Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-7154963

crash in JvmtiEnvBase::get_current_contended_monitor()

    XMLWordPrintable

    Details

    • Subcomponent:
    • CPU:
      x86
    • OS:
      linux

      Description

      Ashok reported the following crash in JVM/TI GetCurrentContendedMonitor():

      Hi Daniel,

       

      I am working on a JVM crash in our environment in a JVMTI call.

      I have looked at the problem and analyzed the core dump, I don’t see a possibility of the JVMD agent causing this crash. I am suspecting a bug in JVM code.

       

      Can you please have a look at this crash and let us know your view on it or can you suggest others from the JVM team who could have a look at it ( I could raise a bug for this).

       

      The details of the crash and the related files and its location are in the attached file. I have attached the hs_err file for reference.

       

      Thanks and Regards,

      Ashok
      Here's the HSX-19 version of the code that is crashing. I don't have
      a copy of HSX-19.1 at my fingertips...

      src/share/vm/prims/jvmtiEnvBase.cpp:

         642 jvmtiError
         643 JvmtiEnvBase::get_current_contended_monitor(JavaThread *calling_thread,
      JavaThread *java_thread, jobject *monitor_ptr) {
         644 #ifdef ASSERT
         645 uint32_t debug_bits = 0;
         646 #endif
         647 assert((SafepointSynchronize::is_at_safepoint() ||
         648 is_thread_fully_suspended(java_thread, false, &debug_bits)),
         649 "at safepoint or target thread is suspended");
         650 oop obj = NULL;
         651 ObjectMonitor *mon = java_thread->current_waiting_monitor();
         652 if (mon == NULL) {
         653 // thread is not doing an Object.wait() call
         654 mon = java_thread->current_pending_monitor();
         655 if (mon != NULL) {
         656 // The thread is trying to enter() or raw_enter() an ObjectMonitor
      .
         657 obj = (oop)mon->object();
         658 // If obj == NULL, then ObjectMonitor is raw which doesn't count
         659 // as contended for this API
         660 }
         661 // implied else: no contended ObjectMonitor
         662 } else {
         663 // thread is doing an Object.wait() call
         664 obj = (oop)mon->object();
         665 assert(obj != NULL, "Object.wait() should have an object");
         666 }
         667
         668 if (obj == NULL) {
         669 *monitor_ptr = NULL;
         670 } else {
         671 HandleMark hm;
         672 Handle hobj(obj);
         673 *monitor_ptr = jni_reference(calling_thread, hobj);
         674 }
         675 return JVMTI_ERROR_NONE;
         676 }

      The above function matches the current HSX-24-B04 source.


      Based a quick look at the disassembly that Ashok provided
      (I stripped off some of the name mangling stuff for clarity):

      (gdb) disass 0x00002af8d716b911
      Dump of assembler code for function JvmtiEnvBase29get_current_contended_monitor:
      0x00002af8d716b8e0 <JvmtiEnvBase29get_current_contended_monitor+0>: push %rbp
      0x00002af8d716b8e1 <JvmtiEnvBase29get_current_contended_monitor+1>: mov %rsp,%rbp
      0x00002af8d716b8e4 <JvmtiEnvBase29get_current_contended_monitor+4>: sub $0x60,%rsp
      0x00002af8d716b8e8 <JvmtiEnvBase29get_current_contended_monitor+8>: mov 0xc8(%rdx),%rax
      0x00002af8d716b8ef <JvmtiEnvBase29get_current_contended_monitor+15>: mov %r13,-0x18(%rbp)
      0x00002af8d716b8f3 <JvmtiEnvBase29get_current_contended_monitor+19>: mov %r14,-0x10(%rbp)
      0x00002af8d716b8f7 <JvmtiEnvBase29get_current_contended_monitor+23>: mov %r15,-0x8(%rbp)
      0x00002af8d716b8fb <JvmtiEnvBase29get_current_contended_monitor+27>: xor %r13d,%r13d
      0x00002af8d716b8fe <JvmtiEnvBase29get_current_contended_monitor+30>: mov %rbx,-0x28(%rbp)
      0x00002af8d716b902 <JvmtiEnvBase29get_current_contended_monitor+34>: mov %r12,-0x20(%rbp)
      0x00002af8d716b906 <JvmtiEnvBase29get_current_contended_monitor+38>: test %rax,%rax
      0x00002af8d716b909 <JvmtiEnvBase29get_current_contended_monitor+41>: mov %rsi,%r15
      0x00002af8d716b90c <JvmtiEnvBase29get_current_contended_monitor+44>: mov %rcx,%r14
      0x00002af8d716b90f <JvmtiEnvBase29get_current_contended_monitor+47>: je 0x2af8d716b990 <JvmtiEnvBase29get_current_contended_monitor+176>
      0x00002af8d716b911 <JvmtiEnvBase29get_current_contended_monitor+49>: mov 0x8(%rax),%r13
      0x00002af8d716b915 <JvmtiEnvBase29get_current_contended_monitor+53>: test %r13,%r13
      0x00002af8d716b918 <JvmtiEnvBase29get_current_contended_monitor+56>: je 0x2af8d716b986 <JvmtiEnvBase29get_current_contended_monitor=+166>


      I think the crash is happening at line 664:

         662 } else {
         663 // thread is doing an Object.wait() call
         664 obj = (oop)mon->object();

      on the attempt to dereference 'mon' to get the associated object.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              dcubed Daniel Daugherty
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Imported:
                Indexed: