-
Notifications
You must be signed in to change notification settings - Fork 721
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
JDK11 Segmentation error vmState=0x00020019 #15474
Comments
I am going to triage the crash from GC point of view |
The reason for crash is heap memory corruption at
|
Is it possible heap corruption occur at out-of-bound initialization of large byte array? @0xdaryl FYI |
I can reproduce this easily with 0.33 but not with 0.32, so it could be a new problem. I'll take a closer look. |
I mentioned that I was unable to reproduce this problem with 0.32. That's because at some point Idiom Recognition was disabled outside of jitserver compilations. It was turned on again in 0.33, re-exposing what was likely an existing problem. |
I should have come back to summarize what Idiom Recognition is doing in this case. Running Test with this option
the loop in
That is, it begins the Looking at Idiom Recognition's pattern graph for
and the target graph (with some annotations)
and finally the T2P (with some annotations):
Ultimately, the JIT arrives at
As #423 begins the loop with the value 555550, I believe that |
In examining an array index for Idiom Recognition, analyzeOneArrayIndex checks whether the variable operand in a 'var + const' or 'const + var' expression is an induction variable. On the other hand, if the expression is a simple variable, the analysis assumes the variable reference is acceptable. However, it can happen that the variable used as the array index is not an induction variable which can result in an incorrect transformation. Fixed this by adding a check that an arrayindex that is a variable is also an induction variable. Fixes eclipse-openj9#15474 Signed-off-by: Henry Zongaro <zongaro@ca.ibm.com>
Reopening this temporarily, as I had hoped to include a fix for the 0.35 milestone build. |
In examining an array index for Idiom Recognition, analyzeOneArrayIndex checks whether the variable operand in a 'var + const' or 'const + var' expression is an induction variable. On the other hand, if the expression is a simple variable, the analysis assumes the variable reference is acceptable. However, it can happen that the variable used as the array index is not an induction variable which can result in an incorrect transformation. Fixed this by adding a check that an arrayindex that is a variable is also an induction variable. Fixes eclipse-openj9#15474 Signed-off-by: Henry Zongaro <zongaro@ca.ibm.com>
It's merged to 0.35 now. |
Java -version output
Summary of problem
The following
Test.java
, which is reduced by us, crashes OpenJ9's JIT compiler. Even through the stacktrace shows the crash happens inside libj9gc29.so; the bug disappears if you add-Xint
(and the last item of the stacktrace is also a call in the JIT compiler which calls into perhaps an uncommon NPE trap through a slowpath). So we reckon this to be a JIT bug.Diagnostic files
By issuing
the following crash log is given:
Please also check openj9-bug-87.tar.gz for all the logs (jitdump, snap, etc.), the test (Test.java, Test.class), and the unreduced test (Test.java.orig).
Notice
Test.java
(which is reduced by us) is always reproducible for us. If it is not reproducible for you, please useTest.java.orig
in the above link.0x000000000100000 [<unknown>+0x0]
The text was updated successfully, but these errors were encountered: