SEGV in regression test java/lang/Character/Supplementary.java on Solaris 8

Courtesy of Fui-Shien Choong:
Here's why I think its 5106020.

/net/cores.central/cores/65247016/app2
current thread: t@177
...
 [5] libjvm.so:VMError::report_and_die(0x0, 0xfef48658, 0xfef4234c, 0x1, 0xfedc8058, 0xfef4234c), at 0xfee38168
 [6] libjvm.so:report_fatal(0xfeebcac5, 0x51b, 0xfeebcb03, 0x0, 0x0, 0xf908c5f4), at 0xfec09abc
=>[7] libjvm.so:nmethod::continuation_for_implicit_exception(0xf908be48, 0xf908bfc0, 0x60, 0xf908bf60, 0xf908bf60, 0x118), at 0xfeb08c00
 [8] libjvm.so:SharedRuntime::continuation_for_implicit_exception(0x35dcb8, 0x0, 0xfeecedec, 0xf908bfc0, 0x7800, 0x7400), at 0xfeae4680
 [9] libjvm.so:JVM_handle_solaris_signal(0xb, 0x87c7e2f8, 0x87c7e040, 0x1, 0x7c00, 0x35dcb8), at 0xfea63b3c
 [10] libc.so.1:__sighndlr(0xb, 0x87c7e2f8, 0x87c7e040, 0xfea634bc, 0x0, 0x1), at 0xff33fec8
 ---- called from signal handler with signal 11 (SIGSEGV) ------
...
(dbx) frame 8
0xfeae4680: continuation_for_implicit_exception+0x036c: call continuation_for_implicit_exception ! 0xfeb08ba8
(dbx) dis 0xfeae4660, 0xfeae4684
...
0xfeae467c: continuation_for_implicit_exception+0x0368: restore %g0, %l7, %o0
0xfeae4680: continuation_for_implicit_exception+0x036c: call continuation_for_implicit_exception ! 0xfeb08ba8
0xfeae4684: continuation_for_implicit_exception+0x0370: mov %i3, %o1

nmethod and pc.
(dbx) x $l7
0xf908be48: 0xfef40898 (dbx) x $i3
0xf908bfc0: 0xea046108

1287 address nmethod::continuation_for_implicit_exception(address pc) {
1288 // Exception happened outside inline-cache check code => we are inside
1289 // an active nmethod => use cpc to determine a return address
1290 int exception_offset = pc - instructions_begin();
1291 int cont_offset = ImplicitExceptionTable(this).at( exception_offset );

092 address header_begin() const { return (address) this; }
096 address instructions_begin() const { return (address) header_begin() + _instructions_offset; }

Using SA instead of manual counting...
hsdb> inspect 0xf908be48
Type is nmethod (size of 176)
const char* CodeBlob::_name: "nmethod"
int CodeBlob::_size: 2040
int CodeBlob::_header_size: 176
int CodeBlob::_relocation_size: 84
int CodeBlob::_instructions_offset: 280

dbx) print -fx 0xf908be48 + 280
0xf908be48U+280 = 0xf908bf60

(dbx) print 0xf908bfc0 - 0xf908bf60
0xf908bfc0U-0xf908bf60U = 96U
This is exception_offset.

185 ImplicitExceptionTable::ImplicitExceptionTable(const nmethod* nm) {
186 _data = (implicit_null_entry*)nm->nul_chk_table_begin();
187 _size = len();
188 }

266 address nul_chk_table_begin() const { return header_begin() + _nul_chk_table_offset ; }
hsdb> inspect 0xf908be48
....
int nmethod::_nul_chk_table_offset: 1964
....

(dbx) print -fx 0xf908be48 + 1964
0xf908be48U+1964 = 0xf908c5f4
_data is 0xf908c5f4

122 uint len() const { return _data[0]; }

107 class ImplicitExceptionTable VALUE_OBJ_CLASS_SPEC {
108 uint _size;
109 implicit_null_entry *_data;
110 implicit_null_entry *adr( uint idx ) const { return &_data[2*idx+1]; }
111 ReallocMark _nesting; // assertion check for reallocations

170 uint ImplicitExceptionTable::at( uint exec_off ) const {
171 uint l = len();
172 for( uint i=0; i<l; i++ )
173 if( *adr(i) == exec_off )
174 return *(adr(i)+1);
175 return 0; // Failed to find any execption offset
176 }

(dbx) x 0xf908c5f4
0xf908c5f4: 0x00000000
_size is zero. So JVM returns 0.

Check again.
(dbx) down
0xfeb08c00: continuation_for_implicit_exception+0x0058: call report_fatal ! 0xfec09a98
(dbx) dis 0xfeb08c00-0x58, 0xfeb08c04
...
0xfeb08bdc: continuation_for_implicit_exception+0x0034: add %fp, -12, %o0
0xfeb08be0: continuation_for_implicit_exception+0x0038: call at ! 0xfeb0b59c
0xfeb08be4: continuation_for_implicit_exception+0x003c: mov %i2, %o1
...

fp - 12 should be ImplicitExceptionTable
$i2 is offset

(dbx) x $fp - 12/4X
0x87c7dd6c: 0x00000000 0xf908c5f4 0x00000000 0x00000001
                _size *_data

(dbx) print -fx $i2
$i2 = 0x60

Searching in sunsolve turns up some bugs. 6191226 -> 6178131 -> 5106020. 5107326 -> 5106020. So I think 5106020 is a good match although this is C2. The bug should have been under runtime?


(Deleted data about other failure.)