SIGSEGV in C2 compiler

[Denis Lila]

Hello.

I was working on the pisces rendering engine using eclipse and I
encountered a segfault. I was using the pisces/Test.java file
to test various parts of the rendering engine without having to rebuild
openjdk. In it, I create a Frame whose paint method creates a Path2D,
a Stroker and a Dasher. Then the path is fed to the Dasher (but it is not
drawn because this is unnecessary to make it crash), and eventually
Stroker.somethingTo is called, which is where the crash occurred. However,
it only happened when I accidentally left uncommented the rest of
main, which creates other Stroker and Dasher objects and feeds lots of
curves to them and measures how long this processing takes. Even then,
it only happens if one grabs the window and moves it on and off screen,
causing the paint method to be called. I tried putting a repaint() call
at the end of paint() so that I wouldn't have to do any manual work,
but that didn't work. It is reproducible using an awt.Robot, but not
as frequently as manually.

When I remove the Frame creation and leave just the performance measuring
part of main(), it doesn't crash. It also doesn't crash when I remove
the performance measuring part of main() and leave just the graphical
part of the program. I tried reproducing it using a debug build of hotspot,
but I couldn't. This all suggests that it's a concurrency issue, so I
wrote a new main that simply created a few threads where each thread
created Dasher and Stroker objects and fed curves to them, but this didn't
crash.


Another important thing is that I was only able to reproduce it when the
files in pisces.tar.gz were compiled using ecj - not javac.

I've seen over 30 hs_err_pis*.log files produced by this crash and every one
of them says:
C2:  [2|3]%     pisces.Stroker.somethingTo(I)V @ 710 (1190 bytes)

where line 710 corresponds to line 830 in Stroker.java, which is a call to
it.next() where "it" is an anonymous Iterator<float[]> object.

I did not submit a bug report at sun.bugs.com because I couldn't find a way
to attach the 4 files.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pisces.tar.gz
Type: application/x-compressed-tar
Size: 22223 bytes
Desc: not available
Url : http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/attachments/20101122/5aa97226/attachment-0003.bin 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hotspot.log
Type: text/x-log
Size: 5433 bytes
Desc: not available
Url : http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/attachments/20101122/5aa97226/attachment-0004.bin 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hs_err_pid12042.log
Type: text/x-log
Size: 21803 bytes
Desc: not available
Url : http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/attachments/20101122/5aa97226/attachment-0005.bin 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: gdbDump.txt
Url: http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/attachments/20101122/5aa97226/attachment-0001.txt