JDK8 Segmentation error: vmState=0x000514ff #15311
Comments
|
We can reproduce the reduced |
|
The crash didn't reproduce for me. Trying |
|
Actually, I was able to reproduce the crash using the reduced test case on plinux (using 11.0.14.1). |
|
vmState [0x514ff]: {J9VMSTATE_JIT} {globalValuePropagation} @0xdaryl fyi |
|
It doesn't reproduce on plinux using the reduced test case with the latest build. |
|
@pshipton Sorry for fogetting FuzzerUtils.java. See this /*
* Copyright (C) 2016 Intel Corporation
* Modifications copyright (C) 2017-2018 Azul Systems
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import java.util.concurrent.atomic.AtomicLong;
import java.io.PrintStream;
import java.util.Random;
// Utilities for the tests generated by Java* Fuzzer for Android*
// with modifications for Java* Fuzzer test generator
public class FuzzerUtils {
public static PrintStream out = System.out;
public static Random random = new Random(1);
public static long seed = 1L;
public static int UnknownZero = 0;
// Init seed
public static void seed(long seed){
random = new Random(seed);
FuzzerUtils.seed = seed;
}
public static int nextInt(){
return random.nextInt();
}
public static long nextLong(){
return random.nextLong();
}
public static float nextFloat(){
return random.nextFloat();
}
public static double nextDouble(){
return random.nextDouble();
}
public static boolean nextBoolean(){
return random.nextBoolean();
}
public static byte nextByte(){
return (byte)random.nextInt();
}
public static short nextShort(){
return (short)random.nextInt();
}
public static char nextChar(){
return (char)random.nextInt();
}
// Array initialization
// boolean -----------------------------------------------
public static void init(boolean[] a, boolean seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (j % 2 == 0) ? seed : (j % 3 == 0);
}
}
public static void init(boolean[][] a, boolean seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// long --------------------------------------------------
public static void init(long[] a, long seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (j % 2 == 0) ? seed + j : seed - j;
}
}
public static void init(long[][] a, long seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// int --------------------------------------------------
public static void init(int[] a, int seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (j % 2 == 0) ? seed + j : seed - j;
}
}
public static void init(int[][] a, int seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// short --------------------------------------------------
public static void init(short[] a, short seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (short) ((j % 2 == 0) ? seed + j : seed - j);
}
}
public static void init(short[][] a, short seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// char --------------------------------------------------
public static void init(char[] a, char seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (char) ((j % 2 == 0) ? seed + j : seed - j);
}
}
public static void init(char[][] a, char seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// byte --------------------------------------------------
public static void init(byte[] a, byte seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (byte) ((j % 2 == 0) ? seed + j : seed - j);
}
}
public static void init(byte[][] a, byte seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// double --------------------------------------------------
public static void init(double[] a, double seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (j % 2 == 0) ? seed + j : seed - j;
}
}
public static void init(double[][] a, double seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// float --------------------------------------------------
public static void init(float[] a, float seed) {
for (int j = 0; j < a.length; j++) {
a[j] = (j % 2 == 0) ? seed + j : seed - j;
}
}
public static void init(float[][] a, float seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
// Object -------------------------------------------------
public static void init(Object[][] a, Object seed) {
for (int j = 0; j < a.length; j++) {
init(a[j], seed);
}
}
public static void init(Object[] a, Object seed) {
for (int j = 0; j < a.length; j++)
try {
a[j] = seed.getClass().newInstance();
} catch (Exception ex) {
a[j] = seed;
}
}
// Calculate array checksum
// boolean -----------------------------------------------
public static long checkSum(boolean[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (a[j] ? j + 1 : 0);
}
return sum;
}
public static long checkSum(boolean[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// long --------------------------------------------------
public static long checkSum(long[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static long checkSum(long[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// int --------------------------------------------------
public static long checkSum(int[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static long checkSum(int[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// short --------------------------------------------------
public static long checkSum(short[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (short) (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static long checkSum(short[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// char --------------------------------------------------
public static long checkSum(char[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (char) (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static long checkSum(char[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// byte --------------------------------------------------
public static long checkSum(byte[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (byte) (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static long checkSum(byte[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// double --------------------------------------------------
public static double checkSum(double[] a) {
double sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static double checkSum(double[][] a) {
double sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// float --------------------------------------------------
public static double checkSum(float[] a) {
double sum = 0;
for (int j = 0; j < a.length; j++) {
sum += (a[j] / (j + 1) + a[j] % (j + 1));
