0f 1f                   (bad)  
;; 00002aadf456c9cd 44 00 00                add    %r8b,(%rax)
;; ---------------
;; 00002aadf456c9d0 49 8b 55 00             mov    0x0(%r13),%rdx
;; 00002aadf456c9d4 48 89 d0                mov    %rdx,%rax
;; 00002aadf456c9d7 83 e0 07                and    $0x7,%eax
;; 00002aadf456c9da 48 83 e8 01             sub    $0x1,%rax
;; 00002aadf456c9de 0f 85 5a fe ff ff       jne    0x00002aadf456c83e
;; 00002aadf456c9e4 81 e2 80 00 00 00       and    $0x80,%edx
;; 00002aadf456c9ea 0f 84 4e fe ff ff       je     0x00002aadf456c83e

We die because r13 has the value:
R13=0x0000000100000000 is an unknown value

which looks like a size rather than a pointer (or it could be the end of the perm Gen according to the heap below).

Heap:
Heap
 par new generation   total 19136K, used 12970K [0x00000000f3000000, 0x00000000f44c0000, 0x00000000f44c0000)
  eden space 17024K,  74% used [0x00000000f3000000, 0x00000000f3c54078, 0x00000000f40a0000)
  from space 2112K,  16% used [0x00000000f40a0000, 0x00000000f40f6988, 0x00000000f42b0000)
  to   space 2112K,   0% used [0x00000000f42b0000, 0x00000000f42b0000, 0x00000000f44c0000)
 concurrent mark-sweep generation total 63872K, used 167K [0x00000000f44c0000, 0x00000000f8320000, 0x00000000fae00000)
 concurrent-mark-sweep perm gen total 83968K, used 72671K [0x00000000fae00000, 0x0000000100000000, 0x0000000100000000)


Failing tests:
runtime/ParallelClassLoading/stress-redefine/freeLock/reflect/inner-complex
runtime/ParallelClassLoading/stress-redefine/freeLock/reflect/inner-simple
runtime/ParallelClassLoading/stress-redefine/holdLock/reflect/inner-simple
runtime/ParallelClassLoading/mixed/systemloader/forName/anonymous-complex
runtime/ParallelClassLoading/mixed/systemloader/forName/anonymous-simple
runtime/ParallelClassLoading/mixed/systemloader/forName/dynamic-init/anonymous-simple
runtime/ParallelClassLoading/mixed/systemloader/forName/independent
runtime/ParallelClassLoading/mixed/systemloader/forName/init-simple
runtime/ParallelClassLoading/mixed/systemloader/loadClass/init-simple
runtime/ParallelClassLoading/mixed/systemloader/loadClass/tree
runtime/ParallelClassLoading/stress-redefine/holdLock/loadClass/dynamic-init/interface
runtime/ParallelClassLoading/stress-redefine/holdLock/loadClass/dynamic-init/interface
runtime/ParallelClassLoading/std_CLs/MLet/loadClass/redefine/dynamic-init/inner-complex	
runtime/ParallelClassLoading/std_CLs/MLet/loadClass/redefine/dynamic-init/inner-simple
runtime/ParallelClassLoading/std_CLs/MLet/reflect/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/URLClassLoader/forName/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/URLClassLoader/forName/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/PrivateMLet/loadClass/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/PrivateMLet/forName/redefine/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/dynamic-init/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/dynamic-init/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/dynamic-init/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/reflect/redefine/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/inner-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/dynamic-init/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/dynamic-init/init-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/loadClass/redefine/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/init-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/init-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/dynamic-init/inner-simple
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/dynamic-init/anonymous-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/dynamic-init/init-complex
runtime/ParallelClassLoading/std_CLs/SecureClassLoader/forName/redefine/inner-simple

EVALUATION http://hg.openjdk.java.net/jdk7/hotspot-gc/hotspot/rev/c91cc404ca46

14-01-2011

EVALUATION The sweeping code was attempting to indirect from an address at the (exclusive) end of the space when checking for a condition. Introduced in the fix for 7008136. I left the "Introduced in Release" filed empty because the bug did not (so far) make it out of the GC baseline repo.

12-01-2011

SUGGESTED FIX diff --git a/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp b/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp --- a/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp +++ b/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp @@ -8119,8 +8119,10 @@ void SweepClosure::do_already_free_chunk // if the next chunk is a free block that can't be coalesced // it doesn't make sense to remove this chunk from the free lists FreeChunk* nextChunk = (FreeChunk*)(addr + size); - if (nextChunk->isFree() && // The next chunk is free... - nextChunk->cantCoalesce()) { // ... but cant be coalesced + assert((HeapWord*)nextChunk <= _sp->end(), "Chunk size out of bounds?"); + if ((HeapWord*)nextChunk < _sp->end() && // There is another free chunk to the right ... + nextChunk->isFree() && // ... which is free... + nextChunk->cantCoalesce()) { // ... but can't be coalesced // nothing to do } else { // Potentially the start of a new free range:

12-01-2011