The LeakProfiler component of JFR uses the lower 32 bits of the markWord of the leak object sample candidates (for event jdk.OldObjectSample) to implement the <sample oop, Edge*> function during the PathsToGcRoots VM_Operation. Technically, the idx used for looking up a side-table (a GrowableArray) is stored into the markWord by shifting up: idx << markWord::lock_bits.

Packing more features into the markWord, such as Valhalla’s field layout encodings, and the reduction of markWord bits by Lilliput, has rendered this mapping unmaintainable. The manifest problems are usually hard to debug because of crashes, where it is not apparent what has gone wrong. The result is that new features usually turn off the LeakProfiler component to make progress.

Although the function is only used during a safepoint, and only when paths-to-gc-roots=true, with fewer bits free for use in the markWord, even with the original markWord saved to be restored on completion, it is time to move this function out of the markWord.

The most straightforward way is to provide yet another HashTable to implement this mapping.

There are several ProblemLists excluding JFR OldObjectSample testing in the respective feature branches. I will not update them as part of this change; instead, I will leave it to the branch developers to determine if this fix is sufficient for their respective issues.