}
return sum;
}
public static double checkSum(float[][] a) {
double sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
// Object --------------------------------------------------
public static long checkSum(Object[][] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]);
}
return sum;
}
public static long checkSum(Object[] a) {
long sum = 0;
for (int j = 0; j < a.length; j++) {
sum += checkSum(a[j]) * Math.pow(2, j);
}
return sum;
}
public static long checkSum(Object a) {
if (a == null)
return 0L;
return (long) a.getClass().getCanonicalName().length();
}
// Array creation ------------------------------------------
public static byte[] byte1array(int sz, byte seed) {
byte[] ret = new byte[sz];
init(ret, seed);
return ret;
}
public static byte[][] byte2array(int sz, byte seed) {
byte[][] ret = new byte[sz][sz];
init(ret, seed);
return ret;
}
public static short[] short1array(int sz, short seed) {
short[] ret = new short[sz];
init(ret, seed);
return ret;
}
public static short[][] short2array(int sz, short seed) {
short[][] ret = new short[sz][sz];
init(ret, seed);
return ret;
}
public static int[] int1array(int sz, int seed) {
int[] ret = new int[sz];
init(ret, seed);
return ret;
}
public static int[][] int2array(int sz, int seed) {
int[][] ret = new int[sz][sz];
init(ret, seed);
return ret;
}
public static long[] long1array(int sz, long seed) {
long[] ret = new long[sz];
init(ret, seed);
return ret;
}
public static long[][] long2array(int sz, long seed) {
long[][] ret = new long[sz][sz];
init(ret, seed);
return ret;
}
public static float[] float1array(int sz, float seed) {
float[] ret = new float[sz];
init(ret, seed);
return ret;
}
public static float[][] float2array(int sz, float seed) {
float[][] ret = new float[sz][sz];
init(ret, seed);
return ret;
}
public static double[] double1array(int sz, double seed) {
double[] ret = new double[sz];
init(ret, seed);
return ret;
}
public static double[][] double2array(int sz, double seed) {
double[][] ret = new double[sz][sz];
init(ret, seed);
return ret;
}
public static char[] char1array(int sz, char seed) {
char[] ret = new char[sz];
init(ret, seed);
return ret;
}
public static char[][] char2array(int sz, char seed) {
char[][] ret = new char[sz][sz];
init(ret, seed);
return ret;
}
public static Object[] Object1array(int sz, Object seed) {
Object[] ret = new Object[sz];
init(ret, seed);
return ret;
}
public static Object[][] Object2array(int sz, Object seed) {
Object[][] ret = new Object[sz][sz];
init(ret, seed);
return ret;
}
public static boolean[] boolean1array(int sz, boolean seed) {
boolean[] ret = new boolean[sz];
init(ret, seed);
return ret;
}
public static boolean[][] boolean2array(int sz, boolean seed) {
boolean[][] ret = new boolean[sz][sz];
init(ret, seed);
return ret;
}
public static AtomicLong runningThreads = new AtomicLong(0);
public static synchronized void runThread(Runnable r) {
final Thread t = new Thread(r);
t.start();
runningThreads.incrementAndGet();
Thread t1 = new Thread(new Runnable() {
public void run() {
try {
t.join();
runningThreads.decrementAndGet();
} catch (InterruptedException e) {
}
}
});
t1.start();
}
public static void joinThreads() {
while (runningThreads.get() > 0) {
try {
Thread.sleep(1000);
} catch (InterruptedException e) {
}
}
}
} |
|
Using the original testcase, I can reproduce it now on xlinux on 0.32 and the latest JVM, |
|
@hzongaro : could you have a look at this reproducible GVP crash please? Note it is initially targeted to 0.33. |
|
This might be the same as issue #14489. I am readily able to reproduce it and am continuing to investigate. |
|
@hzongaro I looked through the value propagation git history in OMR and tried reverting a few recent PR's. I was not able to reproduce after reverting eclipse-omr/omr#6121. |
Thanks, Brad @BradleyWood! I'll take a look at whether that causes the problem, or if that change was correct, and exposed the problem. . . . |
|
I took at look at transformations that GVP performs when OMR pull request #6121 is reverted. In that case, although there's no crash, I can see that it removes a Now I'm trying to understand why |
|
I'm still able to reproduce the failure with this reduced test: I'll post some more details showing what I think is going wrong. |
|
This is not a 0.33 regression. It is reproducible at least as far back as 0.24 on JDK11. As @hzongaro mentions above, eclipse-omr/omr#6121 is likely a red herring. |
pshipton
modified the milestones:
Release 0.33 (Java 8, 11, 17, 18) July refresh,
Release 0.34 (Java 19)
|
I'm still struggling a bit with how to resolve this issue. I don't think it can be quickly resolved safely, and as it's a long-standing problem I don't think it should be considered a blocker - and I see the Peter @pshipton has already removed the blocker label. I'll post some more details about what I see happening, and reach out to Vijay @vijaysun-omr for some advice. |
|
Inside the inner loop (loop 6), we have several paths through inlined code and guarded calls that assigns values to The relevant portion of the CFG looks this: 31→32, 32→92, 92→93, 93→94, 94→47 The branches from blocks 26, 89 and 94 are conditional; the branch from block 44 (which is on the taken side of the inlined guard for In processing
Where things go awry in In this case, Later Later, in processing But this time, the constraint from the def at node n58n is What I'm trying to understand is whether the later processing in Vijay @vijaysun-omr, I would appreciate your thoughts, comments or questions about this |
|
In case anyone is interested, here is the complete jitdump from which the information in the previous comment was extracted. It contains some additional tracing from |
pshipton
modified the milestones:
Java 19,
Release 0.35 (Java 8, 11, 17, 19) Oct refresh
|
Fixed by OMR pull request 6619 |
Java -version output
Summary of problem
The following test case crashes OpenJ9's JIT compiler
Diagnostic files
By issuing
the following crash log is given:
Please also check openj9-bug-63.tar.gz for all the logs (jitdump, snap, etc.) and the testcase (Test.java, Test.class).
Notice
The given
Test.java(which is reduced by us) is NOT always reproducible, and often take ~1min to crash when it is reproducible. So please be patient. If it is not reproducible, please useTest.java.origin the above link.The text was updated successfully, but these errors were encountered: