[1.8.0_60-ea-b18 & 1.9.0-ea-b67] Array accesses using sun.misc.Unsafe cause data corruption or SIGSEGV

[Rory O'Donnell]

Hi Mehmet,

Could you please log a bug at bugs.java.com, and let us know what issue ID
you receive.

Rgds,Rory

On 10/06/2015 13:28, Mehmet Dogan wrote:
> Hi all,
>
> While we were testing an internal project at Hazelcast using 
> 1.8.0_60-ea-b18 & 1.9.0-ea-b67, we encountered a previously 
> reported sun.misc.Unsafe issue.
>
> https://bugs.openjdk.java.net/browse/JDK-8076445
> http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2015-April/017685.html
>
> Issue status says it's resolved with resolution "Cannot Reproduce".  
> But unfortunately it's still reproducible using "1.8.0_60-ea-b18" and 
> "1.9.0-ea-b67".
>
> Test is very simple:
>
> ```
> public static void main(String[] args) throws Exception {
>         Unsafe unsafe = findUnsafe();
>         // 10000 pass
>         // 100000 jvm crash
>         // 1000000 fail
>         int count = 100000;
>         long size = count * 8L;
>         long baseAddress = unsafe.allocateMemory(size);
>
>         try {
>             for (int i = 0; i < count; i++) {
>                 long address = baseAddress + (i * 8L);
>
>                 long expected = i;
>                 unsafe.putLong(address, expected);
>
>                 long actual = unsafe.getLong(address);
>
>                 if (expected != actual) {
>                     throw new AssertionError("Expected: " + expected + 
> ", Actual: " + actual);
>                 }
>             }
>         } finally {
>             unsafe.freeMemory(baseAddress);
>         }
>     }
> ```
> It's not failing up to version 1.8.0.31, by starting 1.8.0.40 test is 
> failing constantly.
>
> - With iteration count 10000, test is passing.
> - With iteration count 100000, jvm is crashing with SIGSEGV.
> - With iteration count 1000000, test is failing with AssertionError.
>
> When one of compilation (-Xint) or inlining (-XX:-Inline) or 
> on-stack-replacement (-XX:-UseOnStackReplacement) is disabled, test is 
> not failing at all.
>
> Also, when address calculation in the loop is converted to
>
> long address = baseAddress + (i * 8)
>
> test passes. Only difference is, next address is calculated using 
> integer 8 instead of long 8.
>
> ```
> for (int i = 0; i < count; i++) {
>   long address = baseAddress + (i * 8); // <--- here, integer 8 
> instead of long 8
>
>   long expected = i;
>   unsafe.putLong(address, expected);
>
>   long actual = unsafe.getLong(address);
>
>   if (expected != actual) {
>       throw new AssertionError("Expected: " + expected + ", Actual: " 
> + actual);
>   }
> }
> ```
>
> I tested on versions:
> - 1.8.0.40
> - 1.8.0.45
> - 1.8.0_60-ea-b18
> - 1.9.0-ea-b67
>
> Previous issue comment 
> (https://bugs.openjdk.java.net/browse/JDK-8076445?focusedCommentId=13633043#comment-13633043) 
> says "Cannot reproduce based on the latest version". I hope that 
> latest version is not mentioning to '1.8.0_60-ea-b18' or 
> '1.9.0-ea-b67'. Because both are failing.
> PS: Cross posted this on 'hotspot-compiler-dev' group but still 
> haven't got a response yet. 
> http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2015-June/018191.html
>
> Thanks,
> Mehmet Dogan
> -- 
>
> @mmdogan
>

-- 
Rgds,Rory O'Donnell
Quality Engineering Manager
Oracle EMEA, Dublin,Ireland

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openjdk.java.net/pipermail/quality-discuss/attachments/20150610/4811be42/attachment.html>