8261837: SIGSEGV in ciVirtualCallTypeData::translate_from by dean-long · Pull Request #16750 · openjdk/jdk

dean-long · 2023-11-20T22:42:41Z

Type profiling code based on the x86 implementation uses XOR to check if the MDO value matches the klass, then later stores that XORed value into the MDO if the MDO value was 0. However, there is a race here if we reload the MDO value to check for 0, resulting in storing OBJ_KLASS XOR MDO_KLASS back to the MDO.

I took a stab at riscv, but I don't have a way to test it.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8261837: SIGSEGV in ciVirtualCallTypeData::translate_from (Bug - P3)

Reviewers

Igor Veresov (@veresov - Reviewer)
Vladimir Ivanov (@iwanowww - Reviewer) ⚠️ Review applies to d6f71bbd
Vladimir Kozlov (@vnkozlov - Reviewer)

Contributors

Fei Yang <fyang@openjdk.org>

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/16750/head:pull/16750
$ git checkout pull/16750

Update a local copy of the PR:
$ git checkout pull/16750
$ git pull https://git.openjdk.org/jdk.git pull/16750/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 16750

View PR using the GUI difftool:
$ git pr show -t 16750

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/16750.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2023-11-20T22:44:03Z

👋 Welcome back dlong! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2023-11-20T22:45:50Z

@dean-long The following label will be automatically applied to this pull request:

hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2023-11-20T22:48:12Z

Webrevs

dean-long · 2023-11-20T23:49:50Z

Moved to Draft. There is no rscratch1 register on 32-bit x86.

vnkozlov · 2023-11-21T00:36:37Z

src/hotspot/cpu/x86/interp_masm_x86.cpp

+  xorptr(obj, rscratch1); // get back original value before XOR
  xorptr(obj, mdo_addr);


Was it bug here originally? We had 2 xors (including this) and now 3 for obj.

Yes, there was a bug here originally. obj could have contained a bad value. The code wants to store the Klass* from load_klass with the low TypeEntries::null_seen bit from mdo_addr ORed in. However, because the low bits of the Klass* are 0, XOR was used to both OR the low bits and SET the high bits, assuming the high bits from mdo_addr are 0.
The problem comes from assuming the mdo_addr memory value is stable and reloading the value from memory to compare against 0 and TypeEntries::null_seen. A transient 0 can appear because of non-atomic updates like this:
orptr(mdo_addr, TypeEntries::null_seen);
An alternative fix would be to get rid of the races and use atomic compare-and-swap to write new values.

The new 2nd XOR is an optimization, instead of calling load_klass() again, or saving the original obj value somewhere else. The 3nd XOR is a repeat of the 1st XOR. I don't think this slow path retry is that useful, and not all platforms do it, but I left it in because I wanted to minimize changes.

dean-long · 2023-11-21T03:19:02Z

@vnkozlov, you might want to wait until the 32-bit x86 code is fixed before reviewing. If I can't find an extra temp register to use, I'll need to make more significant changes.

dean-long · 2023-11-21T03:40:19Z

pseudo-code of the bug:

klass = obj->klass();
mdo_klass = *mdo_addr;
// low 2 bits: null_seen, unknown_type
// case 1: klass unset
// we want (klass | (mdo_klass & 3)) if md_addr is empty or null_seen,
// XOR gives same result as OR if klass has low bits 0 and md_addr has
// high bits 0.
// case 2: klass already set and matches obj klass
// (klass ^ mdo_klass) & ~3 == 0 means klasses match 
new_klass = klass ^ mdo_klass;
if ((new_klass & ~3) == 0) {
  // match, do nothing
} else if (*mdo_addr == 0 || *mdo_addr == null_seen) {
  // XXX Oops, *mdo_addr could have changed, which means instead of the value
  // (klass | (mdo_klass & 3))
  // we might have instead
  // klass ^ mdo_klass
  *mdo_addr = new_klass;
}

veresov

Great find! Thank you for getting to the bottom of it!

dean-long · 2023-11-21T23:28:44Z

Thanks @veresov. I had to push a different fix for x86 because of a lack of scratch registers. Please take another look.

openjdk · 2023-11-21T23:31:02Z

@dean-long This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8261837: SIGSEGV in ciVirtualCallTypeData::translate_from

Co-authored-by: Fei Yang <fyang@openjdk.org>
Reviewed-by: iveresov, vlivanov, kvn

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 99 new commits pushed to the master branch:

82967f4: 8310159: Bulk copy with Unsafe::arrayCopy is slower compared to memcpy
f0a12c5: 8320763: Fix spacing arround assignment in spec.gmk.in
12e983a: 8194743: Compiler implementation for Statements before super()
5e24aaf: 8320001: javac crashes while adding type annotations to the return type of a constructor
f9e9131: 8319703: Serial: Remove generationSpec
a006d7e: 8294549: configure script should detect unsupported path
4977922: 8320330: Improve implementation of RShift Value
a40d8d9: 8314220: Configurable InlineCacheBuffer size
1272368: 8318113: CSS.BackgroundImage doesn't implement equals
28d3762: 8320618: NPE: Cannot invoke "java.lang.constant.ClassDesc.isArray()" because "this.sym" is null
... and 89 more: https://git.openjdk.org/jdk/compare/99570fbe76e05b463d31c3dd7f8f15f16971fb0a...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

dean-long · 2023-11-21T23:34:07Z

/label hotspot-runtime

openjdk · 2023-11-21T23:34:50Z

@dean-long
The hotspot-runtime label was successfully added.

dean-long · 2023-11-21T23:47:46Z

Can I get a RISC-V developer to test this for me, please?
@feilongjiang @RealFYang @luhenry

iwanowww

Nice catch, Dean!

src/hotspot/cpu/riscv/c1_LIRAssembler_riscv.cpp

src/hotspot/cpu/x86/c1_LIRAssembler_x86.cpp

src/hotspot/cpu/x86/interp_masm_x86.cpp

RealFYang · 2023-11-22T15:27:38Z

@dean-long : Hi Dean, thanks for adding handling for riscv.
But seems that we need several more changes for this platform. Would you mind apply following small add-on patch please?
(Tier1 tested on sifive unmatched board. Also run non-trivial benchmark workloads.)

16750-riscv.diff.txt

dean-long · 2023-11-23T00:30:56Z

/contributor @RealFYang

dean-long · 2023-11-23T00:31:06Z

Thanks @RealFYang

openjdk · 2023-11-23T00:31:42Z

@dean-long Syntax: /contributor (add|remove) [@user | openjdk-user | Full Name <email@address>]. For example:

/contributor add @openjdk-bot
/contributor add duke
/contributor add J. Duke <duke@openjdk.org>

User names can only be used for users in the census associated with this repository. For other contributors you need to supply the full name and email address.

dean-long · 2023-11-23T00:51:04Z

/contributor add fyang

openjdk · 2023-11-23T00:52:14Z

@dean-long
Contributor Fei Yang <fyang@openjdk.org> successfully added.

vnkozlov

Latest changes looks good.

dean-long · 2023-11-27T21:59:33Z

Thanks @iwanowww , @veresov , and @vnkozlov .

dean-long · 2023-11-27T21:59:43Z

/integrate

openjdk · 2023-11-27T22:01:39Z

Going to push as commit 1bb250c.
Since your change was applied there have been 101 commits pushed to the master branch:

5f7f2c4: 8320249: tools/jpackage/share/AddLauncherTest.java#id1 fails intermittently on Windows in verifyDescription
6871a2f: 8320803: Update SourceVersion.RELEASE_22 description for language changes
82967f4: 8310159: Bulk copy with Unsafe::arrayCopy is slower compared to memcpy
f0a12c5: 8320763: Fix spacing arround assignment in spec.gmk.in
12e983a: 8194743: Compiler implementation for Statements before super()
5e24aaf: 8320001: javac crashes while adding type annotations to the return type of a constructor
f9e9131: 8319703: Serial: Remove generationSpec
a006d7e: 8294549: configure script should detect unsupported path
4977922: 8320330: Improve implementation of RShift Value
a40d8d9: 8314220: Configurable InlineCacheBuffer size
... and 91 more: https://git.openjdk.org/jdk/compare/99570fbe76e05b463d31c3dd7f8f15f16971fb0a...master

Your commit was automatically rebased without conflicts.

openjdk · 2023-11-27T22:01:46Z

@dean-long Pushed as commit 1bb250c.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

theRealAph · 2025-11-17T09:33:38Z

src/hotspot/cpu/x86/c1_LIRAssembler_x86.cpp

+      __ jcc(Assembler::notZero, next); // already set
+#endif
+      // atomic update to prevent overwriting Klass* with 0
+      __ lock();


One thing I'm curious about: why is the locked update only here on x86, and not in any other port?

dean-long added 4 commits November 18, 2023 03:45

aarch64

2789740

x86

3e4946b

riscv

d8c3e79

revert unnecessary changes

ed8ea27

openjdk bot added the rfr Pull request is ready for review label Nov 20, 2023

openjdk bot added the hotspot-compiler hotspot-compiler-dev@openjdk.org label Nov 20, 2023

dean-long marked this pull request as draft November 20, 2023 23:17

openjdk bot removed the rfr Pull request is ready for review label Nov 20, 2023

vnkozlov reviewed Nov 21, 2023

View reviewed changes

veresov approved these changes Nov 21, 2023

View reviewed changes

redo for x86

d6f71bb

dean-long marked this pull request as ready for review November 21, 2023 23:28

dean-long requested review from veresov and vnkozlov November 21, 2023 23:28

openjdk bot added ready Pull request is ready to be integrated rfr Pull request is ready for review labels Nov 21, 2023

openjdk bot added the hotspot-runtime hotspot-runtime-dev@openjdk.org label Nov 21, 2023

iwanowww approved these changes Nov 22, 2023

View reviewed changes

src/hotspot/cpu/riscv/c1_LIRAssembler_riscv.cpp Show resolved Hide resolved

src/hotspot/cpu/x86/c1_LIRAssembler_x86.cpp Outdated Show resolved Hide resolved

src/hotspot/cpu/x86/interp_masm_x86.cpp Show resolved Hide resolved

src/hotspot/cpu/x86/interp_masm_x86.cpp Show resolved Hide resolved

add missing #endif

44c3422

use #ifdef _LP64 instead of LP64_ONLY

4602f30

riscv patch from Fei Yang <fyang@openjdk.org>

bcc1a31

vnkozlov approved these changes Nov 24, 2023

View reviewed changes

veresov approved these changes Nov 27, 2023

View reviewed changes

openjdk bot added the integrated Pull request has been integrated label Nov 27, 2023

openjdk bot closed this Nov 27, 2023

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Nov 27, 2023

theRealAph reviewed Nov 17, 2025

View reviewed changes

		xorptr(obj, rscratch1); // get back original value before XOR
		xorptr(obj, mdo_addr);

Conversation

dean-long commented Nov 20, 2023 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Contributors

Reviewing

Webrev

Uh oh!

bridgekeeper bot commented Nov 20, 2023

Uh oh!

openjdk bot commented Nov 20, 2023

Uh oh!

mlbridge bot commented Nov 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

dean-long commented Nov 20, 2023

Uh oh!

vnkozlov Nov 21, 2023

Choose a reason for hiding this comment

Uh oh!

dean-long Nov 21, 2023

Choose a reason for hiding this comment

Uh oh!

dean-long commented Nov 21, 2023

Uh oh!

dean-long commented Nov 21, 2023

Uh oh!

veresov left a comment

Choose a reason for hiding this comment

Uh oh!

dean-long commented Nov 21, 2023

Uh oh!

openjdk bot commented Nov 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dean-long commented Nov 21, 2023

Uh oh!

openjdk bot commented Nov 21, 2023

Uh oh!

dean-long commented Nov 21, 2023

Uh oh!

iwanowww left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RealFYang commented Nov 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dean-long commented Nov 23, 2023

Uh oh!

dean-long commented Nov 23, 2023

Uh oh!

openjdk bot commented Nov 23, 2023

Uh oh!

dean-long commented Nov 23, 2023

Uh oh!

openjdk bot commented Nov 23, 2023

Uh oh!

vnkozlov left a comment

Choose a reason for hiding this comment

Uh oh!

dean-long commented Nov 27, 2023

Uh oh!

dean-long commented Nov 27, 2023

Uh oh!

openjdk bot commented Nov 27, 2023

Uh oh!

openjdk bot commented Nov 27, 2023

Uh oh!

theRealAph Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

dean-long commented Nov 20, 2023 •

edited by openjdk bot

Loading

mlbridge bot commented Nov 20, 2023 •

edited

Loading

openjdk bot commented Nov 21, 2023 •

edited

Loading

RealFYang commented Nov 22, 2023 •

edited

Loading