JDK-8274340 : [BACKOUT] JDK-8271880: Tighten condition for excluding regions from collecting cards with cross-references
  • Type: Bug
  • Component: hotspot
  • Sub-Component: gc
  • Affected Version: 18
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: linux
  • CPU: x86_64
  • Submitted: 2021-09-27
  • Updated: 2022-02-10
  • Resolved: 2021-09-29
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 18
18 b17Fixed
Related Reports
Duplicate :  
JDK-8274343 - Kitchensink8H.java fails with SIGSEGV in MemAccessWorkerThread
Duplicate :  
JDK-8274787 - Kitchensink24HStress.java failed with EXCEPTION_ACCESS_VIOLATION in oopDesc::size_given_klass
Duplicate :  
JDK-8274452 - G1: Only evac-failed objects must be in the collection set here
Relates :  
JDK-8274344 - Kitchensink24HStress.java failed with 'Analyzer failed with: java.lang.NullPointerException: Cannot assign field "next" because "this.prev" is null'
Relates :  
JDK-8274343 - Kitchensink8H.java fails with SIGSEGV in MemAccessWorkerThread
Relates :  
JDK-8274452 - G1: Only evac-failed objects must be in the collection set here
Relates :  
JDK-8274516 - [REDO] JDK-8271880: Tighten condition for excluding regions from collecting cards with cross-references
Relates :  
JDK-8271880 - Tighten condition for excluding regions from collecting cards with cross-references
Description
The following test failed in the JDK18 CI:

applications/kitchensink/Kitchensink24HStress.java

Here's a snippet from the log file:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007ff209bdaeec, pid=21948, tid=22024
#
# JRE version: Java(TM) SE Runtime Environment (18.0+17) (build 18-ea+17-965)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (18-ea+17-965, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x6e5eec]  G1RegionMarkStatsCache::add_live_words(oopDesc*)+0x15c
#
# Core dump will be written. Default location: Core dumps may be processed with "/opt/core.sh %p" (or dumping to /opt/mach5/mesos/work_dir/slaves/ff806ead-2cac-495d-9cbc-62116f99bf14-S13996/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/23ea0fe5-ccc5-4438-bfdd-11ff21b35df5/runs/f8cd76ab-f465-4380-b5fa-5a79c42b8131/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_kitchensink_Kitchensink24HStress_java/scratch/0/core.21948)
#
# JFR recording file will be written. Location: /opt/mach5/mesos/work_dir/slaves/ff806ead-2cac-495d-9cbc-62116f99bf14-S13996/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/23ea0fe5-ccc5-4438-bfdd-11ff21b35df5/runs/f8cd76ab-f465-4380-b5fa-5a79c42b8131/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_kitchensink_Kitchensink24HStress_java/scratch/0/hs_err_pid21948.jfr
#
Unsupported internal testing APIs have been used.

# An error report file with more information is saved as:
# /opt/mach5/mesos/work_dir/slaves/ff806ead-2cac-495d-9cbc-62116f99bf14-S13996/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/23ea0fe5-ccc5-4438-bfdd-11ff21b35df5/runs/f8cd76ab-f465-4380-b5fa-5a79c42b8131/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_kitchensink_Kitchensink24HStress_java/scratch/0/hs_err_pid21948.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#
----------System.err:(944/81629)----------


Here's the crashing thread's stack:

---------------  T H R E A D  ---------------

Current thread (0x00007ff19c016ea0):  GCTaskThread "GC Thread#3" [stack: 0x00007ff10f4f4000,0x00007ff10f5f4000] [id=22024]

