RFR: 8256732: Zero: broken +ZeroTLAB exposes badly initialized memory [v4]
Aleksey Shipilev
shade at openjdk.java.net
Fri Mar 5 16:04:52 UTC 2021
> Looks like memory is badly initialized when `-XX:+ZeroTLAB` is specified.
>
> Manifests like this:
>
> $ CONF=linux-x86_64-zero-fastdebug make exploded-test TEST=compiler/memoryinitialization/ZeroTLABTest.java
>
> command: main -Xcomp -XX:+UseTLAB -XX:+ZeroTLAB compiler.memoryinitialization.ZeroTLABTest
> reason: User specified action: run main/othervm -Xcomp -XX:+UseTLAB -XX:+ZeroTLAB compiler.memoryinitialization.ZeroTLABTest
> Mode: othervm [/othervm specified]
> elapsed time (seconds): 0.098
> configuration:
> STDOUT:
> Error occurred during initialization of VM
> java.lang.NullPointerException
> at java.lang.System.getProperty(java.base/System.java:836)
>
> The cause is simple: Zero calls `ThreadLocalAllocBuffer::allocate`:
>
> if (UseTLAB) {
> result = (oop) THREAD->tlab().allocate(obj_size);
> }
>
> ...which actually does mangle the object space in debug builds:
>
> inline HeapWord* ThreadLocalAllocBuffer::allocate(size_t size) {
> invariants();
> HeapWord* obj = top();
> if (pointer_delta(end(), obj) >= size) {
> // successful thread-local allocation
> #ifdef ASSERT
> // Skip mangling the space corresponding to the object header to
> // ensure that the returned space is not considered parsable by
> // any concurrent GC thread.
> size_t hdr_size = oopDesc::header_size();
> Copy::fill_to_words(obj + hdr_size, size - hdr_size, badHeapWordVal);
> #endif // ASSERT
> // This addition is safe because we know that top is
> // at least size below end, so the add can't wrap.
> set_top(obj + size);
>
> invariants();
> return obj;
> }
> return NULL;
> }
>
> So if we do `+ZeroTLAB` in debug builds, Zero skips initializing the object body, and gets scrambled memory for newly allocated object. Then everything breaks.
Aleksey Shipilev has updated the pull request with a new target base due to a merge or a rebase. The pull request now contains six commits:
- Refactor TLAB allocation code a bit
- Adjust for the fact ThreadLocalAllocBuffer can mangle object space
- Merge branch 'master' into JDK-8256732-zero-zerotlab-broken
- Merge branch 'master' into JDK-8256732-zero-zerotlab-broken
- Maintain the body/header initialization order
- 8256732: Zero: broken +ZeroTLAB exposes badly initialized memory
-------------
Changes: https://git.openjdk.java.net/jdk/pull/1343/files
Webrev: https://webrevs.openjdk.java.net/?repo=jdk&pr=1343&range=03
Stats: 31 lines in 1 file changed: 12 ins; 5 del; 14 mod
Patch: https://git.openjdk.java.net/jdk/pull/1343.diff
Fetch: git fetch https://git.openjdk.java.net/jdk pull/1343/head:pull/1343
PR: https://git.openjdk.java.net/jdk/pull/1343
More information about the hotspot-runtime-dev
mailing list