Ashok reported the following crash in JVM/TI GetCurrentContendedMonitor():

Hi Daniel,

 

I am working on a JVM crash in our environment in a JVMTI call.

I have looked at the problem and analyzed the core dump, I don���t see a possibility of the JVMD agent causing this crash. I am suspecting a bug in JVM code.

 

Can you please have a look at this crash and let us know your view on it or can you suggest others from the JVM team who could have a look at it ( I could raise a bug for this).

 

The details of the crash and the related files and its location are in the attached file. I have attached the hs_err file for reference.

 

Thanks and Regards,

Ashok
Here's the HSX-19 version of the code that is crashing. I don't have
a copy of HSX-19.1 at my fingertips...

src/share/vm/prims/jvmtiEnvBase.cpp:

   642  jvmtiError
   643  JvmtiEnvBase::get_current_contended_monitor(JavaThread *calling_thread,
JavaThread *java_thread, jobject *monitor_ptr) {
   644  #ifdef ASSERT
   645    uint32_t debug_bits = 0;
   646  #endif
   647    assert((SafepointSynchronize::is_at_safepoint() ||
   648            is_thread_fully_suspended(java_thread, false, &debug_bits)),
   649           "at safepoint or target thread is suspended");
   650    oop obj = NULL;
   651    ObjectMonitor *mon = java_thread->current_waiting_monitor();
   652    if (mon == NULL) {
   653      // thread is not doing an Object.wait() call
   654      mon = java_thread->current_pending_monitor();
   655      if (mon != NULL) {
   656        // The thread is trying to enter() or raw_enter() an ObjectMonitor
.
   657        obj = (oop)mon->object();
   658        // If obj == NULL, then ObjectMonitor is raw which doesn't count
   659        // as contended for this API
   660      }
   661      // implied else: no contended ObjectMonitor
   662    } else {
   663      // thread is doing an Object.wait() call
   664      obj = (oop)mon->object();
   665      assert(obj != NULL, "Object.wait() should have an object");
   666    }
   667
   668    if (obj == NULL) {
   669      *monitor_ptr = NULL;
   670    } else {
   671      HandleMark hm;
   672      Handle     hobj(obj);
   673      *monitor_ptr = jni_reference(calling_thread, hobj);
   674    }
   675    return JVMTI_ERROR_NONE;
   676  }

The above function matches the current HSX-24-B04 source.


Based a quick look at the disassembly that Ashok provided
(I stripped off some of the name mangling stuff for clarity):

(gdb) disass 0x00002af8d716b911
Dump of assembler code for function JvmtiEnvBase29get_current_contended_monitor:
0x00002af8d716b8e0 <JvmtiEnvBase29get_current_contended_monitor+0>:    push   %rbp
0x00002af8d716b8e1 <JvmtiEnvBase29get_current_contended_monitor+1>:    mov    %rsp,%rbp
0x00002af8d716b8e4 <JvmtiEnvBase29get_current_contended_monitor+4>:    sub    $0x60,%rsp
0x00002af8d716b8e8 <JvmtiEnvBase29get_current_contended_monitor+8>:    mov    0xc8(%rdx),%rax
0x00002af8d716b8ef <JvmtiEnvBase29get_current_contended_monitor+15>:   mov    %r13,-0x18(%rbp)
0x00002af8d716b8f3 <JvmtiEnvBase29get_current_contended_monitor+19>:   mov    %r14,-0x10(%rbp)
0x00002af8d716b8f7 <JvmtiEnvBase29get_current_contended_monitor+23>:   mov    %r15,-0x8(%rbp)
0x00002af8d716b8fb <JvmtiEnvBase29get_current_contended_monitor+27>:   xor    %r13d,%r13d
0x00002af8d716b8fe <JvmtiEnvBase29get_current_contended_monitor+30>:   mov    %rbx,-0x28(%rbp)
0x00002af8d716b902 <JvmtiEnvBase29get_current_contended_monitor+34>:   mov    %r12,-0x20(%rbp)
0x00002af8d716b906 <JvmtiEnvBase29get_current_contended_monitor+38>:   test   %rax,%rax
0x00002af8d716b909 <JvmtiEnvBase29get_current_contended_monitor+41>:   mov    %rsi,%r15
0x00002af8d716b90c <JvmtiEnvBase29get_current_contended_monitor+44>:   mov    %rcx,%r14
0x00002af8d716b90f <JvmtiEnvBase29get_current_contended_monitor+47>:   je     0x2af8d716b990 <JvmtiEnvBase29get_current_contended_monitor+176>
0x00002af8d716b911 <JvmtiEnvBase29get_current_contended_monitor+49>:   mov    0x8(%rax),%r13
0x00002af8d716b915 <JvmtiEnvBase29get_current_contended_monitor+53>:   test   %r13,%r13
0x00002af8d716b918 <JvmtiEnvBase29get_current_contended_monitor+56>:   je     0x2af8d716b986 <JvmtiEnvBase29get_current_contended_monitor=+166>


I think the crash is happening at line 664:

   662    } else {
   663      // thread is doing an Object.wait() call
   664      obj = (oop)mon->object();

on the attempt to dereference 'mon' to get the associated object.