Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8229694

JVM crash in SWPointer during C2 OSR compilation

    Details

      Description

      (synopsis is provisional, please change as you see fit)

      Found with fuzzing. Testing bundle is attached, has a few hs_errs and replays inside. Crashes intermittently, roughly in half of invocations, so this is the reproducer:

      $ for I in `seq 1 10`; do ~/trunks/jdk-jdk/build/linux-x86_64-server-fastdebug/images/jdk/bin/java Test; done

      release build crashes like this:

      # A fatal error has been detected by the Java Runtime Environment:
      #
      # SIGSEGV (0xb) at pc=0x00007f9cc1057e89, pid=22579, tid=22594
      #
      # JRE version: OpenJDK Runtime Environment (14.0) (build 14-internal+0-adhoc.shade.jdk-jdk)
      # Java VM: OpenJDK 64-Bit Server VM (14-internal+0-adhoc.shade.jdk-jdk, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0xf03e89] SWPointer::SWPointer(MemNode*, SuperWord*, Node_Stack*, bool) [clone .constprop.199]+0x49
      #
      # Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P" (or dumping to /home/shade/trunks/JavaFuzzer/tests/0002/core.22579)
      #
      # If you would like to submit a bug report, please visit:
      # http://bugreport.java.com/bugreport/crash.jsp
      #

      --------------- S U M M A R Y ------------

      Command Line: Test

      Host: Intel(R) Core(TM) i7-7820X CPU @ 3.60GHz, 16 cores, 125G, Ubuntu 18.04.3 LTS
      Time: Wed Aug 14 10:18:52 2019 CEST elapsed time: 0 seconds (0d 0h 0m 0s)

      --------------- T H R E A D ---------------

      Current thread (0x00007f9cb8486800): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=22594, stack(0x00007f9c5847d000,0x00007f9c5857e000)]


      Current CompileTask:
      C2: 215 64 % 4 Test::vMeth1 @ 112 (293 bytes)

      Stack: [0x00007f9c5847d000,0x00007f9c5857e000], sp=0x00007f9c58578a20, free space=1006k
      Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
      V [libjvm.so+0xf03e89] SWPointer::SWPointer(MemNode*, SuperWord*, Node_Stack*, bool) [clone .constprop.199]+0x49
      V [libjvm.so+0xf04531] SuperWord::align_initial_loop_index(MemNode*)+0xa1
      V [libjvm.so+0xf0a4b7] SuperWord::output()+0xa07
      V [libjvm.so+0xf0e720] SuperWord::SLP_extract()+0x70
      V [libjvm.so+0xf0ed5c] SuperWord::transform_loop(IdealLoopTree*, bool)+0x26c

      fastdebug build crashes like this:

      # SIGSEGV (0xb) at pc=0x00007f6fa6f8c52c, pid=21280, tid=21291
      #
      # JRE version: OpenJDK Runtime Environment (14.0) (fastdebug build 14-internal+0-adhoc.shade.jdk-jdk)
      # Java VM: OpenJDK 64-Bit Server VM (fastdebug 14-internal+0-adhoc.shade.jdk-jdk, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0x177f52c] Node::in(unsigned int) const [clone .isra.38] [clone .constprop.281]+0xc
      #
      # Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P" (or dumping to /home/shade/trunks/JavaFuzzer/tests/0002/core.21280)
      #
      # If you would like to submit a bug report, please visit:
      # http://bugreport.java.com/bugreport/crash.jsp
      #

      --------------- S U M M A R Y ------------

      Command Line: Test

      Host: shade-desktop, Intel(R) Core(TM) i7-7820X CPU @ 3.60GHz, 16 cores, 125G, Ubuntu 18.04.3 LTS
      Time: Wed Aug 14 09:59:46 2019 CEST elapsed time: 0 seconds (0d 0h 0m 0s)

      --------------- T H R E A D ---------------

      Current thread (0x00007f6fa0596000): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=21291, stack(0x00007f6f3056a000,0x00007f6f3066b000)]


      Current CompileTask:
      C2: 269 75 % 4 Test::vMeth1 @ 112 (293 bytes)

      Stack: [0x00007f6f3056a000,0x00007f6f3066b000], sp=0x00007f6f30665040, free space=1004k
      Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
      V [libjvm.so+0x177f52c] Node::in(unsigned int) const [clone .isra.38] [clone .constprop.281]+0xc
      V [libjvm.so+0x1788bcf] SWPointer::SWPointer(MemNode*, SuperWord*, Node_Stack*, bool) [clone .constprop.277]+0x6f
      V [libjvm.so+0x17897d9] SuperWord::align_initial_loop_index(MemNode*)+0x279
      V [libjvm.so+0x179539d] SuperWord::output()+0xe2d
      V [libjvm.so+0x1799418] SuperWord::SLP_extract()+0x278
      V [libjvm.so+0x1799a9b] SuperWord::transform_loop(IdealLoopTree*, bool)+0x41b
      V [libjvm.so+0x1208506] PhaseIdealLoop::build_and_optimize(LoopOptsMode)+0x1146

        Attachments

        1. 0002.tar.gz
          374 kB
        2. hs_err_pid6311.log
          76 kB
        3. Test.java
          7 kB

          Issue Links

            Activity

              People

              • Assignee:
                vdeshpande Vivek Deshpande
                Reporter:
                shade Aleksey Shipilev
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated: