SEGV in EdgeUtils::field_name_symbol(Edge const&)

[Tony Printezis]

FWIW, this is the stack trace when the crash happens:

EdgeUtils::field_name_symbol(Edge const&)
ObjectSampleWriter::write(StoredEdge const*)
ObjectSampleWriter::operator()(StoredEdge&)
ObjectSampleCheckpoint::write(ObjectSampler*, EdgeStore*, bool, Thread*)
EventEmitter::write_events(ObjectSampler*, EdgeStore*, bool)
PathToGcRootsOperation::doit()
VM_Operation::evaluate()
VMThread::evaluate_operation(VM_Operation*)
VMThread::loop()
VMThread::run()


—————
Tony Printezis | @TonyPrintezis | tprintezis at twitter.com


On February 19, 2020 at 1:22:35 PM, Tony Printezis (tprintezis at twitter.com)
wrote:

Hi,

(Is this the right mailing list for this?)

I’ve been looking at a SEGV in EdgeUtils::field_name_symbol(Edge const&)
that we have been seeing in our nightly testing when running
jdk/jfr/jcmd/TestJcmdDump.java. I can reproduce it using graal and parallel
gc (cms also) on Linux with our 11 release, as well as OpenJDK 11u, 12, 13,
and 14.

The culprit seems to be this method:

static const InstanceKlass* field_type(const StoredEdge& edge) {
  assert(!edge.is_root() || !EdgeUtils::is_array_element(edge),
"invariant");
  return (const InstanceKlass*)edge.reference_owner_klass();
}

In fact, edge.reference_owner_klass()->is_instance_klass() == false, as the
class here seems to be an object array class (I’ve seen [Ljava.lang.Class;
and [Ljava.lang.Enum;).

Is this a known issue? I’m not familiar with this code. Should
field_name_symbol() return NULL in this case?

Thanks,

Tony


—————
Tony Printezis | @TonyPrintezis | tprintezis at twitter.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.java.net/pipermail/serviceability-dev/attachments/20200219/a06da744/attachment.htm>