JDK-8313796 : AsyncGetCallTrace crash on unreadable interpreter method pointer
  • Type: Bug
  • Component: hotspot
  • Sub-Component: svc
  • Affected Version: 11,17,21,22
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux
  • CPU: x86
  • Submitted: 2023-08-04
  • Updated: 2023-08-25
  • Resolved: 2023-08-09
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 17 JDK 21 JDK 22
11.0.21Fixed 17.0.9Fixed 21.0.1Fixed 22 b10Fixed
Description
```
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f83be32e9c3, pid=100, tid=926134
#
# JRE version: OpenJDK Runtime Environment Corretto-11.0.19.7.1 (11.0.19+7) (build 11.0.19+7-LTS)
# Java VM: OpenJDK 64-Bit Server VM Corretto-11.0.19.7.1 (11.0.19+7-LTS, mixed mode, tiered, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x7a19c3]  frame::is_interpreted_frame_valid(JavaThread*) const+0x43
#
# Core dump will be written. Default location: //core.100
#
# If you would like to submit a bug report, please visit:
#   https://github.com/corretto/corretto-11/issues/
#
...
Current thread (0x00007f81700aa000):  JavaThread "redacted" daemon [_thread_in_vm, id=926134, stack(0x00007f7f9b9fe000,0x00007f7f9baff000)]

Stack: [0x00007f7f9b9fe000,0x00007f7f9baff000],  sp=0x00007f7f9baf8b00,  free space=1002k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x7a19c3]  frame::is_interpreted_frame_valid(JavaThread*) const+0x43
V  [libjvm.so+0x286f47]  forte_fill_call_trace_given_top(JavaThread*, ASGCT_CallTrace*, int, frame) [clone .isra.20]+0x1d3
V  [libjvm.so+0x79daf8]  AsyncGetCallTrace+0x188
C  [libjavaProfiler12753845288268514789.so+0x33c1b]  Profiler::getJavaTraceAsync(void*, ASGCT_CallFrame*, int, StackContext*, bool*)+0x12b
C  [libjavaProfiler12753845288268514789.so+0x34cf0]  Profiler::recordSample(void*, unsigned long long, int, int, Event*)+0x250
C  [libjavaProfiler12753845288268514789.so+0x3944c]  PerfEvents::signalHandler(int, siginfo_t*, void*)+0x13c
C  [libpthread.so.0+0x118e0]


siginfo: si_signo: 11 (SIGSEGV), si_code: 128 (SI_KERNEL), si_addr: 0x0000000000000000
```

```
00000000007a1980 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread>:
  7a1980:	48 8b 47 20          	mov    0x20(%rdi),%rax
  7a1984:	48 85 c0             	test   %rax,%rax
  7a1987:	74 1f                	je     7a19a8 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x28>
  7a1989:	a8 07                	test   $0x7,%al
  7a198b:	75 1b                	jne    7a19a8 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x28>
  7a198d:	48 8b 17             	mov    (%rdi),%rdx
  7a1990:	48 85 d2             	test   %rdx,%rdx
  7a1993:	74 13                	je     7a19a8 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x28>
  7a1995:	f6 c2 07             	test   $0x7,%dl
  7a1998:	75 0e                	jne    7a19a8 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x28>
  7a199a:	48 8d 48 b8          	lea    -0x48(%rax),%rcx
  7a199e:	48 39 ca             	cmp    %rcx,%rdx
  7a19a1:	77 05                	ja     7a19a8 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x28>
  7a19a3:	48 39 c2             	cmp    %rax,%rdx
  7a19a6:	72 08                	jb     7a19b0 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x30>
  7a19a8:	31 c0                	xor    %eax,%eax
  7a19aa:	c3                   	retq   
  7a19ab:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  7a19b0:	55                   	push   %rbp
  7a19b1:	48 89 e5             	mov    %rsp,%rbp
  7a19b4:	41 55                	push   %r13
  7a19b6:	41 54                	push   %r12
  7a19b8:	53                   	push   %rbx
  7a19b9:	48 89 fb             	mov    %rdi,%rbx
  7a19bc:	49 89 f4             	mov    %rsi,%r12
  7a19bf:	48 83 ec 08          	sub    $0x8,%rsp
  7a19c3:	4c 8b 68 e8          	mov    -0x18(%rax),%r13 <-- +0x43
  7a19c7:	4c 89 ef             	mov    %r13,%rdi
  7a19ca:	e8 91 00 45 00       	callq  bf1a60 <_ZN6Method15is_valid_methodEPKS_>
  7a19cf:	84 c0                	test   %al,%al
  7a19d1:	74 21                	je     7a19f4 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x74>
  7a19d3:	49 8b 55 08          	mov    0x8(%r13),%rdx
  7a19d7:	48 8b 43 20          	mov    0x20(%rbx),%rax
  7a19db:	48 2b 43 28          	sub    0x28(%rbx),%rax
  7a19df:	0f b7 52 30          	movzwl 0x30(%rdx),%edx
  7a19e3:	48 c1 f8 03          	sar    $0x3,%rax
  7a19e7:	48 8d 14 d5 08 04 00 	lea    0x408(,%rdx,8),%rdx
  7a19ee:	00 
  7a19ef:	48 39 d0             	cmp    %rdx,%rax
  7a19f2:	7e 0d                	jle    7a1a01 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x81>
  7a19f4:	31 c0                	xor    %eax,%eax
  7a19f6:	48 83 c4 08          	add    $0x8,%rsp
  7a19fa:	5b                   	pop    %rbx
  7a19fb:	41 5c                	pop    %r12
  7a19fd:	41 5d                	pop    %r13
  7a19ff:	5d                   	pop    %rbp
  7a1a00:	c3                   	retq   
  7a1a01:	48 89 df             	mov    %rbx,%rdi
  7a1a04:	e8 d7 ce ff ff       	callq  79e8e0 <_ZNK5frame21interpreter_frame_bcpEv>
  7a1a09:	4c 89 ef             	mov    %r13,%rdi
  7a1a0c:	48 89 c6             	mov    %rax,%rsi
  7a1a0f:	e8 cc 9c 44 00       	callq  beb6e0 <_ZNK6Method21validate_bci_from_bcpEPh>
  7a1a14:	85 c0                	test   %eax,%eax
  7a1a16:	78 dc                	js     7a19f4 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x74>
  7a1a18:	48 8b 43 20          	mov    0x20(%rbx),%rax
  7a1a1c:	48 8b 78 d0          	mov    -0x30(%rax),%rdi
  7a1a20:	e8 cb df c9 ff       	callq  43f9f0 <_ZN12MetaspaceObj8is_validEPKS_>
  7a1a25:	84 c0                	test   %al,%al
  7a1a27:	74 cb                	je     7a19f4 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x74>
  7a1a29:	48 8b 53 20          	mov    0x20(%rbx),%rdx
  7a1a2d:	48 8b 4a c8          	mov    -0x38(%rdx),%rcx
  7a1a31:	49 3b 8c 24 90 02 00 	cmp    0x290(%r12),%rcx
  7a1a38:	00 
  7a1a39:	0f 97 c0             	seta   %al
  7a1a3c:	48 39 d1             	cmp    %rdx,%rcx
  7a1a3f:	0f 92 c2             	setb   %dl
  7a1a42:	09 d0                	or     %edx,%eax
  7a1a44:	83 f0 01             	xor    $0x1,%eax
  7a1a47:	eb ad                	jmp    7a19f6 <_ZNK5frame26is_interpreted_frame_validEP10JavaThread+0x76>
  7a1a49:	90                   	nop
  7a1a4a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
```

