segmentation fault in the jvm

[Stefanie Tellex]

Hi,

Not sure if this is the right place to report this, but I have a Java 
program that reliably seg faults the JVM when run under GDB.   It 
doesn't seem to happen (quickly) when I run it without gdb.  It also 
doesn't seem to happen if I turn off the JIT, although the original seg 
fault that triggered this (part of a much larger program) would still 
happen with the JIT turned off, although it took longer.

The program is attached, and the command I am running is this:

gdb --args $JAVA_HOME/jre/bin/java -classpath . Test

The java program loops forever.  It gets through about 10 iterations and 
then seg faults with this backtrace:

(gdb) bt
#0  0xb4192300 in ?? ()
Cannot access memory at address 0x234


I also wrote a simple JNI program (attached in the tar.gz) that creates 
the JVM and calls Test programmatically.  When I run it, it seg faults 
after about 10 iterations, (sometimes more, sometimes fewer, every once 
in a while it will run for quite a long time).
(gdb) bt
#0  0x41171329 in ?? ()
#1  0x4107f3bd in ?? ()
#2  0x40400dc3 in JavaCalls::call_helper(JavaValue*, methodHandle*, 
JavaCallArguments*, Thread*) ()
     from 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//jre/lib/i386/client/libjvm.so
#3  0x405f2569 in os::os_exception_wrapper(void (*)(JavaValue*, 
methodHandle*, JavaCallArguments*, Thread*), JavaValue*, methodHandle*, 
JavaCallArguments*, Thread*) () from 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//jre/lib/i386/client/libjvm.so
#4  0x403fe907 in JavaCalls::call(JavaValue*, methodHandle, 
JavaCallArguments*, Thread*) ()
     from 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//jre/lib/i386/client/libjvm.so
#5  0x40420a73 in jni_invoke_nonstatic(JNIEnv_*, JavaValue*, _jobject*, 
JNICallType, _jmethodID*, JNI_ArgumentPusher*, Thread*) ()
     from 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//jre/lib/i386/client/libjvm.so
#6  0x4044b2bb in jni_NewObjectV () from 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//jre/lib/i386/client/libjvm.so
#7  0x40471542 in checked_jni_NewObjectV () from 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//jre/lib/i386/client/libjvm.so
#8  0x08048a71 in JNIEnv_::NewObject (this=0x806353c, clazz=0x806475c, 
methodID=0x80eb088)
      at /home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug//include/jni.h:872
#9  0x080488ab in jvm_test () at c/create_jvm.cxx:63
#10 0x08048a16 in main () at c/create_jvm.cxx:116


I ran the same program in valgrind and I get lots of errors about 
call_helper doing invalid writes:

==24756==
==24756== Invalid write of size 4
==24756==    at 0x5494416: ???
==24756==    by 0x548C0F6: ???
==24756==    by 0x548BD04: ???
==24756==    by 0x548BE29: ???
==24756==    by 0x54893BC: ???
==24756==    by 0x440ADC2: JavaCalls::call_helper(JavaValue*, 
methodHandle*, JavaCallArguments*, Thread*) (in 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug/jre/lib/i386/client/libjvm.so)
==24756==    by 0x45FC568: os::os_exception_wrapper(void (*)(JavaValue*, 
methodHandle*, JavaCallArguments*, Thread*), JavaValue*, methodHandle*, 
JavaCallArguments*, Thread*) (in 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug/jre/lib/i386/client/libjvm.so)
==24756==    by 0x4408906: JavaCalls::call(JavaValue*, methodHandle, 
JavaCallArguments*, Thread*) (in 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug/jre/lib/i386/client/libjvm.so)
==24756==    by 0x44B0A0F: JVM_DoPrivileged (in 
/home/stefie10/Downloads/jdk7/jdk1.7.0/fastdebug/jre/lib/i386/client/libjvm.so)
==24756==    by 0x540E07A: 
Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2 
(AccessController.c:67)
==24756==    by 0x549571A: ???
==24756==    by 0x548BE29: ???
==24756==  Address 0xbe951754 is not stack'd, malloc'd or (recently) free'd


I've reproduced this against 1.7 as well as 1.6 and 1.5.

There are some bugs that seem to refer to this problem, although they 
don't seem to be fixed or to have reproduction instructions.
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7016961
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7016303
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7017562

Any hints would be appreciated.

Stefanie