Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8253756

C2 CompilerThread0 crash in Node::add_req(Node*)

    XMLWordPrintable

    Details

    • Subcomponent:
    • Resolved In Build:
      b20
    • CPU:
      x86_64
    • OS:
      generic
    • Verification:
      Verified

      Backports

        Description

        ADDITIONAL SYSTEM INFORMATION :
        MacBook Pro (Retina, 15-inch, Late 2013)
        macOS Catalina 10.15.6
        openjdk JDK 15 GA (but also 14 and 13 update versions)

        A DESCRIPTION OF THE PROBLEM :
        While running performance testing on the BouncyCastle implementation of Ed448 KeyPairGenerator, I noticed messages like this being written to the output (if sufficient iterations performed):
            Default case invoked for:
               opcode = 0, "Node"

        It's somewhat deterministic in that this would appear from 0 up to ~5 times. Note that this didn't initially crash the process or apparently lead to any error (unit tests continued passing). However I was a bit concerned so started to simplify the code and drill down to what code might be the problem. At a certain point I was able to generate a crash.

        At least superficially this appears very similar to, and may be a regression of, https://bugs.openjdk.java.net/browse/JDK-8208275 .

        ERROR MESSAGES/STACK TRACES THAT OCCUR :
        #
        # A fatal error has been detected by the Java Runtime Environment:
        #
        # SIGSEGV (0xb) at pc=0x0000000106006714, pid=16221, tid=23299
        #
        # JRE version: OpenJDK Runtime Environment (15.0+36) (build 15+36-1562)
        # Java VM: OpenJDK 64-Bit Server VM (15+36-1562, mixed mode, sharing, tiered, compressed oops, g1 gc, bsd-amd64)
        # Problematic frame:
        # V [libjvm.dylib+0x806714] Node::add_req(Node*)+0xb4
        #
        # No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
        #
        # An error report file with more information is saved as:
        # /Users/peter/Documents/Workspaces/BouncyCastle/bc-tests/hs_err_pid16221.log
        #
        # Compiler replay data is saved as:
        # /Users/peter/Documents/Workspaces/BouncyCastle/bc-tests/replay_pid16221.log
        #
        # If you would like to submit a bug report, please visit:
        # https://bugreport.java.com/bugreport/crash.jsp
        #

        (I have hs_err and replay files that I will attach).

        REGRESSION : Last worked in version 12

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        Simply use KeyPairGenerator "EdDSA" from BouncyCastle provider to generate thousands of keys and once the JIT kicks in you should see the "Default case invoked for" message appearing. There might be rare crashes here also, but for me I reached reliably-crashing code while stripping away layers and trying to isolate what code was causing the message.

        ACTUAL -
        Usually displays "Default case invoked for" message up to 5 times or so. May crash rarely but specific code tweaks can lead to (apparently) deterministic crashing.

        ---------- BEGIN SOURCE ----------
        This is simple code that will usually cause "Default case invoked for" message:

                KeyPairGenerator kpGen = KeyPairGenerator.getInstance("EdDSA", new BouncyCastleProvider());
                kpGen.initialize(NamedParameterSpec.ED448);

                for (int i = 0; i < 10000; ++i)
                {
                    kpGen.generateKeyPair();
                }

        The code used to get the crash is too complicated to attach here but I can try and put a reproduce together if the logs are not enough.
        ---------- END SOURCE ----------

        CUSTOMER SUBMITTED WORKAROUND :
        Bug (message or crash) appears to never happen if either -XX:-TieredCompilation or -XX:LoopStripMiningIter=0 are used.
         

        FREQUENCY : often


          Attachments

            Issue Links

              Activity

                People

                Assignee:
                roland Roland Westrelin
                Reporter:
                webbuggrp Webbug Group
                Votes:
                0 Vote for this issue
                Watchers:
                9 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved: