Crash on finalizer in tsanOopMap

[Man Cao]

I don't see the attached reproducer. I don't think you could add attachment
on the mailing list though.
Could you inline it in the email or put it on webrev?

-Man


On Mon, Jul 8, 2019 at 1:23 PM Arthur Eubanks <aeubanks at google.com> wrote:

> I have a simpler reproducer attached.
>
> Some logging:
>            // The object survived GC, add its updated oop to the new oops
> map.
>            oop target_oop = cast_to_oop((intptr_t)source_obj);
>            pointer_adjuster->do_oop(&target_oop);
> +          oopDesc *target_obj = target_oop;
> +          if (!heap->is_in(target_oop)) {
> +            fprintf(stderr, "%p\n", source_obj);
> +            fprintf(stderr, "%p\n", target_obj);
> +          }
>            assert(heap->is_in(target_oop), "Adjustment failed");
> -          oopDesc *target_obj = target_oop;
>            new_map->put(target_obj, obj_size);
>
> 0xffea5570
> 0xf8238138
>
> On Wed, Jul 3, 2019 at 10:44 AM Arthur Eubanks <aeubanks at google.com>
> wrote:
>
> > Trying to implement finalizer support, I created a test (attached), and
> > tsanOopMap.cpp seems buggy.
> >
> > # after -XX: or in .hotspotrc:  SuppressErrorAt=/tsanOopMap.cpp:294
> > #
> > # A fatal error has been detected by the Java Runtime Environment:
> > #
> > #  Internal Error
> >
> (/usr/local/google/home/aeubanks/jdk/tsan/src/hotspot/share/tsan/tsanOopMap.cpp:294),
> > pid=16182, tid=16188
> > #  assert(heap->is_in(target_oop)) failed: Adjustment failed
> > #
> > # JRE version: OpenJDK Runtime Environment (13.0) (fastdebug build
> > 13-internal+0-adhoc.aeubanks.tsan)
> > # Java VM: OpenJDK 64-Bit Server VM (fastdebug
> > 13-internal+0-adhoc.aeubanks.tsan, interpreted mode, tiered, compressed
> > oops, g1 gc, linux-amd64)
> > # Problematic frame:
> > # V  [libjvm.so+0x164e63b]
> >  TsanOopMapImpl::TsanOopSizeMap::collect_oops(BoolObjectClosure*,
> > OopClosure*, GrowableArray<TsanOopMapImpl::PendingMove>*, int*, char**,
> > char**)+0x24b
> > #
> > # No core dump will be written. Core dumps have been disabled. To enable
> > core dumping, try "ulimit -c unlimited" before starting Java again
> > #
> > # An error report file with more information is saved as:
> > #
> >
> /usr/local/google/home/aeubanks/jdk/tsan/build/test-support/jtreg_test_hotspot_jtreg_tsan_NonRacyFinalizerLoopTest_java/scratch/0/hs_err_pid16182.log
> > #
> > # If you would like to submit a bug report, please visit:
> > #   http://bugreport.java.com/bugreport/crash.jsp
> > #
> >
>