Evacuation failure handling when deferred RS update is disabled can fail to evacuate some objects.

The problem is that during evacuation failure handling we may need to update the remembered set of currently evacuated regions, while remembered set scan is iterating over them.

The iterator in conjunction with the way we distribute work across threads does not support modification of the remembered set while iterating over it, leading to cards not being iterated over.

These referenced objects are later nuked while fixing up the self-forwarding pointers.

The remembered sets are okay though.

Easily reproducable at least on a machine with many threads by running GCBasher and induced evacuation failure, e.g.

java -Xint -XX:-G1DeferredRSUpdate -XX:+G1EvacuationFailureALot -XX:+UnlockDiagnosticVMOptions -XX:-VerifyDuringGC -XX:+VerifyBeforeGC -XX:+VerifyAfterGC -Xmx128M -XX:+UseG1GC -XX:+PrintGCDetails -XX:G1LogLevel=finest -XX:InitiatingHeapOccupancyPercent=0 -XX:+ShowMessageBoxOnError -jar GCBasher.jar -
time:30000

Verification finds the error though, example:

# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/g1CollectedHeap.cpp:3479
==============================================================================
Unexpected Error
------------------------------------------------------------------------------
Internal Error at g1CollectedHeap.cpp:3479, pid=12133, tid=140222187861760
guarantee(!failures) failed: there should not have been any failures

Do you want to debug the problem?

To debug, run 'gdb /proc/12133/exe 12133'; then switch to thread 140222187861760 (0x00007f8805b27700)
Enter 'yes' to launch gdb automatically (PATH must include gdb)
Otherwise, press RETURN to abort...
==============================================================================



#28: [GC pause (G1 Evacuation Pause) (mixed) VerifyBeforeGC:[Verifying threads heap Roots HeapRegionSets HeapRegions RemSet syms strs zone dict cldg metaspace chunks hand C-heap code cache ]
 VerifyAfterGC:[Verifying threads heap Roots HeapRegionSets HeapRegions
----------
Field 0x00000000fc50041c of live obj 0x00000000fc500410 in region [0x00000000fc500000, 0x00000000fc600000)
Dependency
 - klass: 'Dependency'
 - ---- fields (total size 3 words):
 - 'methodName' 'Ljava/lang/String;' @12 [I (fd7016a8 fd7016e8)
 - 'methodDescriptor' 'Ljava/lang/String;' @16 [I (fd7016e8 fd701740)
 - 'target' 'Ljava/lang/String;' @20 [I (fd701740 5)
points to dead obj 0x00000000fd7016a8 in region [0x00000000fd700000, 0x00000000fd800000)
[I
 - klass: {type array int}
 - length: 2
 - 0: 0xdeafbabe -558908738
 - 1: 0xdeafbabe -558908738
----------
[...]

P4 until further evaluation since this occurs only in debug mode where -XX:-G1DeferredRSUpdate can be set.