Crash on finalizer in tsanOopMap

[Arthur Eubanks]

I have a simpler reproducer attached.

Some logging:
           // The object survived GC, add its updated oop to the new oops
map.
           oop target_oop = cast_to_oop((intptr_t)source_obj);
           pointer_adjuster->do_oop(&target_oop);
+          oopDesc *target_obj = target_oop;
+          if (!heap->is_in(target_oop)) {
+            fprintf(stderr, "%p\n", source_obj);
+            fprintf(stderr, "%p\n", target_obj);
+          }
           assert(heap->is_in(target_oop), "Adjustment failed");
-          oopDesc *target_obj = target_oop;
           new_map->put(target_obj, obj_size);

0xffea5570
0xf8238138

On Wed, Jul 3, 2019 at 10:44 AM Arthur Eubanks <aeubanks at google.com> wrote:

> Trying to implement finalizer support, I created a test (attached), and
> tsanOopMap.cpp seems buggy.
>
> # after -XX: or in .hotspotrc:  SuppressErrorAt=/tsanOopMap.cpp:294
> #
> # A fatal error has been detected by the Java Runtime Environment:
> #
> #  Internal Error
> (/usr/local/google/home/aeubanks/jdk/tsan/src/hotspot/share/tsan/tsanOopMap.cpp:294),
> pid=16182, tid=16188
> #  assert(heap->is_in(target_oop)) failed: Adjustment failed
> #
> # JRE version: OpenJDK Runtime Environment (13.0) (fastdebug build
> 13-internal+0-adhoc.aeubanks.tsan)
> # Java VM: OpenJDK 64-Bit Server VM (fastdebug
> 13-internal+0-adhoc.aeubanks.tsan, interpreted mode, tiered, compressed
> oops, g1 gc, linux-amd64)
> # Problematic frame:
> # V  [libjvm.so+0x164e63b]
>  TsanOopMapImpl::TsanOopSizeMap::collect_oops(BoolObjectClosure*,
> OopClosure*, GrowableArray<TsanOopMapImpl::PendingMove>*, int*, char**,
> char**)+0x24b
> #
> # No core dump will be written. Core dumps have been disabled. To enable
> core dumping, try "ulimit -c unlimited" before starting Java again
> #
> # An error report file with more information is saved as:
> #
> /usr/local/google/home/aeubanks/jdk/tsan/build/test-support/jtreg_test_hotspot_jtreg_tsan_NonRacyFinalizerLoopTest_java/scratch/0/hs_err_pid16182.log
> #
> # If you would like to submit a bug report, please visit:
> #   http://bugreport.java.com/bugreport/crash.jsp
> #
>