Crash on finalizer in tsanOopMap

[Arthur Eubanks]

Here it is:
http://cr.openjdk.java.net/~aeubanks/tsanfinalizercrash/NonRacyFinalizerLoopTest.java

On Wed, Jul 10, 2019 at 4:59 PM Man Cao <manc at google.com> wrote:

> I don't see the attached reproducer. I don't think you could add
> attachment on the mailing list though.
> Could you inline it in the email or put it on webrev?
>
> -Man
>
>
> On Mon, Jul 8, 2019 at 1:23 PM Arthur Eubanks <aeubanks at google.com> wrote:
>
>> I have a simpler reproducer attached.
>>
>> Some logging:
>>            // The object survived GC, add its updated oop to the new oops
>> map.
>>            oop target_oop = cast_to_oop((intptr_t)source_obj);
>>            pointer_adjuster->do_oop(&target_oop);
>> +          oopDesc *target_obj = target_oop;
>> +          if (!heap->is_in(target_oop)) {
>> +            fprintf(stderr, "%p\n", source_obj);
>> +            fprintf(stderr, "%p\n", target_obj);
>> +          }
>>            assert(heap->is_in(target_oop), "Adjustment failed");
>> -          oopDesc *target_obj = target_oop;
>>            new_map->put(target_obj, obj_size);
>>
>> 0xffea5570
>> 0xf8238138
>>
>> On Wed, Jul 3, 2019 at 10:44 AM Arthur Eubanks <aeubanks at google.com>
>> wrote:
>>
>> > Trying to implement finalizer support, I created a test (attached), and
>> > tsanOopMap.cpp seems buggy.
>> >
>> > # after -XX: or in .hotspotrc:  SuppressErrorAt=/tsanOopMap.cpp:294
>> > #
>> > # A fatal error has been detected by the Java Runtime Environment:
>> > #
>> > #  Internal Error
>> >
>> (/usr/local/google/home/aeubanks/jdk/tsan/src/hotspot/share/tsan/tsanOopMap.cpp:294),
>> > pid=16182, tid=16188
>> > #  assert(heap->is_in(target_oop)) failed: Adjustment failed
>> > #
>> > # JRE version: OpenJDK Runtime Environment (13.0) (fastdebug build
>> > 13-internal+0-adhoc.aeubanks.tsan)
>> > # Java VM: OpenJDK 64-Bit Server VM (fastdebug
>> > 13-internal+0-adhoc.aeubanks.tsan, interpreted mode, tiered, compressed
>> > oops, g1 gc, linux-amd64)
>> > # Problematic frame:
>> > # V  [libjvm.so+0x164e63b]
>> >  TsanOopMapImpl::TsanOopSizeMap::collect_oops(BoolObjectClosure*,
>> > OopClosure*, GrowableArray<TsanOopMapImpl::PendingMove>*, int*, char**,
>> > char**)+0x24b
>> > #
>> > # No core dump will be written. Core dumps have been disabled. To enable
>> > core dumping, try "ulimit -c unlimited" before starting Java again
>> > #
>> > # An error report file with more information is saved as:
>> > #
>> >
>> /usr/local/google/home/aeubanks/jdk/tsan/build/test-support/jtreg_test_hotspot_jtreg_tsan_NonRacyFinalizerLoopTest_java/scratch/0/hs_err_pid16182.log
>> > #
>> > # If you would like to submit a bug report, please visit:
>> > #   http://bugreport.java.com/bugreport/crash.jsp
>> > #
>> >
>>
>