JDK-8191620 : assert(is_native() && bcp == code_base() || contains(bcp) || VMError::is_error_reported())
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 10
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • Submitted: 2017-11-20
  • Updated: 2017-11-28
  • Resolved: 2017-11-21
Related Reports
Duplicate :  
JDK-8190817 - deopt special-case for _return_register_finalizer is confusing and leads to bugs
Duplicate :  
JDK-8191619 - assert(is_native() && bcp == code_base() || contains(bcp) || VMError::is_error_reported())
Relates :  
JDK-8189941 - Implementation JEP 312: Thread-local handshake
Description
urlhammer hit assert in GC thread

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (t:/workspace/open/src/hotspot/share/oops/method.cpp:238), pid=20364, tid=20708
#  assert(is_native() && bcp == code_base() || contains(bcp) || VMError::is_error_reported()) failed: bcp doesn't belong to this method: bcp: 0x00000007c0000f70, method: java.lang.Object.<init>()V
#
# JRE version: Java(TM) SE Runtime Environment (10.0) (fastdebug build 10-internal+0-2017-11-18-0331034.vm-sqe-notificationswwgrp.integ-jdk-hs)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 10-internal+0-2017-11-18-0331034.vm-sqe-notificationswwgrp.integ-jdk-hs, compiled mode, tiered, compressed oops, g1 gc, windows-amd64)
# Core dump will be written. Default location: T:\testoutput\jtreg\JTwork\scratch\0\results\client\5\hs_err_pid20364.mdmp
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -XX:MaxRAMPercentage=6 -Xcomp -XX:+CreateCoredumpOnCrash -ea -esa -XX:CompileThreshold=100 -XX:+UnlockExperimentalVMOptions -XX:+TieredCompilation -XX:+IgnoreUnrecognizedVMOptions -XX:+DeoptimizeALot -Djava.net.preferIPv6Addresses=false -XX:-PrintVMOptions -XX:+DisplayVMOutputToStderr -XX:+UsePerfData atg.core.net.URLHammer -script C:\ade\mesos\work_dir\jib-master\install\2017-11-18-0331034.vm-sqe-notifications_ww_grp.integ-jdk-hs\src.full\closed\test\hotspot\jtreg\applications\weblogic\urlhammer.script 10 200 -htmlStats stats.html -cookies -substitute -server 127.0.0.1:7001

Host: sca00ljz, Intel(R) Xeon(R) CPU E5-2690 0 @ 2.90GHz, 8 cores, 60G,  Windows Server 2012 R2 , 64 bit Build 9600 (6.3.9600.17415)
Time: Sat Nov 18 06:18:43 2017 Ame elapsed time: 26 seconds (0d 0h 0m 26s)

---------------  T H R E A D  ---------------

Current thread (0x0000001ab60c8800):  GCTaskThread "GC Thread#1" [stack: 0x0000001ad0610000,0x0000001ad0710000] [id=20708]

Stack: [0x0000001ad0610000,0x0000001ad0710000]
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
Comments
[~jwilhelm] It was introduced with 8189941.
21-11-2017
When was this issue introduced into the VM code?
21-11-2017
I confirmed that the thread in question was calling InterpreterRuntime::at_safepoint from TemplateTable::_return, and hs_err shows that a deoptimization just happened in that thread, so I'm pretty confident 8190817 will fix it.
21-11-2017
I think this is related to ThreadLocalHandshakes support and the new call to InterpreterRuntime::at_safepoint in TemplateTable::_return. I think what happens is when we the call_VM, it does save_bcp(), which stores whatever (junk) is in _bcp_register. If we took the weird deopt path as described in 8190817, then we came from a deoptimization and we didn't actually do restore_bcp() to get a valid value for the bcp register. 8190817 should fix this.
21-11-2017
I moved this to compiler, because the related AOT bug was in the compiler. It looks like we were deoptimizing a compiled frame for Object.<init> that was registering a finalizer.
21-11-2017
happened on linux-x64 as well: # # A fatal error has been detected by the Java Runtime Environment: # # Internal Error (/scratch/opt/mach5/mesos/work_dir/slaves/e72b529e-af37-4c00-b29e-141f3b57348c-S1138/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/bcdab603-4ebb-4d4e-96f8-2c7d0fc5e452/runs/9 ab4a21d-2367-4cc6-8a7f-f0852927aa09/workspace/open/src/hotspot/share/oops/method.cpp:238), pid=15855, tid=15867 # assert(is_native() && bcp == code_base() || contains(bcp) || VMError::is_error_reported()) failed: bcp doesn't belong to this method: bcp: 0x00000000e6b5df03, method: java.lang.Object.<init>()V # # JRE version: Java(TM) SE Runtime Environment (10.0) (fastdebug build 10-internal+0-2017-11-18-0331034.vm-sqe-notificationswwgrp.integ-jdk-hs) # Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 10-internal+0-2017-11-18-0331034.vm-sqe-notificationswwgrp.integ-jdk-hs, compiled mode, tiered, compressed oops, g1 gc, linux-amd64) # Core dump will be written. Default location: Core dumps may be processed with "/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e" (or dumping to /scratch/opt/mach5/mesos/work_dir/slaves/7aed79a7-ea87-4caa-8895 -f1d7e69bb48e-S4003/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/6ab1fc77-e2aa-4a05-9faa-0e72166d746e/runs/b6b8bbf1-f0af-4d79-81d9-56a7118953a2/testoutput/jtreg/JTwork/scratch/0/results/clien t/13/core.15855) # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp # --------------- S U M M A R Y ------------ Command Line: -XX:MaxRAMPercentage=8 -Xcomp -XX:+CreateCoredumpOnCrash -ea -esa -XX:CompileThreshold=100 -XX:+UnlockExperimentalVMOptions -XX:+TieredCompilation -XX:+IgnoreUnrecognizedVMOptions -XX:+Deoptimize ALot -Djava.net.preferIPv6Addresses=true -XX:-PrintVMOptions -XX:+DisplayVMOutputToStderr -XX:+UsePerfData atg.core.net.URLHammer -script /scratch/opt/mach5/mesos/work_dir/jib-master/install/2017-11-18-0331034 .vm-sqe-notifications_ww_grp.integ-jdk-hs/src.full/closed/test/hotspot/jtreg/applications/weblogic/urlhammer.script 10 200 -htmlStats stats.html -cookies -substitute -server 127.0.0.1:7001 Host: sca00mch.us.oracle.com, Intel(R) Xeon(R) CPU E5-2690 0 @ 2.90GHz, 6 cores, 29G, Oracle Linux Server release 7.1 Time: Fri Nov 17 21:48:45 2017 PST elapsed time: 33 seconds (0d 0h 0m 33s) --------------- T H R E A D --------------- Current thread (0x00007fa6d403d800): GCTaskThread "GC Thread#2" [stack: 0x00007fa6d81b5000,0x00007fa6d82b5000] [id=15867] Stack: [0x00007fa6d81b5000,0x00007fa6d82b5000], sp=0x00007fa6d82b24d0, free space=1013k Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code) V [libjvm.so+0x17f5e12] VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x162 V [libjvm.so+0x17f6bdf] VMError::report_and_die(Thread*, char const*, int, char const*, char const*, __va_list_tag*)+0x2f V [libjvm.so+0xb2571d] report_vm_error(char const*, int, char const*, char const*, ...)+0xdd V [libjvm.so+0x13a4cc5] Method::bci_from(unsigned char*) const+0x135 V [libjvm.so+0xc796bb] frame::oops_interpreted_do(OopClosure*, RegisterMap const*, bool)+0x17b V [libjvm.so+0x174619a] JavaThread::oops_do(OopClosure*, CodeBlobClosure*)+0x21a V [libjvm.so+0x1750662] Threads::possibly_parallel_oops_do(bool, OopClosure*, CodeBlobClosure*)+0xf2 V [libjvm.so+0xd89a9d] G1RootProcessor::process_java_roots(G1RootClosures*, G1GCPhaseTimes*, unsigned int)+0xad V [libjvm.so+0xd89d1c] G1RootProcessor::evacuate_roots(G1EvacuationRootClosures*, unsigned int)+0x4c V [libjvm.so+0xcc5549] G1ParTask::work(unsigned int)+0x169 V [libjvm.so+0x186e730] GangWorker::loop()+0xe0 V [libjvm.so+0x14963aa] thread_native_entry(Thread*)+0xfa
20-11-2017