Stack: [0x00007ff10f4f4000,0x00007ff10f5f4000],  sp=0x00007ff10f5f2bd0,  free space=1018k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x6e5eec]  G1RegionMarkStatsCache::add_live_words(oopDesc*)+0x15c
V  [libjvm.so+0x6b24c8]  void OopOopIterateDispatch<G1MarkAndPushClosure>::Table::oop_oop_iterate<InstanceRefKlass, narrowOop>(G1MarkAndPushClosure*, oopDesc*, Klass*)+0xf18
V  [libjvm.so+0x6b9f6a]  G1FullGCMarker::complete_marking(GenericTaskQueueSet<OverflowTaskQueue<oopDesc*, (MEMFLAGS)5, 131072u>, (MEMFLAGS)5>*, GenericTaskQueueSet<OverflowTaskQueue<ObjArrayTask, (MEMFLAGS)5, 131072u>, (MEMFLAGS)5>*, TaskTerminator*)+0xaa
V  [libjvm.so+0x6b983e]  G1FullGCMarkTask::work(unsigned int)+0xde
V  [libjvm.so+0xdf2fbf]  GangWorker::loop()+0x5f
V  [libjvm.so+0xdf301f]
V  [libjvm.so+0xd456f0]  Thread::call_run()+0xc0
V  [libjvm.so+0xbab221]  thread_native_entry(Thread*)+0xe1


siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x0000000000000100
Comments
Changeset: 1dc8fa99 Author: Thomas Schatzl <tschatzl@openjdk.org> Date: 2021-09-29 13:59:58 +0000 URL: https://git.openjdk.java.net/jdk/commit/1dc8fa9902cf2cfa3556ccffb15244115f594966
29-09-2021
[171.616s][1632757560415ms][error][gc,verify ] GC(129) Missing rem set entry: [171.616s][1632757560415ms][error][gc,verify ] GC(129) Field 0x00000007fb1008f0 of obj 0x00000007fb1008d8 in region 1485:(O)[0x00000007fb000000,0x00000007fc00000 [171.616s][1632757560415ms][error][gc,verify ] GC(129) NULL card setjava.lang.invoke.MethodType$ConcurrentWeakInternSet$WeakEntry [171.616s][1632757560415ms][error][gc,verify ] GC(129) {0x00000007fb1008d8} - klass: 'java/lang/invoke/MethodType$ConcurrentWeakInternSet$WeakEntry' [171.616s][1632757560415ms][error][gc,verify ] GC(129) - ---- fields (total size 4 words): [171.616s][1632757560415ms][error][gc,verify ] GC(129) - private 'referent' 'Ljava/lang/Object;' @12 NULL (0) [171.616s][1632757560416ms][error][gc,verify ] GC(129) - volatile 'queue' 'Ljava/lang/ref/ReferenceQueue;' @16 a 'java/lang/ref/ReferenceQueue'{0x0000000541336 [171.616s][1632757560416ms][error][gc,verify ] GC(129) - volatile 'next' 'Ljava/lang/ref/Reference;' @20 NULL (0) [171.616s][1632757560416ms][error][gc,verify ] GC(129) - private transient 'discovered' 'Ljava/lang/ref/Reference;' @24 a 'java/lang/invoke/MethodType$Concurre [171.616s][1632757560416ms][error][gc,verify ] GC(129) - public final 'hashcode' 'I' @28 1920153987 (72733983) [171.616s][1632757560416ms][error][gc,verify ] GC(129) points to obj 0x00000004d9abd4c8 in region 683:(S)[0x00000004d9000000,0x00000004da000000,0x00000004da00000 [171.616s][1632757560416ms][error][gc,verify ] GC(129) java.lang.invoke.MethodType$ConcurrentWeakInternSet$WeakEntry [171.616s][1632757560416ms][error][gc,verify ] GC(129) {0x00000004d9abd4c8} - klass: 'java/lang/invoke/MethodType$ConcurrentWeakInternSet$WeakEntry' Kitchensink runs crash within a few minutes with -XX:+UnlockDiagnosticVMOptions -XX:+VerifyAfterGC -XX:VerifyGCType=young-evac-fail
28-09-2021
Reproduces with Kitchensink. Testing revert of JDK-8271880 which is likely the issue.
28-09-2021
The crash itself looks a bit like ones fixed with JDK-8271880, and the build contains that fix. A closed test case used for verifying JDK-8271880 however does not reproduce any issue after a few 1000 runs. There does not seem to be anything interesting in the hs_err except that we are failing iterating an InstanceRefKlass (hence the connection to JDK-8271880). Further connection is that this crash is a full gc after evacuation failure. There are other crashes in Kitchensink with that build, JDK-8274343 and JDK-8274344 which may be related (but no idea either way). Need to try to reproduce with kitchensink.
27-09-2021