The following crash was see in our internal (code pipeline) testing in a branch where I had removed pacing (see JDK-8350050). Although the test runs with pacing disabled, it is possible that the removal of pacing code might have changed the corss-section of the root-cause event. I am going to commence testing in a loop with and withpout verification enabled to see if I can catch this. The removal of ShenandoahPacing code itself should have no material impact on the correctness of marking, modulo already latent race conditions etc.

#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007faa7caaef50, pid=2347, tid=2350
#
# JRE version: OpenJDK Runtime Environment (25.0) (build 25-root-ysrjdkpacing-x86.c8db17)
# Java VM: OpenJDK 64-Bit Server VM (25-root-ysrjdkpacing-x86.c8db17, mixed mode, sharing, compressed oops, compressed class ptrs, shenandoah gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xefbf50] void OopOopIterateDispatch<ShenandoahMarkRefsClosure<(ShenandoahGenerationType)2> >::Table::oop_oop_iterate<InstanceKlass, narrowOop>(ShenandoahMarkRefsClosure<(ShenandoahGenerationType)2>*, oopDesc*, Klass*)+0x60
#
# Core dump will be written. Default location: /codebuild/output/src1303/src/s3/00/results/core.2347.%i
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#

--------------- S U M M A R Y ------------

Command Line: -XX:ErrorFile=results/genshen/heapothesys/1/hs_err_pid%p.log -XX:-TieredCompilation -XX:+AlwaysPreTouch -Xms10g -Xmx10g -XX:+UseShenandoahGC -XX:+UnlockDiagnosticVMOptions -XX:+UnlockExperimentalVMOptions -XX:-ShenandoahPacing -XX:-ShenandoahUncommit -XX:ShenandoahGCMode=generational -XX:+UnlockExperimentalVMOptions -XX:+UseCompactObjectHeaders -javaagent:/tmp/jHiccup.jar=-l,results/genshen/heapothesys/1/hyperalloc_a2048_o4096.jhiccup.log,-i,1000,-a -Xlog:async -Xlog:gc*=info,safepoint*=info,handshake*=info,gc+thread=debug:results/genshen/heapothesys/1/hyperalloc_a2048_o4096.jvm.log:utctime,uptime,tid,level,tags:filecount=0,filesize=0 /tmp/HyperAlloc-1.0.jar -d 180 -p 10 -r 50 -a 2048 -s 4096 -t 4 -b results/genshen/heapothesys/1/heapothesys_2048_4096.csv.allocation -l results/genshen/heapothesys/1/heapothesys_2048_4096.csv

Host: Intel(R) Xeon(R) Platinum 8275CL CPU @ 3.00GHz, 8 cores, 14G, Amazon Linux release 2 (Karoo)
Time: Sun Mar 23 06:12:34 2025 UTC elapsed time: 25.351513 seconds (0d 0h 0m 25s)

--------------- T H R E A D ---------------

Current thread (0x00007faa7412a410): WorkerThread "Shenandoah GC Threads#1" [id=2350, stack(0x00007faa65788000,0x00007faa65888000) (1024K)]

Stack: [0x00007faa65788000,0x00007faa65888000], sp=0x00007faa65886b80, free space=1018k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xefbf50] void OopOopIterateDispatch<ShenandoahMarkRefsClosure<(ShenandoahGenerationType)2> >::Table::oop_oop_iterate<InstanceKlass, narrowOop>(ShenandoahMarkRefsClosure<(ShenandoahGenerationType)2>*, oopDesc*, Klass*)+0x60 (oop.inline.hpp:236)
V [libjvm.so+0xeed728] ShenandoahMark::mark_loop(unsigned int, TaskTerminator*, ShenandoahReferenceProcessor*, ShenandoahGenerationType, bool, StringDedupMode, StringDedup::Requests*)+0x2918 (iterator.inline.hpp:300)
V [libjvm.so+0xe9774a] ShenandoahConcurrentMarkingTask<(ShenandoahGenerationType)2>::work(unsigned int)+0xda (shenandoahConcurrentMark.cpp:71)
V [libjvm.so+0x11277a0] WorkerThread::run()+0x80 (workerThread.cpp:69)
V [libjvm.so+0x10624e8] Thread::call_run()+0xa8 (thread.cpp:231)
V [libjvm.so+0xd8ec4b] thread_native_entry(Thread*)+0xdb (os_linux.cpp:877)

siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x00007fadae07e220

Registers:
RAX=0x00007fb191c0ef20, RBX=0x00007fa9ce000000, RCX=0x0000000000007faa, RDX=0x000000007c7721a0
RSP=0x00007faa65886b80, RBP=0x00007faa65886bc0, RSI=0x0000000000000003, RDI=0x00007faa7c0324b0
R8 =0x00007faa7c0324d8, R9 =0x0000000000000000, R10=0x00007faa7410b7c0, R11=0x0000001000000000
R12=0x00007fadae07e220, R13=0x00000006a513eb88, R14=0x00007faa65886cb0, R15=0x00007faa7410b7c0
RIP=0x00007faa7caaef50, EFLAGS=0x0000000000010206, CSGSFS=0x002b000000000033, ERR=0x0000000000000004
  TRAPNO=0x000000000000000e