Bug ID: JDK-8359870 JVM crashes in AccessInternal::PostRuntimeDispatch

JDK-8359870 : JVM crashes in AccessInternal::PostRuntimeDispatch

Type: Bug
Component: hotspot
Sub-Component: svc
Affected Version: 25

Priority: P2
Status: Resolved
Resolution: Fixed

Submitted: 2025-06-18
Updated: 2025-07-17
Resolved: 2025-07-01

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 25	JDK 26
25Fixed	26 b05Fixed

Related Reports

Duplicate :	JDK-8360663 - assert(Universe::is_in_heap(result)) failed: object not in heap 0x0000000000000f50
Relates :	JDK-8361912 - ThreadsListHandle::cv_internal_thread_to_JavaThread does not deal with a virtual thread's carrier thread

Description

com/sun/management/HotSpotDiagnosticMXBean/DumpThreadsWithEliminatedLock.java crashed with

#  SIGSEGV (0xb) at pc=0x00007ffadc251b10, pid=2085770, tid=2085797
#
# JRE version: Java(TM) SE Runtime Environment (25.0+26) (build 25-ea+26-LTS-3358)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25-ea+26-LTS-3358, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x47bb10]  AccessInternal::PostRuntimeDispatch<G1BarrierSet::AccessBarrier<286822ul, G1BarrierSet>, (AccessInternal::BarrierType)3, 286822ul>::oop_access_barrier(
oopDesc*, long)+0x0
#

Stack: [0x00007ffad82e5000,0x00007ffad83e5000],  sp=0x00007ffad83e13a8,  free space=1008k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x47bb10]  AccessInternal::PostRuntimeDispatch<G1BarrierSet::AccessBarrier<286822ul, G1BarrierSet>, (AccessInternal::BarrierType)3, 286822ul>::oop_access_barrier(oopDesc*, long)+0x0  (accessBackend.hpp:228)
V  [libjvm.so+0x10e1c1a]  vframeStream::vframeStream(oopDesc*, Handle)+0x7a  (vframe.cpp:523)
V  [libjvm.so+0x1068a51]  GetThreadSnapshotClosure::do_thread(Thread*)+0x7d1  (threadService.cpp:1319)
V  [libjvm.so+0x106691d]  ThreadSnapshotFactory::get_thread_snapshot(_jobject*, JavaThread*)+0x80d  (threadService.cpp:1482)
V  [libjvm.so+0xae23d5]  JVM_CreateThreadSnapshot+0x75  (jvm.cpp:2966)
j  jdk.internal.vm.ThreadSnapshot.create(Ljava/lang/Thread;)Ljdk/internal/vm/ThreadSnapshot;+0 java.base@25-ea
j  jdk.internal.vm.ThreadSnapshot.of(Ljava/lang/Thread;)Ljdk/internal/vm/ThreadSnapshot;+1 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThread(Ljava/lang/Thread;Ljdk/internal/vm/ThreadDumper$TextWriter;)V+1 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.lambda$dumpThreads$0(Ljdk/internal/vm/ThreadDumper$TextWriter;Ljava/lang/Thread;)V+2 java.base@25-ea
j  jdk.internal.vm.ThreadDumper$$Lambda+0x0000000086026408.accept(Ljava/lang/Object;)V+8 java.base@25-ea
j  java.util.stream.StreamSpliterators$WrappingSpliterator$$Lambda+0x0000000086026848.accept(Ljava/lang/Object;)V+5 java.base@25-ea
j  java.util.stream.ReferencePipeline$2$1.accept(Ljava/lang/Object;)V+18 java.base@25-ea
j  java.util.Spliterators$ArraySpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+53 java.base@25-ea
j  java.util.stream.AbstractPipeline.copyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)V+32 java.base@25-ea
j  java.util.stream.AbstractPipeline.wrapAndCopyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Ljava/util/stream/Sink;+13 java.base@25-ea
j  java.util.stream.StreamSpliterators$WrappingSpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+42 java.base@25-ea
j  java.util.stream.Streams$ConcatSpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+12 java.base@25-ea
j  java.util.stream.ReferencePipeline$Head.forEach(Ljava/util/function/Consumer;)V+12 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThreads(Ljdk/internal/vm/ThreadContainer;Ljdk/internal/vm/ThreadDumper$TextWriter;)V+10 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThreads(Ljdk/internal/vm/ThreadDumper$TextWriter;)V+32 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThreads(Ljava/io/OutputStream;)V+10 java.base@25-ea
j  com.sun.management.internal.HotSpotDiagnostic.dumpThreads(Ljava/io/OutputStream;Lcom/sun/management/HotSpotDiagnosticMXBean$ThreadDumpFormat;)V+37 jdk.management@25-ea
j  com.sun.management.internal.HotSpotDiagnostic.dumpThreads(Ljava/lang/String;Lcom/sun/management/HotSpotDiagnosticMXBean$ThreadDumpFormat;)V+48 jdk.management@25-ea
j  DumpThreadsWithEliminatedLock.testPlainFormat()V+39
j  DumpThreadsWithEliminatedLock.main([Ljava/lang/String;)V+289
j  java.lang.invoke.LambdaForm$DMH+0x0000000086042000.invokeStatic(Ljava/lang/Object;Ljava/lang/Object;)V+10 java.base@25-ea
j  java.lang.invoke.LambdaForm$MH+0x0000000086043c00.invoke(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+33 java.base@25-ea
j  java.lang.invoke.Invokers$Holder.invokeExact_MT(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+20 java.base@25-ea
j  jdk.internal.reflect.DirectMethodHandleAccessor.invokeImpl(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+55 java.base@25-ea
j  jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+23 java.base@25-ea
j  java.lang.reflect.Method.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+102 java.base@25-ea
j  com.sun.javatest.regtest.agent.MainWrapper$MainTask.run()V+134
j  java.lang.Thread.runWith(Ljava/lang/Object;Ljava/lang/Runnable;)V+5 java.base@25-ea
j  java.lang.Thread.run()V+19 java.base@25-ea
v  ~StubRoutines::call_stub 0x00007ffac3c9ffa6
V  [libjvm.so+0x9effe0]  JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*)+0x2b0  (javaCalls.cpp:415)
V  [libjvm.so+0x9f191f]  JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, JavaThread*)+0x1df  (javaCalls.cpp:323)
V  [libjvm.so+0xae008c]  thread_entry(JavaThread*, JavaThread*)+0x8c  (jvm.cpp:2748)
V  [libjvm.so+0xa08df8]  JavaThread::thread_main_inner() [clone .part.0]+0xb8  (javaThread.cpp:772)
V  [libjvm.so+0x105ba9f]  Thread::call_run()+0x9f  (thread.cpp:243)
V  [libjvm.so+0xe44ec6]  thread_native_entry(Thread*)+0xd6  (os_linux.cpp:868)
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  jdk.internal.vm.ThreadSnapshot.create(Ljava/lang/Thread;)Ljdk/internal/vm/ThreadSnapshot;+0 java.base@25-ea
j  jdk.internal.vm.ThreadSnapshot.of(Ljava/lang/Thread;)Ljdk/internal/vm/ThreadSnapshot;+1 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThread(Ljava/lang/Thread;Ljdk/internal/vm/ThreadDumper$TextWriter;)V+1 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.lambda$dumpThreads$0(Ljdk/internal/vm/ThreadDumper$TextWriter;Ljava/lang/Thread;)V+2 java.base@25-ea
j  jdk.internal.vm.ThreadDumper$$Lambda+0x0000000086026408.accept(Ljava/lang/Object;)V+8 java.base@25-ea
j  java.util.stream.StreamSpliterators$WrappingSpliterator$$Lambda+0x0000000086026848.accept(Ljava/lang/Object;)V+5 java.base@25-ea
j  java.util.stream.ReferencePipeline$2$1.accept(Ljava/lang/Object;)V+18 java.base@25-ea
j  java.util.Spliterators$ArraySpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+53 java.base@25-ea
j  java.util.stream.AbstractPipeline.copyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)V+32 java.base@25-ea
j  java.util.stream.AbstractPipeline.wrapAndCopyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Ljava/util/stream/Sink;+13 java.base@25-ea
j  java.util.stream.StreamSpliterators$WrappingSpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+42 java.base@25-ea
j  java.util.stream.Streams$ConcatSpliterator.forEachRemaining(Ljava/util/function/Consumer;)V+12 java.base@25-ea
j  java.util.stream.ReferencePipeline$Head.forEach(Ljava/util/function/Consumer;)V+12 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThreads(Ljdk/internal/vm/ThreadContainer;Ljdk/internal/vm/ThreadDumper$TextWriter;)V+10 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThreads(Ljdk/internal/vm/ThreadDumper$TextWriter;)V+32 java.base@25-ea
j  jdk.internal.vm.ThreadDumper.dumpThreads(Ljava/io/OutputStream;)V+10 java.base@25-ea
j  com.sun.management.internal.HotSpotDiagnostic.dumpThreads(Ljava/io/OutputStream;Lcom/sun/management/HotSpotDiagnosticMXBean$ThreadDumpFormat;)V+37 jdk.management@25-ea
j  com.sun.management.internal.HotSpotDiagnostic.dumpThreads(Ljava/lang/String;Lcom/sun/management/HotSpotDiagnosticMXBean$ThreadDumpFormat;)V+48 jdk.management@25-ea
j  DumpThreadsWithEliminatedLock.testPlainFormat()V+39
j  DumpThreadsWithEliminatedLock.main([Ljava/lang/String;)V+289
j  java.lang.invoke.LambdaForm$DMH+0x0000000086042000.invokeStatic(Ljava/lang/Object;Ljava/lang/Object;)V+10 java.base@25-ea
j  java.lang.invoke.LambdaForm$MH+0x0000000086043c00.invoke(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+33 java.base@25-ea
j  java.lang.invoke.Invokers$Holder.invokeExact_MT(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+20 java.base@25-ea
j  jdk.internal.reflect.DirectMethodHandleAccessor.invokeImpl(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+55 java.base@25-ea
j  jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+23 java.base@25-ea
j  java.lang.reflect.Method.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+102 java.base@25-ea
j  com.sun.javatest.regtest.agent.MainWrapper$MainTask.run()V+134
j  java.lang.Thread.runWith(Ljava/lang/Object;Ljava/lang/Runnable;)V+5 java.base@25-ea
j  java.lang.Thread.run()V+19 java.base@25-ea
v  ~StubRoutines::call_stub 0x00007ffac3c9ffa6

siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x0000000000000020

as part of jdk25 ATR testing.

The crash is observed on both linux-x64 and macosx-x64 platforms with product builds.

Comments

A pull request was submitted for review. Branch: jdk25 URL: https://git.openjdk.org/jdk/pull/26088 Date: 2025-07-02 08:42:22 +0000
02-07-2025
Changeset: 13a39278 Branch: master Author: Kevin Walls <kevinw@openjdk.org> Date: 2025-07-01 19:07:49 +0000 URL: https://git.openjdk.org/jdk/commit/13a3927855da61fe27f3b43e5e4755d0c5ac5a16
01-07-2025
I believe the crashes are caused by JavaThread == null is considered as "unmounted virtual thread" in GetThreadSnapshotClosure::do_thread and the code tries to get j.l.VirtualThread properties passing j.l.Thread object (and get some bad values) So we get issues with java_lang_VirtualThread::continuation(_thread_h()) - it reads VirtualThread.cont, but the _thread_h is j.l.Thread In Graal failure java_lang_VirtualThread::state(_thread_h()) returns some bad value (VirtualThread.state) and map_state_to_thread_status asserts about the value.
27-06-2025
There should already be guards for terminating, or terminated, threads. UPDATE: As per the PR and thanks to [~dcubed] for noticing, the ThreadsListHandle in the code is not being used correctly to obtain a JavaThread that can't terminate.
26-06-2025
A pull request was submitted for review. Branch: master URL: https://git.openjdk.org/jdk/pull/25958 Date: 2025-06-24 17:00:19 +0000
25-06-2025
Can reproduce crashes that relate to having a short-lived Thread which has terminated, getting inspected. Looking at where to guard against this.
24-06-2025
Just to note that the test runs 4 times. The crashes seems to be the "plain platform" runs, this is plain text format and platform threads (not virtual threads).
24-06-2025
There is also a clue in the related Graal failure: # # A fatal error has been detected by the Java Runtime Environment: # # Internal Error (javaClasses.cpp:2205), pid=70147, tid=32771 # Error: ShouldNotReachHere() V [libjvm.dylib+0x4da064] java_lang_VirtualThread::current_pending_monitor(oopDesc)+0x0 V [libjvm.dylib+0xa0bea8] GetThreadSnapshotClosure::do_thread(Thread)+0xa4 V [libjvm.dylib+0xa0b974] ThreadSnapshotFactory::get_thread_snapshot(_jobject, JavaThread)+0x2c0 V [libjvm.dylib+0x5ae57c] JVM_CreateThreadSnapshot+0xa0 So we are crashing in the same code in both cases and with a virtual thread in both cases. In this issue we hit a bad oop walking the vframes for the thread. In the Graal issue the thread itself seems in an invalid state as we hit the code: default: ShouldNotReachHere(); in java_lang_VirtualThread::map_state_to_thread_status(int state) Moving this to serviceability.
18-06-2025