1.3c1: VM crashes when heap is exhausted

Name: dkC59003 Date: 05/19/99



The displayed below simple program tries to allocate all memory available
in heap, and crashes every of the latest versions of HotSpot for win32.

I have tried it on 350MHz Pentium-II with 128Mb of RAM working under
Windows NT 4.0 SP3 plus IE401 SP1. In particular, I have executed this
program against HotSpot Client VM (1.3beta, mixed mode, build d), and
after 173rd chunk just allocated I have obtained NT's

    "java.exe - Application Error"

window with the following message:

    The instruction at "0x0805a2ec" referenced memory
    at "0x00000008". The memory could not be "read".

When I looked at this break point at the MS DevStudio debugger window,
I saw the following code:

    0805A2E6 mov ecx, dword ptr [eax+4]
    0805A2E9 add ecx, 8
 ==>0805A2EC mov edx, dword ptr [ecx]

It looks like a try to operate on an object which was not allocated
(I guess, malloc() have returned NULL address [eax+4] for that object).

I have observed the same failure (affecting the same portion of x86 code)
for the following versions of HotSpot:

    hotspot1_0fcs_hp-e-bin-win-apr_17
    hotspot2_0ea1_hp-a-bin-win-may_04
    hotspot_client1_3beta1_compiler1-d-bin-win-may_18

This program also crashes classic JDK 1.2.2 for Solaris/Sparc both with JIT
and without JIT, but such result is unstable: classic VM may do not crash or
crashes occasionally with probability ~10%.

Following is the source of this testing program:

/* %W% %E%
 * Copyright %D% Sun Microsystems, Inc.
 * ---
 * @author Valerii Shakurov
 */
class dummy {
    byte[] arr;
    int sz;
    int num;
    dummy(int n,int size) {
         arr=new byte[size];
         sz=size;
    }
}

public class a {
   static boolean debug=true;
   static void Msg(int no,int sz,String res) {
       if (debug) {
           System.out.println("Chunk #"+no+",size "+sz+" : "+res);
       }
   }
   
   static public void main(String[] args) {
       dummy[] arr=new dummy[1024];
       int i=0;
       int j=1048576*2;

       while (j>1) {
           try {
               arr[i]=new dummy(i,j);
               Msg(i,j,"Allocated");
           } catch (OutOfMemoryError e) {
               Msg(i,j,"Out of memory");
               j=j/2;
           }
           i++;
       }

   }
}

======================================================================

Name: dkC59003 Date: 05/25/99



This problem also seems to affect the following HotSpot tests:
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a011
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a014
The path to the Novosibirsk testbase at Cupertino is:
    TESTBASE=/net/sqesvr/vsn/testbase/testbase_nsk

Each of these tests stresses out a huge bunch of JCK 1.2a API tests
by executing them concurrently in separate threads. Usually, there is
no enough memory to pass all of those threads, and some of the involved
API tests are omitted to let the whole stress test to pass. So, the
tests jck12a011, jck12a014 also usually exhaust heap, though in the
other way than the test program displayed above.

I executed these tests on the same PC (350MHz Pentium-II, 128Mb RAM,
Windows NT 4.0 SP3, IE 4.01 SP1) against HotSpot Client VM 1.3betaD
(mixed mode).

While executing "jck12a011", following message window has poped up:
    "java.exe - Application Error"
    The instruction at "0x08017ca4" referenced memory
    at "0x0096febc". The memory could not be "read".
MS DevStudio debugger has diaplayed the window:
    Unhandled exception in java.exe (JVM.DLL):
    0xC0000005: Access Violation
and in debug window I saw the following code:
    08017C98 mov ecx,dword ptr ds:[80D8118h]
    08017C9E shr eax,10h
    08017CA1 lea eax,dword ptr [eax+eax*2]
 ==>08017CA4 mov eax,dword ptr [ecx+eax*8+14h]

While executing "jck12a011" next time, similar message window
has poped up dislaying the problem at other but near location:
    "java.exe - Application Error"
    The instruction at "0x080285ea" referenced memory
    at "0x6ac30cad". The memory could not be "read".
MS DevStudio debugger has diaplayed the same window:
    Unhandled exception in java.exe (JVM.DLL):
    0xC0000005: Access Violation
and in debug window I saw the other code:
    080285DC mov eax,dword ptr [ebp+0Ch]
    080285DF mov esi,dword ptr [eax]
    080285E1 mov eax,dword ptr [esi+4]
    080285E4 lea ecx,dword ptr [eax+8]
    080285E7 mov eax,dword ptr [eax+8]
 ==>080285EA call dword ptr [eax+5Ch]

Finally, while executing "jck12a014", I have observed pop-up window:
    "java.exe - Application Error"
    The instruction at "0x080357be" referenced memory
    at "0x6ac30c75". The memory could not be "read".
MS DevStudio debugger has diaplayed the window:
    Unhandled exception in java.exe (JVM.DLL):
    0xC0000005: Access Violation
and in debug window I saw the following code:
    080357BB mov eax,dword ptr [esi]
    080357BD push edi
    080357BE call dword ptr [eax+24h]

So, these crashes look very similar to the crashes described above.

Release summary: 1.3betaD

======================================================================

Name: dkC59003 Date: 05/31/99



Below is some additional diagnostics for this bug (I guess, this is the same bug):

When executing the stress tests:
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a011
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a012
under HotSpot 1.3betaF, the VM crashed with the following diagnostics:
    #
    # HotSpot Virtual Machine Error, EXCEPTION_ACCESS_VIOLATION
    #
    # Error ID: 4F533F57494E13120E43505002AD
    #

And when executing the stress tests:
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a011
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a014
    ${TESTBASE}/nsk/src/stress/jck12a/jck12a015
under HotSpot 1.3betaG, the VM crashed with the following diagnostics:
    #
    # HotSpot Virtual Machine Error, Internal Error
    #
    # Error ID: 47454E45524154452F4F502D41500E435050083C
    #

======================================================================

Name: dkC59003 Date: 06/01/99



HotSpot 1.3betaG also fails due to this bug under the following tests:
    ${TESTBASE}/src/nsk/coverage/relocator/relocator003
    ${TESTBASE}/src/nsk/coverage/relocator/relocator006
    ${TESTBASE}/src/nsk/coverage/relocator/relocator007
    ${TESTBASE}/src/nsk/coverage/relocator/relocator009

While executing relocator003(6,7), Windows NT have thrown the
error-message window:
    java.exe - Application Error
    ----------------------------
    The instruction "0x08011f98" referenced memory at "0x0000000c".
    The memory could not be "read".
and debugger have shown the message:
    Unhandled exception in java.exe (JVM.DLL):
    0xC0000005: Access Violation
 
And while executing relocator009, Windows NT have thrown the
error-message window:
    java.exe - Application Error
    ----------------------------
    The instruction "0x7800f9c4" referenced memory at "0x00a6a000".
    The memory could not be "read".
and debugger have shown the message:
    Unhandled exception in java.exe (MSVCRT.DLL):
    0xC0000005: Access Violation

======================================================================

Name: dkC59003 Date: 07/27/99



Despite the bug is treated fixed and integrated in kestrel-beta,
the problem seems to remain unresolved.

When I executed hotspot tests "jck12a012", and "jck12a014"
under JDK 1.3L for win32, the virtual machine crashed with
diagnostics very similar to that described above:

    #
    # HotSpot Virtual Machine Error, EXCEPTION_ACCESS_VIOLATION
    #
    # Error ID: 4F533F57494E13120E43505002B0
    #

So, I believe that this bug should be reopen.


======================================================================