This appears to indicate that the `Method**` returned by `interpreter_frame_method_addr()` is null:

```cpp
  // do some validation of frame elements
  // first the method

  Method* m = *interpreter_frame_method_addr();
```
Comments
A pull request was submitted for review. URL: https://git.openjdk.org/jdk21u/pull/94 Date: 2023-08-23 19:27:53 +0000
23-08-2023

Fix request (21u): Fixes a sigseg, backport is clean and passes jtreg tier 1
23-08-2023

Fix request (11u): Fixes a sigseg. Backport is not clean but the changes are trivial and passes jtreg tier 1-4 tests.
16-08-2023

A pull request was submitted for review. URL: https://git.openjdk.org/jdk11u-dev/pull/2079 Date: 2023-08-15 21:49:14 +0000
15-08-2023

A pull request was submitted for review. URL: https://git.openjdk.org/jdk17u-dev/pull/1665 Date: 2023-08-15 21:49:16 +0000
15-08-2023

Fix request (17u): Fixes a sigseg, backport is clean and passes jtreg tier 1-4 tests.
15-08-2023

Changeset: 0e2c72d7 Author: Richard Startin <richard.startin@datadoghq.com> Committer: Thomas Stuefe <stuefe@openjdk.org> Date: 2023-08-09 11:23:32 +0000 URL: https://git.openjdk.org/jdk/commit/0e2c72d7a5206b7173af5bf69e21d21ea276bd94
09-08-2023

A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/15193 Date: 2023-08-08 15:02:59 +0000
08-08-2023

Moving from core-svc -> hotspot/svc since that is where AsyncGetCallTrace bugs live.
07-08-2023

A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/15178 Date: 2023-08-07 13:37:33 +0000
07-08-2023