Crash on finalizer in tsanOopMap

[Man Cao]

Can I have reviews for this bug fix?
https://cr.openjdk.java.net/~manc/tsan20190711/webrev.00/
The assertion check is too strong for target_oop after calling
pointer_adjuster->do_oop().


-Man


On Thu, Jul 11, 2019 at 10:52 AM Arthur Eubanks <aeubanks at google.com> wrote:

> Here it is:
> http://cr.openjdk.java.net/~aeubanks/tsanfinalizercrash/NonRacyFinalizerLoopTest.java
>
> On Wed, Jul 10, 2019 at 4:59 PM Man Cao <manc at google.com> wrote:
>
>> I don't see the attached reproducer. I don't think you could add
>> attachment on the mailing list though.
>> Could you inline it in the email or put it on webrev?
>>
>> -Man
>>
>>
>> On Mon, Jul 8, 2019 at 1:23 PM Arthur Eubanks <aeubanks at google.com>
>> wrote:
>>
>>> I have a simpler reproducer attached.
>>>
>>> Some logging:
>>>            // The object survived GC, add its updated oop to the new oops
>>> map.
>>>            oop target_oop = cast_to_oop((intptr_t)source_obj);
>>>            pointer_adjuster->do_oop(&target_oop);
>>> +          oopDesc *target_obj = target_oop;
>>> +          if (!heap->is_in(target_oop)) {
>>> +            fprintf(stderr, "%p\n", source_obj);
>>> +            fprintf(stderr, "%p\n", target_obj);
>>> +          }
>>>            assert(heap->is_in(target_oop), "Adjustment failed");
>>> -          oopDesc *target_obj = target_oop;
>>>            new_map->put(target_obj, obj_size);
>>>
>>> 0xffea5570
>>> 0xf8238138
>>>
>>> On Wed, Jul 3, 2019 at 10:44 AM Arthur Eubanks <aeubanks at google.com>
>>> wrote:
>>>
>>> > Trying to implement finalizer support, I created a test (attached), and
>>> > tsanOopMap.cpp seems buggy.
>>> >
>>> > # after -XX: or in .hotspotrc:  SuppressErrorAt=/tsanOopMap.cpp:294
>>> > #
>>> > # A fatal error has been detected by the Java Runtime Environment:
>>> > #
>>> > #  Internal Error
>>> >
>>> (/usr/local/google/home/aeubanks/jdk/tsan/src/hotspot/share/tsan/tsanOopMap.cpp:294),
>>> > pid=16182, tid=16188
>>> > #  assert(heap->is_in(target_oop)) failed: Adjustment failed
>>> > #
>>> > # JRE version: OpenJDK Runtime Environment (13.0) (fastdebug build
>>> > 13-internal+0-adhoc.aeubanks.tsan)
>>> > # Java VM: OpenJDK 64-Bit Server VM (fastdebug
>>> > 13-internal+0-adhoc.aeubanks.tsan, interpreted mode, tiered, compressed
>>> > oops, g1 gc, linux-amd64)
>>> > # Problematic frame:
>>> > # V  [libjvm.so+0x164e63b]
>>> >  TsanOopMapImpl::TsanOopSizeMap::collect_oops(BoolObjectClosure*,
>>> > OopClosure*, GrowableArray<TsanOopMapImpl::PendingMove>*, int*, char**,
>>> > char**)+0x24b
>>> > #
>>> > # No core dump will be written. Core dumps have been disabled. To
>>> enable
>>> > core dumping, try "ulimit -c unlimited" before starting Java again
>>> > #
>>> > # An error report file with more information is saved as:
>>> > #
>>> >
>>> /usr/local/google/home/aeubanks/jdk/tsan/build/test-support/jtreg_test_hotspot_jtreg_tsan_NonRacyFinalizerLoopTest_java/scratch/0/hs_err_pid16182.log
>>> > #
>>> > # If you would like to submit a bug report, please visit:
>>> > #   http://bugreport.java.com/bugreport/crash.jsp
>>> > #
>>> >
>>>
>>