Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8253745

[lworld] C1: Flat inline type array store may write out of bounds

XMLWordPrintable

    • x86
    • linux

      The issue exists for a long time and still exists on jdk-16-valhalla+1-102.

      How to reproduce:
      - build benchmarks.jar from open jdk.
      - java --enable-preview -jar target/benchmarks.jar org.openjdk.bench.valhalla.array.fill.Inline64byte.Val_to_Val_as_Val_fillinst -p size=100

      # A fatal error has been detected by the Java Runtime Environment:
      #
      # SIGSEGV (0xb) at pc=0x00007ff306bc7697, pid=12860, tid=12884
      #
      # JRE version: Java(TM) SE Runtime Environment (16.0+1) (build 16-valhalla+1-102)
      # Java VM: Java HotSpot(TM) 64-Bit Server VM (16-valhalla+1-102, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0x6ba697][thread 12885 also had an error]
        G1ParScanThreadState::copy_to_survivor_space(G1HeapRegionAttr, oopDesc*, markWord)+0x627
      #
      # Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P %E" (or dumping to /home/skuksenk/wrk/valhalla-weekly/core.12860)
      #
      # An error report file with more information is saved as:
      # /home/skuksenk/wrk/valhalla-weekly/hs_err_pid12860.log
      [thread 12886 also had an error]
      [thread 12862 also had an error]
      Compiled method (c1) 491 524 3 org.openjdk.bench.valhalla.array.fill.Inline64byte::Val_to_Val_as_Val_fillinst (30 bytes)
       total in heap [0x00007ff2e9196190,0x00007ff2e9196810] = 1664
       relocation [0x00007ff2e9196300,0x00007ff2e9196348] = 72
       main code [0x00007ff2e9196360,0x00007ff2e91966c0] = 864
       stub code [0x00007ff2e91966c0,0x00007ff2e91966f0] = 48
       oops [0x00007ff2e91966f0,0x00007ff2e91966f8] = 8
       metadata [0x00007ff2e91966f8,0x00007ff2e9196700] = 8
       scopes data [0x00007ff2e9196700,0x00007ff2e9196758] = 88
       scopes pcs [0x00007ff2e9196758,0x00007ff2e91967e8] = 144
       dependencies [0x00007ff2e91967e8,0x00007ff2e91967f0] = 8
       nul chk table [0x00007ff2e91967f0,0x00007ff2e9196810] = 32
      Compiled method (c1) 491 524 3 org.openjdk.bench.valhalla.array.fill.Inline64byte::Val_to_Val_as_Val_fillinst (30 bytes)
       total in heap [0x00007ff2e9196190,0x00007ff2e9196810] = 1664
       relocation [0x00007ff2e9196300,0x00007ff2e9196348] = 72
       main code [0x00007ff2e9196360,0x00007ff2e91966c0] = 864
       stub code [0x00007ff2e91966c0,0x00007ff2e91966f0] = 48
       oops [0x00007ff2e91966f0,0x00007ff2e91966f8] = 8
       metadata [0x00007ff2e91966f8,0x00007ff2e9196700] = 8
       scopes data [0x00007ff2e9196700,0x00007ff2e9196758] = 88
       scopes pcs [0x00007ff2e9196758,0x00007ff2e91967e8] = 144
       dependencies [0x00007ff2e91967e8,0x00007ff2e91967f0] = 8
       nul chk table [0x00007ff2e91967f0,0x00007ff2e9196810] = 32
      #
      # If you would like to submit a bug report, please visit:
      # https://bugreport.java.com/bugreport/crash.jsp
      #
      <forked VM failed with exit code 134>
      <stdout last='20 lines'>
       metadata [0x00007ff2e91966f8,0x00007ff2e9196700] = 8
       scopes data [0x00007ff2e9196700,0x00007ff2e9196758] = 88
       scopes pcs [0x00007ff2e9196758,0x00007ff2e91967e8] = 144
       dependencies [0x00007ff2e91967e8,0x00007ff2e91967f0] = 8
       nul chk table [0x00007ff2e91967f0,0x00007ff2e9196810] = 32
      Compiled method (c1) 491 524 3 org.openjdk.bench.valhalla.array.fill.Inline64byte::Val_to_Val_as_Val_fillinst (30 bytes)
       total in heap [0x00007ff2e9196190,0x00007ff2e9196810] = 1664
       relocation [0x00007ff2e9196300,0x00007ff2e9196348] = 72
       main code [0x00007ff2e9196360,0x00007ff2e91966c0] = 864
       stub code [0x00007ff2e91966c0,0x00007ff2e91966f0] = 48
       oops [0x00007ff2e91966f0,0x00007ff2e91966f8] = 8
       metadata [0x00007ff2e91966f8,0x00007ff2e9196700] = 8
       scopes data [0x00007ff2e9196700,0x00007ff2e9196758] = 88
       scopes pcs [0x00007ff2e9196758,0x00007ff2e91967e8] = 144
       dependencies [0x00007ff2e91967e8,0x00007ff2e91967f0] = 8
       nul chk table [0x00007ff2e91967f0,0x00007ff2e9196810] = 32
      #
      # If you would like to submit a bug report, please visit:
      # https://bugreport.java.com/bugreport/crash.jsp
      #
      </stdout>
      <stderr last='20 lines'>
      </stderr>

      Note:
      The error doesn't happen with -Xint or -XX:-TieredCompilation.

            thartmann Tobias Hartmann
            skuksenko Sergey Kuksenko
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: