Details
-
Bug
-
Resolution: Fixed
-
P3
-
17, 21
-
b01
-
aarch64
-
os_x
Backports
Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-8328032 | 21.0.4-oracle | Tobias Hartmann | P3 | Resolved | Fixed | b01 |
JDK-8328031 | 17.0.12-oracle | Tobias Hartmann | P3 | Resolved | Fixed | b01 |
JDK-8327777 | 17.0.12 | Richard Reingruber | P3 | Resolved | Fixed | b01 |
JDK-8328252 | 17.0.11 | Goetz Lindenmaier | P3 | Resolved | Fixed | b07 |
Description
It is an invariant on Mac OS AARCH64 that a thread must have WXWrite before doing the transition into the vm [1].
In Unsafe_CopySwapMemory0 we don't switch to WXWrite. Because of this we can get at SIGBUS if a handshake is pending where we modify a nmethod in MarkActivationClosure::do_code_blob
Stack: [0x0000000171f24000,0x0000000172127000], sp=0x0000000172124cd0, free space=2051k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.dylib+0xfc6c60] MarkActivationClosure::do_code_blob(CodeBlob*)+0x74
V [libjvm.dylib+0x1022a84] JavaThread::nmethods_do(CodeBlobClosure*)+0x114
V [libjvm.dylib+0x75c4f8] HandshakeOperation::do_handshake(JavaThread*)+0x70
V [libjvm.dylib+0x75e054] HandshakeState::process_by_self(bool)+0x3a8
V [libjvm.dylib+0xe0f130] SafepointMechanism::process(JavaThread*, bool)+0x5c
V [libjvm.dylib+0x535758] ThreadStateTransition::transition_from_native(JavaThread*, JavaThreadState)+0x1f8
V [libjvm.dylib+0x4334f0] ThreadInVMfromNative::ThreadInVMfromNative(JavaThread*)+0xb0
V [libjvm.dylib+0x106832c] Unsafe_CopySwapMemory0(JNIEnv_*, _jobject*, _jobject*, long, _jobject*, long, long, long)+0xdc
J 915 jdk.internal.misc.Unsafe.copySwapMemory0(Ljava/lang/Object;JLjava/lang/Object;JJJ)V java.base@17.0.11-internal (0 bytes) @ 0x0000000115f636dc [0x0000000115f63640+0x000000000000009c]
[...]
While we cannot get the very same crash in jdk21 (nmethod sweeper was removed in jdk20 with
Reproduce:
It's not easy to reproduce this directly but when running test/jdk/sun/nio/cs/FindDecoderBugs.java with -XX:+AssertWXAtThreadSync on Mac OS AARCH64 a corresponding assertion fails because of the issue.
Note that the issue is fixed with
JDK 11 is not affected because there's no backport of
[1] https://github.com/openjdk/jdk/blob/0583f7357480c0500daa82f490b2fcc05f2fb65a/src/hotspot/share/runtime/interfaceSupport.inline.hpp#L253-L259
Attachments
Issue Links
- backported by
-
JDK-8327777 [macosx-aarch64] SIGBUS in MarkActivationClosure::do_code_blob reached from Unsafe_CopySwapMemory0
- Resolved
-
JDK-8328031 [macosx-aarch64] SIGBUS in MarkActivationClosure::do_code_blob reached from Unsafe_CopySwapMemory0
- Resolved
-
JDK-8328032 [macosx-aarch64] SIGBUS in MarkActivationClosure::do_code_blob reached from Unsafe_CopySwapMemory0
- Resolved
-
JDK-8328252 [macosx-aarch64] SIGBUS in MarkActivationClosure::do_code_blob reached from Unsafe_CopySwapMemory0
- Resolved
- relates to
-
JDK-8266889 [macosx-aarch64] Crash with SIGBUS in MarkActivationClosure::do_code_blob during vmTestbase/nsk/jvmti/.../bi04t002 test run
- Resolved
-
JDK-8302736 Major performance regression in Math.log on aarch64
- Resolved
-
JDK-8327990 [macosx-aarch64] Various tests fail with -XX:+AssertWXAtThreadSync
- Resolved
-
JDK-8330171 Lazy W^X switch implementation
- Closed
- links to
-
Commit openjdk/jdk17u-dev/f38add6f
-
Commit openjdk/jdk17u/e100cf5d
-
Commit openjdk/jdk21u-dev/ad1d3248
-
Review openjdk/jdk17u-dev/2269
-
Review openjdk/jdk17u/391
-
Review openjdk/jdk21u-dev/305