Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HeapHogLoadTest_5m crash vmState=0x00000000 #19081

Open
pshipton opened this issue Mar 6, 2024 · 55 comments
Open

HeapHogLoadTest_5m crash vmState=0x00000000 #19081

pshipton opened this issue Mar 6, 2024 · 55 comments
Assignees
Labels
blocker comp:vm segfault Issues that describe segfaults / JVM crashes test failure

Comments

@pshipton
Copy link
Member

pshipton commented Mar 6, 2024

https://openj9-jenkins.osuosl.org/job/Test_openjdk17_j9_extended.system_aarch64_mac_Nightly_testList_2/455/
HeapHogLoadTest_5m_0

https://openj9-artifactory.osuosl.org/artifactory/ci-openj9/Test/Test_openjdk17_j9_extended.system_aarch64_mac_Nightly_testList_2/455/system_test_output.tar.gz

HHLT 12:06:00.398 - Completed 33.4%. Number of tests started=330247 (+64744)
HHLT stderr Unhandled exception
HHLT stderr Type=Segmentation error vmState=0x00000000
HHLT stderr J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002
HHLT stderr Handler1=00000001005A32EC Handler2=000000010045DE84 InaccessibleAddress=0000000000000028
HHLT stderr x0=000000015BA95500 x1=0000000170C8E7C8 x2=000000037CCA21E8 x3=000000037CCA21E8
HHLT stderr x4=0000000170C8E7D8 x5=0000000170C8E7C0 x6=0000000170C8E7B8 x7=0000000170C8E820
HHLT stderr x8=0000000000000020 x9=00000003793AB698 x10=0000000170C8E7C0 x11=0000000170C8E7C8
HHLT stderr x12=0000000170C8E7D8 x13=0000000170C8E7B0 x14=00000001005EC910 x15=0000000000000010
HHLT stderr x16=00000001005EC37C x17=00000001FEAA5DE0 x18=000000015B820031 x19=0000000040000000
HHLT stderr x20=0000000000000000 x21=0000000170C8E7B0 x22=000000010FE8A470 x23=0000000170C8E7C0
HHLT stderr x24=0000000170C8E7D8 x25=0000000170C8E7C8 x26=0000000170C8E7C0 x27=0000000170C8E7B8
HHLT stderr x28=00000001006C2D74 x29(FP)=0000000170C8E7A0 x30(LR)=00000001005EC370 x31(SP)=0000000170C8E500
HHLT stderr PC=0000000100600E74 SP=0000000170C8E500
HHLT stderr v0 000000015c0ae9e9 (f: 1544219136.000000, d: 2.884941e-314)
HHLT stderr v1 000000013b823998 (f: 998390144.000000, d: 2.615266e-314)
HHLT stderr v2 0706050403020100 (f: 50462976.000000, d: 7.949929e-275)
HHLT stderr v3 3f7b853f30bf4fb1 (f: 817844160.000000, d: 6.718871e-03)
HHLT stderr v4 3fecc75fe0000000 (f: 3758096384.000000, d: 8.993377e-01)
HHLT stderr v5 bf9411c4195bf130 (f: 425455936.000000, d: -1.959902e-02)
HHLT stderr v6 3ff0000000000000 (f: 0.000000, d: 1.000000e+00)
HHLT stderr v7 000e1781000e1781 (f: 923521.000000, d: 1.959708e-308)
HHLT stderr v8 000003c10000745f (f: 29791.000000, d: 2.039238e-311)
HHLT stderr v9 7f747ae147ae147a (f: 1202590848.000000, d: 8.988466e+305)
HHLT stderr v10 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v11 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v12 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v13 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v14 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v15 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v16 bfd0000000000000 (f: 0.000000, d: -2.500000e-01)
HHLT stderr v17 3fd565ed077d5555 (f: 125654360.000000, d: 3.343461e-01)
HHLT stderr v18 bf70a052a09d07ae (f: 2694645760.000000, d: -4.059146e-03)
HHLT stderr v19 3fe62e42fefa39ef (f: 4277811712.000000, d: 6.931472e-01)
HHLT stderr v20 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v21 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v22 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v23 0000000000000000 (f: 0.000000, d: 0.000000e+00)
HHLT stderr v24 7fefffffffffffff (f: 4294967296.000000, d: 1.797693e+308)
HHLT stderr v25 c1150fb645a1cac1 (f: 1168231168.000000, d: -3.450696e+05)
HHLT stderr v26 bfb16872b03ff0cf (f: 2956980480.000000, d: -6.800000e-02)
HHLT stderr v27 c1150fb600000000 (f: 0.000000, d: -3.450695e+05)
HHLT stderr v28 7ff0000000000000 (f: 0.000000, d: inf)
HHLT stderr v29 3fc2492492492492 (f: 2454267136.000000, d: 1.428571e-01)
HHLT stderr v30 000000003f800000 (f: 1065353216.000000, d: 5.263544e-315)
HHLT stderr v31 000000003f800000 (f: 1065353216.000000, d: 5.263544e-315)
HHLT stderr Module=/Users/jenkins/workspace/Test_openjdk17_j9_extended.system_aarch64_mac_Nightly_testList_2/jdkbinary/j2sdk-image/lib/default/libj9vm29.dylib
HHLT stderr Module_base_address=0000000100580000 Symbol=_ZN26VM_BytecodeInterpreterFull3runEP10J9VMThread
HHLT stderr Symbol_address=00000001005EC37C
HHLT stderr Target=2_90_20240306_525 (Mac OS X 12.6.7)
HHLT stderr CPU=aarch64 (8 logical CPUs) (0x400000000 RAM)
HHLT stderr ----------- Stack Backtrace -----------
HHLT stderr ---------------------------------------
@pshipton pshipton added test failure segfault Issues that describe segfaults / JVM crashes labels Mar 6, 2024
@pshipton
Copy link
Member Author

pshipton commented Mar 6, 2024

1XMCURTHDINFO  Current thread
3XMTHREADINFO      "load-4" J9VMThread:0x000000015BA95500, omrthread_t:0x000000015BA8DF58, java/lang/Thread:0x00000002802E7B40, state:R, prio=5
3XMJAVALTHREAD            (java/lang/Thread getId:0x1F, isDaemon:false)
3XMJAVALTHRCCL            jdk/internal/loader/ClassLoaders$AppClassLoader(0x000000028005C568)
3XMTHREADINFO1            (native thread ID:0xA269812, native priority:0x5, native policy:UNKNOWN, vmstate:R, vm thread flags:0x00000020)
3XMTHREADINFO2            (native stack address range from:0x0000000170C4C000, to:0x0000000170C8F000, size:0x43000)
3XMCPUTIME               CPU usage total: 83.348020000 secs, current category="Application"
3XMHEAPALLOC             Heap bytes allocated since last GC cycle=11057632 (0xA8B9E0)
3XMTHREADINFO3           Java callstack:
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NFI/0x000000005b716890.invoke_L3_L(LambdaForm$NFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$DMH/0x000000005c059e20.invokeStatic(LambdaForm$DMH(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NamedFunction.invokeWithArguments(LambdaForm.java:1179(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretName(LambdaForm.java:964(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretWithArguments(LambdaForm.java:941(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$LFI/0x000000003b732620.interpret_I(LambdaForm$LFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$MH/0x000000005c06dc20.invokeExact_MT(LambdaForm$MH(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/AsTypeTest.testConvertByte(AsTypeTest.java:1589(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/AsTypeTest.testByte(AsTypeTest.java:861(Compiled Code))
4XESTACKTRACE                at jdk/internal/reflect/GeneratedMethodAccessor4.invoke(Bytecode PC:36(Compiled Code))
4XESTACKTRACE                at jdk/internal/reflect/DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43(Compiled Code))
4XESTACKTRACE                at java/lang/reflect/Method.invoke(Method.java:574(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/loadTest/adaptors/ArbitraryJavaAdaptor.executeTest(ArbitraryJavaAdaptor.java:102(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/loadTest/LoadTestRunner$2.run(LoadTestRunner.java:182(Compiled Code))
4XESTACKTRACE                at java/util/concurrent/ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
4XESTACKTRACE                at java/util/concurrent/ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
4XESTACKTRACE                at java/lang/Thread.run(Thread.java:857)

Looks like a dup of #16029

@knn-k
Copy link
Contributor

knn-k commented Mar 7, 2024

I ran a 30x Grinder job for HeapHogLoadTest_5m_0, and got no failures.
https://openj9-jenkins.osuosl.org/job/Grinder/3368

@knn-k
Copy link
Contributor

knn-k commented Mar 8, 2024

One more successful Grinder job (30x). https://openj9-jenkins.osuosl.org/job/Grinder/3369

@pshipton
Copy link
Member Author

https://openj9-jenkins.osuosl.org/job/Test_openjdk17_j9_extended.system_aarch64_mac_Nightly_testList_0/533
HeapHogLoadTest_5m_0

https://openj9-artifactory.osuosl.org/artifactory/ci-openj9/Test/Test_openjdk17_j9_extended.system_aarch64_mac_Nightly_testList_0/533/system_test_output.tar.gz

20:40:22  HHLT 10:40:19.853 - Completed 6.7%. Number of tests started=60455
20:40:22  HHLT stderr Unhandled exception
20:40:22  HHLT stderr Type=Segmentation error vmState=0x00000000
20:40:22  HHLT stderr J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002
20:40:22  HHLT stderr Handler1=000000010448AE08 Handler2=0000000104665E74 InaccessibleAddress=0000000000000021
20:40:22  HHLT stderr x0=000000013408D900 x1=000000016C9D67C8 x2=000000036581C610 x3=0000000128FB3400
20:40:22  HHLT stderr x4=000000016C9D67D8 x5=000000016C9D67C0 x6=000000016C9D67B8 x7=000000016C9D6820
20:40:22  HHLT stderr x8=000000013281A420 x9=0000000000000019 x10=000000016C9D67C0 x11=000000016C9D67C8
20:40:22  HHLT stderr x12=000000016C9D67D8 x13=000000016C9D67B0 x14=00000001044D4680 x15=0000000000000010
20:40:22  HHLT stderr x16=00000001044D40EC x17=0000000203B25AB0 x18=000000016C9D6101 x19=0000000040000000
20:40:22  HHLT stderr x20=0000000000000011 x21=000000016C9D67B0 x22=0000000117982CC4 x23=000000016C9D67C0
20:40:22  HHLT stderr x24=000000016C9D67D8 x25=000000016C9D67C8 x26=000000016C9D67C0 x27=000000016C9D67B8
20:40:22  HHLT stderr x28=00000001045AAD84 x29(FP)=000000016C9D67A0 x30(LR)=00000001044D40E0 x31(SP)=000000016C9D6510
20:40:22  HHLT stderr PC=00000001044E8C64 SP=000000016C9D6510
20:40:22  HHLT stderr v0=0000000131019589 (f: 822187392.000000, d: 2.528210e-314)
20:40:22  HHLT stderr v1=0000000132985998 (f: 848845184.000000, d: 2.541381e-314)
20:40:22  HHLT stderr v2=0000000040000000 (f: 1073741824.000000, d: 5.304989e-315)
20:40:22  HHLT stderr v3=bfb2aa03a4471725 (f: 2756122368.000000, d: -7.290671e-02)
20:40:22  HHLT stderr v4=3fecc75fe0000000 (f: 3758096384.000000, d: 8.993377e-01)
20:40:22  HHLT stderr v5=bf9411c4195bf130 (f: 425455936.000000, d: -1.959902e-02)
20:40:22  HHLT stderr v6=3ff0000000000000 (f: 0.000000, d: 1.000000e+00)
20:40:22  HHLT stderr v7=3fe5555555555593 (f: 1431655808.000000, d: 6.666667e-01)
20:40:22  HHLT stderr v8=3fed70da7230c1d8 (f: 1915798016.000000, d: 9.200260e-01)
20:40:22  HHLT stderr v9=40862e42fefa39ee (f: 4277811712.000000, d: 7.097827e+02)
20:40:22  HHLT stderr v10=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v11=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v12=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v13=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v14=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v15=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v16=bfd0000000000000 (f: 0.000000, d: -2.500000e-01)
20:40:22  HHLT stderr v17=3fd5590e67785555 (f: 1735939456.000000, d: 3.335606e-01)
20:40:22  HHLT stderr v18=bf4dcc08afb49070 (f: 2947846144.000000, d: -9.093325e-04)
20:40:22  HHLT stderr v19=3fe62e42fefa39ef (f: 4277811712.000000, d: 6.931472e-01)
20:40:22  HHLT stderr v20=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v21=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v22=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v23=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v24=7fefffffffffffff (f: 4294967296.000000, d: 1.797693e+308)
20:40:22  HHLT stderr v25=c1150fb645a1cac1 (f: 1168231168.000000, d: -3.450696e+05)
20:40:22  HHLT stderr v26=bfb16872b03ff0cf (f: 2956980480.000000, d: -6.800000e-02)
20:40:22  HHLT stderr v27=c1150fb600000000 (f: 0.000000, d: -3.450695e+05)
20:40:22  HHLT stderr v28=40efffe000000000 (f: 0.000000, d: 6.553500e+04)
20:40:22  HHLT stderr v29=40efffe000000000 (f: 0.000000, d: 6.553500e+04)
20:40:22  HHLT stderr v30=00000003487a8dd8 (f: 1215991296.000000, d: 6.966767e-314)
20:40:22  HHLT stderr v31=616c2f747365742f (f: 1936028672.000000, d: 1.981306e+161)
20:40:22  HHLT stderr Unhandled exception
20:40:22  HHLT stderr Type=Segmentation error vmState=0x00000000
20:40:22  HHLT stderr J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002
20:40:22  HHLT stderr Handler1=000000010448AE08 Handler2=0000000104665E74 InaccessibleAddress=0000000000000040
20:40:22  HHLT stderr x0=000000013409F700 x1=000000016CABA7C8 x2=00000003658C8620 x3=0000000128FB3400
20:40:22  HHLT stderr x4=000000016CABA7D8 x5=000000016CABA7C0 x6=000000016CABA7B8 x7=000000016CABA820
20:40:22  HHLT stderr x8=0000000000000038 x9=0000000128CBF308 x10=000000016CABA7C0 x11=000000016CABA7C8
20:40:22  HHLT stderr x12=000000016CABA7D8 x13=000000016CABA7B0 x14=00000001044D4680 x15=0000000000000010
20:40:22  HHLT stderr x16=00000001044D40EC x17=0000000203B25AB0 x18=0000000132820031 x19=0000000040000000
20:40:22  HHLT stderr x20=0000000000000018 x21=000000016CABA7B0 x22=0000000117982CC4 x23=000000016CABA7C0
20:40:22  HHLT stderr x24=000000016CABA7D8 x25=000000016CABA7C8 x26=000000016CABA7C0 x27=000000016CABA7B8
20:40:22  HHLT stderr x28=00000001045AAD84 x29(FP)=000000016CABA7A0 x30(LR)=00000001044D40E0 x31(SP)=000000016CABA510
20:40:22  HHLT stderr PC=00000001044E8CE8 SP=000000016CABA510
20:40:22  HHLT stderr v0=00000001310201a9 (f: 822215104.000000, d: 2.528224e-314)
20:40:22  HHLT stderr v1=0000000132985998 (f: 848845184.000000, d: 2.541381e-314)
20:40:22  HHLT stderr v2=41cdcd6500000000 (f: 0.000000, d: 1.000000e+09)
20:40:22  HHLT stderr v3=0000000128ca8370 (f: 684360576.000000, d: 2.460115e-314)
20:40:22  HHLT stderr v4=ef1a9c6b007c87f6 (f: 8161270.000000, d: -1.576007e+227)
20:40:22  HHLT stderr v5=00000000a90e0f4c (f: 2836270848.000000, d: 1.401304e-314)
20:40:22  HHLT stderr v6=94446f0194446f01 (f: 2487512832.000000, d: -4.855772e-211)
20:40:22  HHLT stderr v7=000e1781000e1781 (f: 923521.000000, d: 1.959708e-308)
20:40:22  HHLT stderr v8=000003c10000745f (f: 29791.000000, d: 2.039238e-311)
20:40:22  HHLT stderr v9=40862e42fefa39ee (f: 4277811712.000000, d: 7.097827e+02)
20:40:22  HHLT stderr v10=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v11=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v12=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v13=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v14=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v15=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v16=bfd0000000000000 (f: 0.000000, d: -2.500000e-01)
20:40:22  HHLT stderr v17=3fd540a0b0b55555 (f: 2964673792.000000, d: 3.320696e-01)
20:40:22  HHLT stderr v18=3f74a74a5a3ff881 (f: 1514141824.000000, d: 5.042353e-03)
20:40:22  HHLT stderr v19=3fe62e42fefa39ef (f: 4277811712.000000, d: 6.931472e-01)
20:40:22  HHLT stderr v20=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v21=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v22=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v23=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v24=7fefffffffffffff (f: 4294967296.000000, d: 1.797693e+308)
20:40:22  HHLT stderr v25=c1150fb645a1cac1 (f: 1168231168.000000, d: -3.450696e+05)
20:40:22  HHLT stderr v26=bfb16872b03ff0cf (f: 2956980480.000000, d: -6.800000e-02)
20:40:22  HHLT stderr v27=c1150fb600000000 (f: 0.000000, d: -3.450695e+05)
20:40:22  HHLT stderr v28=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v29=0000000000000000 (f: 0.000000, d: 0.000000e+00)
20:40:22  HHLT stderr v30=00000003487a8dd8 (f: 1215991296.000000, d: 6.966767e-314)
20:40:22  HHLT stderr v31=616c2f747365742f (f: 1936028672.000000, d: 1.981306e+161)
20:40:22  HHLT stderr Module=/Users/jenkins/workspace/Test_openjdk17_j9_extended.system_aarch64_mac_Nightly_testList_0/jdkbinary/j2sdk-image/lib/default/libj9vm29.dylib
20:40:22  HHLT stderr Module_base_address=0000000104468000 Symbol=_ZN26VM_BytecodeInterpreterFull3runEP10J9VMThread
20:40:22  HHLT stderr Symbol_address=00000001044D40EC
20:40:22  HHLT stderr Target=2_90_20240711_611 (Mac OS X 11.7.1)
20:40:22  HHLT stderr CPU=aarch64 (8 logical CPUs) (0x400000000 RAM)
20:40:22  HHLT stderr ----------- Stack Backtrace -----------
20:40:22  HHLT stderr ---------------------------------------
1XMCURTHDINFO  Current thread
3XMTHREADINFO      "load-1" J9VMThread:0x000000013408D900, omrthread_t:0x0000000134074158, java/lang/Thread:0x0000000280318AA8, state:R, prio=5
3XMJAVALTHREAD            (java/lang/Thread getId:0x1C, isDaemon:false)
3XMJAVALTHRCCL            jdk/internal/loader/ClassLoaders$AppClassLoader(0x0000000280056100)
3XMTHREADINFO1            (native thread ID:0x1E844E25, native priority:0x5, native policy:UNKNOWN, vmstate:R, vm thread flags:0x00000020)
3XMTHREADINFO2            (native stack address range from:0x000000016C994000, to:0x000000016C9D7000, size:0x43000)
3XMCPUTIME               CPU usage total: 14.847511000 secs, current category="Application"
3XMHEAPALLOC             Heap bytes allocated since last GC cycle=50236232 (0x2FE8B48)
3XMTHREADINFO3           Java callstack:
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NFI/0x00000000327e3d40.invoke_L3_L(LambdaForm$NFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$DMH/0x00000000328d5620.invokeStatic(LambdaForm$DMH(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NamedFunction.invokeWithArguments(LambdaForm.java:1179(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretName(LambdaForm.java:964(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretWithArguments(LambdaForm.java:941(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$LFI/0x0000000032681820.interpret_I(LambdaForm$LFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$MH/0x0000000033138820.invokeExact_MT(LambdaForm$MH(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/AsTypeTest.testConvertInt(AsTypeTest.java:4158(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/AsTypeTest.testInt(AsTypeTest.java:898(Compiled Code))
4XESTACKTRACE                at jdk/internal/reflect/GeneratedMethodAccessor5.invoke(Bytecode PC:36(Compiled Code))
4XESTACKTRACE                at jdk/internal/reflect/DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43(Compiled Code))
4XESTACKTRACE                at java/lang/reflect/Method.invoke(Method.java:575(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/loadTest/adaptors/ArbitraryJavaAdaptor.executeTest(ArbitraryJavaAdaptor.java:102(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/loadTest/LoadTestRunner$2.run(LoadTestRunner.java:182(Compiled Code))
4XESTACKTRACE                at java/util/concurrent/ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
4XESTACKTRACE                at java/util/concurrent/ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
4XESTACKTRACE                at java/lang/Thread.run(Thread.java:857)
3XMTHREADINFO3           No native callstack available for this thread
NULL

@knn-k
Copy link
Contributor

knn-k commented Jul 12, 2024

LambdaForm$NFI/0x00000000327e3d40.invoke_L3_L() is interpreted when the SEGV occurs, while jdmpview shows the core file has the compiled code of the method.

[ Output from info jitm ]
start=0x1179836d4  end=0x11798388c   java/lang/invoke/LambdaForm$NFI/0x00000000327e3d40::invoke_L3_L(Ljava/lang/invoke/MethodHandle;[Ljava/lang/Object;)Ljava/lang/Object;

@knn-k
Copy link
Contributor

knn-k commented Jul 18, 2024

I ran a 20x Grinder job, and got 2 failures.
https://hyc-runtimes-jenkins.swg-devops.com/job/Grinder/42121

I see the following messages from stack walker in those failures.

Failure 1: (output_1721268474258)

HHLT stderr 000000015B844B00: Object neither in heap nor stack-allocated in thread load-1
HHLT stderr 000000015B844B00:	O-Slot=000000014A0B87C0
HHLT stderr 000000015B844B00:	O-Slot value=0000000137A237E9
HHLT stderr 000000015B844B00:	PC=0000000137A237E9
HHLT stderr 000000015B844B00:	framesWalked=0
HHLT stderr 000000015B844B00:	arg0EA=000000014A0B8878
HHLT stderr 000000015B844B00:	walkSP=000000014A0B87A0
HHLT stderr 000000015B844B00:	literals=000000014A041778
HHLT stderr 000000015B844B00:	jitInfo=0000000000000000
HHLT stderr 000000015B844B00:	method=000000014A041778 (java/lang/invoke/LambdaForm$NFI/0x0000000037a236c0.invoke_LI_I(Ljava/lang/invoke/MethodHandle;[Ljava/lang/Object;)Ljava/lang/Object;) (Interpreted)
HHLT stderr 000000015B844B00:	stack=000000014A0B3640-000000014A0B8E80

1XMCURTHDINFO  Current thread
3XMTHREADINFO      "load-1" J9VMThread:0x000000015B844B00, omrthread_t:0x000000015B831F58, java/lang/Thread:0x0000000280450B98, state:R, prio=5
3XMJAVALTHREAD            (java/lang/Thread getId:0x1C, isDaemon:false)
3XMJAVALTHRCCL            jdk/internal/loader/ClassLoaders$AppClassLoader(0x0000000280059E50)
3XMTHREADINFO1            (native thread ID:0x3E8C694D, native priority:0x5, native policy:UNKNOWN, vmstate:R, vm thread flags:0x00000021)
3XMTHREADINFO2            (native stack address range from:0x000000016FF14000, to:0x000000016FF57000, size:0x43000)
3XMCPUTIME               CPU usage total: 157.610709000 secs, current category="Application"
3XMHEAPALLOC             Heap bytes allocated since last GC cycle=2986632 (0x2D9288)
3XMTHREADINFO3           Java callstack:
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NFI/0x0000000037a236c0.invoke_LI_I(LambdaForm$NFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$DMH/0x000000005a0db820.invokeStatic(LambdaForm$DMH(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NamedFunction.invokeWithArguments(LambdaForm.java:1179)
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretName(LambdaForm.java:964)
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretWithArguments(LambdaForm.java:941)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$LFI/0x000000005b048f00.interpret_V(LambdaForm$LFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$MH/0x000000003a00d620.invokeExact_MT(LambdaForm$MH(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/StaticAsTypeTestImplicit.testVoid(StaticAsTypeTestImplicit.java:363(Compiled Code))
...

There is no compiled code for LambdaForm$NFI/0x0000000037a236c0.invoke_LI_I() in the core file.

Failure 2: (output_17212724215180)

HHLT stderr 000000012A986B00: Object neither in heap nor stack-allocated in thread load-2
HHLT stderr 000000012A986B00:	O-Slot=000000012A9B5C18
HHLT stderr 000000012A986B00:	O-Slot value=00000001059A97A0
HHLT stderr 000000012A986B00:	PC=000000012A67ACAC
HHLT stderr 000000012A986B00:	framesWalked=0
HHLT stderr 000000012A986B00:	arg0EA=000000012A9B5CD8
HHLT stderr 000000012A986B00:	walkSP=000000012A9B5BF0
HHLT stderr 000000012A986B00:	literals=000000012A9B8378
HHLT stderr 000000012A986B00:	jitInfo=0000000000000000
HHLT stderr 000000012A986B00:	method=000000012A9B8378 (java/lang/invoke/LambdaForm$NFI/0x000000002a67ab80.invoke_LLI_I(Ljava/lang/invoke/MethodHandle;[Ljava/lang/Object;)Ljava/lang/Object;) (Interpreted)
HHLT stderr 000000012A986B00:	stack=000000012A9B0A40-000000012A9B62C0

No javacore file is available for Failure 2.
There is no compiled code for LambdaForm$NFI/0x000000002a67ab80.invoke_LLI_I() in the core file.

@knn-k
Copy link
Contributor

knn-k commented Jul 19, 2024

I ran two Grinder jobs (30x each) for the same test with Java 17 on AArch64 Linux, and got no failures.

@knn-k
Copy link
Contributor

knn-k commented Jul 22, 2024

I ran two 30x Grinder jobs (internal 42237 and 42238) on AArch64 macOS with JVM_OPTIONS -Xjit:disableAsyncCompilation, and got no failures. This could be a timing-dependent problem.

@knn-k
Copy link
Contributor

knn-k commented Aug 6, 2024

Issue #19456 (HeapHogLoadTest with Java 22 on AArch64 macOS) might be a dup of this issue.

@knn-k
Copy link
Contributor

knn-k commented Aug 29, 2024

Call stack is unavailable in the javacore file:

1XMCURTHDINFO  Current thread
3XMTHREADINFO      "load-4" J9VMThread:0x000000013413B500, omrthread_t:0x000000013410A958, java/lang/Thread:0x00000002801E1028, state:R, prio=5
3XMJAVALTHREAD            (java/lang/Thread getId:0x1F, isDaemon:false)
3XMJAVALTHRCCL            jdk/internal/loader/ClassLoaders$AppClassLoader(0x000000028004F890)
3XMTHREADINFO1            (native thread ID:0x22D9A36F, native priority:0x5, native policy:UNKNOWN, vmstate:R, vm thread flags:0x00000020)
3XMTHREADINFO2            (native stack address range from:0x000000016CA90000, to:0x000000016CAD3000, size:0x43000)
3XMCPUTIME               CPU usage total: 112.326106000 secs, current category="Application"
3XMHEAPALLOC             Heap bytes allocated since last GC cycle=25058072 (0x17E5B18)
1INTERNAL                    Unable to obtain lock context information
3XMTHREADINFO3           Java callstack:
1INTERNAL                    Unable to walk in-flight data on call stack
3XMTHREADINFO3           No native callstack available for this thread

@knn-k
Copy link
Contributor

knn-k commented Aug 29, 2024

2 failures in a 40x Grinder job.
Call stack is unavailable in the javacore files, in the same way as above.

@knn-k
Copy link
Contributor

knn-k commented Sep 2, 2024

You cannot walk the Java stack in the core file from the failure above. Jdmpview fails with CorruptDataException as shown below.

> !threads
        !stack 0x13e08e100      !j9vmthread 0x13e08e100 !j9thread 0x13e00de50   tid 0x24a2127a (614601338) // (main)
        ....
        !stack 0x13d89d100      !j9vmthread 0x13d89d100 !j9thread 0x13e1fa050   tid 0x24a212ae (614601390) // (load-0)
        !stack 0x13e20c500      !j9vmthread 0x13e20c500 !j9thread 0x13e1fa558   tid 0x24a212af (614601391) // (load-1)
        !stack 0x13e205700      !j9vmthread 0x13e205700 !j9thread 0x13e1faa60   tid 0x24a212b0 (614601392) // (load-2)
        !stack 0x13e217700      !j9vmthread 0x13e217700 !j9thread 0x13e214a50   tid 0x24a212b1 (614601393) // (load-3)
        !stack 0x13e21e300      !j9vmthread 0x13e21e300 !j9thread 0x13e214f58   tid 0x24a212b2 (614601394) // (load-4)
        !stack 0x13e224f00      !j9vmthread 0x13e224f00 !j9thread 0x13e215460   tid 0x24a212b3 (614601395) // (load-5)

> !stack 0x13e20c500 // thread "load-1"
Sep 02, 2024 3:36:47 PM com.ibm.j9ddr.vm29.events.DefaultEventListener corruptData
WARNING: CorruptDataException thrown walking stack. walkThread = 0x000000013E20C500
com.ibm.j9ddr.NullPointerDereference: Memory Fault reading 0x00000000 :
        at com.ibm.j9ddr.vm29.pointer.AbstractPointer.getPointerAtOffset(AbstractPointer.java:351)
        at com.ibm.j9ddr.vm29.pointer.generated.J9ConstantPoolPointer.ramClass(Unknown Source)
        at com.ibm.j9ddr.vm29.j9.ConstantPoolHelpers.J9_CLASS_FROM_CP(ConstantPoolHelpers.java:76)
        at com.ibm.j9ddr.vm29.j9.ConstantPoolHelpers.J9_CLASS_FROM_METHOD(ConstantPoolHelpers.java:81)
        ....
Stack walk result: STACK_CORRUPT

>  !j9vmthread 0x13e20c500
J9VMThread at 0x13e20c500 {
  Fields for J9VMThread:
        0x0: struct JNINativeInterface_* functions = !jninativeinterface_ 0x0000000104985AB8
        0x8: struct J9JavaVM* javaVM = !j9javavm 0x000000013E015420
        0x10: UDATA* arg0EA = !j9x 0x000000013B8593F0
        0x18: UDATA* bytecodes = !j9x 0x0000000000000000
        0x20: UDATA* sp = !j9x 0x000000013B859290
        0x28: U8* pc = !j9x 0x0000000000000006
        0x30: struct J9Method* literals = !j9method 0x0000000000000000
        0x38: UDATA jitStackFrameFlags = 0x0000000000000000 (0)
        0x40: struct J9Object* jitException = !j9object 0x000000037583C730 // java/lang/invoke/WrongMethodTypeException
        0x48: struct J9Object* currentException = !j9object 0x0000000000000000
        0x50: UDATA* stackOverflowMark = !j9x 0x000000013B855028
        0x58: UDATA* stackOverflowMark2 = !j9x 0x000000013B855028
        ....
}
> !j9object 0x000000037583C730 // jitException in the J9VMThread above
!J9Object 0x000000037583C730 {
        struct J9Class* clazz = !j9class 0x14863CA00 // java/lang/invoke/WrongMethodTypeException
        Object flags = 0x00000000;
        J lockword = 0x0000000000000000 (offset = 0) (java/lang/Object) <hidden>
        Ljava/lang/String; detailMessage = !fj9object 0x37583c6b0 (offset = 8) (java/lang/Throwable)
        Ljava/lang/Object; walkback = !fj9object 0x37583c770 (offset = 16) (java/lang/Throwable)
        Ljava/lang/Throwable; cause = !fj9object 0x37583c730 (offset = 24) (java/lang/Throwable)
        [Ljava/lang/StackTraceElement; stackTrace = !fj9object 0x0 (offset = 32) (java/lang/Throwable)
        Ljava/util/List; suppressedExceptions = !fj9object 0x280057bd0 (offset = 40) (java/lang/Throwable)
        Z disableWritableStackTrace = 0x00000000 (offset = 48) (java/lang/Throwable)
}
> !fj9object 0x37583c6b0 // detailMessage in the WrongMethodTypeException above
J9VMJavaLangString at 0x000000037583C6B0 {
struct J9Class* clazz = !j9class 0x1417FEC00 // java/lang/String
Object flags = 0x00000000;
[B value = !fj9object 0x37583c6d0 (offset = 0) (java/lang/String)
B coder = 0x00000000 (offset = 8) (java/lang/String)
I hash = 0x00000000 (offset = 12) (java/lang/String)
Z hashIsZero = 0x00000000 (offset = 16) (java/lang/String)
"cannot convert MethodHandle(AsTypeTest,long)long to (AsTypeTest,boolean)long"
}

@knn-k
Copy link
Contributor

knn-k commented Sep 3, 2024

50x Grinder job with the option -Xjit:exclude={java/lang/invoke/LambdaForm*.*} finished successfully: https://openj9-jenkins.osuosl.org/job/Grinder/3791/

On the other hand, jobs with the following options failed:

  • -Xjit:exclude={java/lang/invoke/LambdaForm*.invokeStatic*}
  • -Xjit:exclude={java/lang/invoke/LambdaForm*.invokeWithArguments*}
  • -Xjit:exclude={java/lang/invoke/LambdaForm*.invokeE*}
  • -Xjit:exclude={java/lang/invoke/LambdaForm*.invoke_*}
  • -Xjit:exclude={java/lang/invoke/LambdaForm*.invoke\(*}

@knn-k
Copy link
Contributor

knn-k commented Sep 3, 2024

Disabling compilation of invokeVirtual() by -Xjit:exclude={java/lang/invoke/LambdaForm*.invokeV*} seems to work.
There are more than 10 variations of invokeVirtual() in this testcase, however.

@knn-k
Copy link
Contributor

knn-k commented Sep 5, 2024

  • Running HeapHogLoadTest_5m_0 with Java 11 on AArch64 macOS: Passed
  • Running HeapHogLoadTest_5m_0 with Java 17 on AArch64 macOS: Failed (this issue)
  • Running HeapHogLoadTest_5m_0 with Java 21 on AArch64 macOS: Passed
  • Running HeapHogLoadTest_5m_0 with Java 17 on AArch64 Linux: Passed

@knn-k
Copy link
Contributor

knn-k commented Sep 6, 2024

I thought I would be able to reproduce the failure by -Xjit:limit={java/lang/invoke/LambdaForm*.invokeV*} based on the results with exclude above, but my attempt did not work as expected: Grinder jobs with the limit option were successful.

On the other hand, a Grinder job with -Xjit:disableOSR reproduced the failure.

@knn-k
Copy link
Contributor

knn-k commented Sep 9, 2024

The failure disappears when running with -Xjit:{java/lang/invoke/LambdaForm*.invokeVirtual*}(disableRecognizedCallTransformer)

@knn-k
Copy link
Contributor

knn-k commented Sep 10, 2024

A 50x Grinder job finished successfully by disabling the optimization for MethodHandle.linkToVirtual() in J9RecognizedCallTransformer.cpp.
knn-k@5055f4e

@knn-k
Copy link
Contributor

knn-k commented Sep 20, 2024

I ran a 50x Grinder job (internal 43420) hoping PR #20173 fixed the problem, but the job failed in the same way as before.

@JasonFengJ9
Copy link
Member

JasonFengJ9 commented Oct 29, 2024

openjdk17_j9_extended.system_aarch64_mac(macaarch64rt2)

[2024-10-28T15:28:46.655Z] variation: Mode110
[2024-10-28T15:28:46.655Z] JVM_OPTIONS:  -Xjit -Xgcpolicy:gencon -Xnocompressedrefs 

[2024-10-28T15:30:50.198Z] HHLT 11:30:47.698 - Completed 40.0%. Number of tests started=340172 (+59131)
[2024-10-28T15:31:10.890Z] HHLT stderr Unhandled exception
[2024-10-28T15:31:10.891Z] HHLT stderr Type=Segmentation error vmState=0x00000000
[2024-10-28T15:31:10.891Z] HHLT stderr J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002
[2024-10-28T15:31:10.891Z] HHLT stderr Handler1=000000010524647C Handler2=0000000104ECCD94 InaccessibleAddress=6EE3F12B00000028
[2024-10-28T15:31:10.891Z] HHLT stderr x0=0000000131A4F100 x1=000000016BF5E7C8 x2=0000000000000000 x3=0000000140D5C200
[2024-10-28T15:31:10.891Z] HHLT stderr x4=000000016BF5E7D8 x5=000000016BF5E7C0 x6=000000016BF5E7B8 x7=000000016BF5E820
[2024-10-28T15:31:10.891Z] HHLT stderr x8=6EE3F12B00000020 x9=00000002803CBF28 x10=000000016BF5E7C0 x11=000000016BF5E7C8
[2024-10-28T15:31:10.891Z] HHLT stderr x12=000000016BF5E7D8 x13=000000016BF5E7B0 x14=000000010528FE94 x15=0000000000000010
[2024-10-28T15:31:10.891Z] HHLT stderr x16=000000010528F900 x17=00000001E8E17738 x18=000000016BF5E101 x19=0000000040000000
[2024-10-28T15:31:10.891Z] HHLT stderr x20=6EE3F12B00000000 x21=000000016BF5E7B0 x22=0000000114BC226C x23=000000016BF5E7C0
[2024-10-28T15:31:10.891Z] HHLT stderr x24=000000016BF5E7D8 x25=000000016BF5E7C8 x26=000000016BF5E7C0 x27=000000016BF5E7B8
[2024-10-28T15:31:10.891Z] HHLT stderr x28=000000010536AD94 x29(FP)=000000016BF5E7A0 x30(LR)=000000010528F8F4 x31(SP)=000000016BF5E520
[2024-10-28T15:31:10.891Z] HHLT stderr PC=00000001052A43B8 SP=000000016BF5E520
[2024-10-28T15:31:10.891Z] HHLT stderr v0=0000000130013379 (f: 805385088.000000, d: 2.519909e-314)
[2024-10-28T15:31:10.891Z] HHLT stderr v1=0000000131a6b3b8 (f: 833008576.000000, d: 2.533557e-314)
[2024-10-28T15:31:10.891Z] HHLT stderr v2=0000000040000000 (f: 1073741824.000000, d: 5.304989e-315)
[2024-10-28T15:31:10.891Z] HHLT stderr v3=bfcbd088e83bd5d4 (f: 3896235520.000000, d: -2.173015e-01)
[2024-10-28T15:31:10.891Z] HHLT stderr v4=bc6ce0f170000000 (f: 1879048192.000000, d: -1.252413e-17)
[2024-10-28T15:31:10.891Z] HHLT stderr v5=3df73cd68165e929 (f: 2170939648.000000, d: 3.381523e-10)
[2024-10-28T15:31:10.891Z] HHLT stderr v6=bd803323f5b53b23 (f: 4122295040.000000, d: -1.841700e-12)
[2024-10-28T15:31:10.891Z] HHLT stderr v7=bfadde2d52defd9a (f: 1390345600.000000, d: -5.833570e-02)
[2024-10-28T15:31:10.891Z] HHLT stderr v8=3fc0000000000000 (f: 0.000000, d: 1.250000e-01)
[2024-10-28T15:31:10.892Z] HHLT stderr v9=4020000000000000 (f: 0.000000, d: 8.000000e+00)
[2024-10-28T15:31:10.892Z] HHLT stderr v10=0000000000000000 (f: 0.000000, d: 0.000000e+00)
[2024-10-28T15:31:10.892Z] HHLT stderr v11=0000000000000000 (f: 0.000000, d: 0.000000e+00)
[2024-10-28T15:31:10.892Z] HHLT stderr v12=00000000ff7fffff (f: 4286578688.000000, d: 2.117851e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v13=00000000ff7fffff (f: 4286578688.000000, d: 2.117851e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v14=000000007ba3d70a (f: 2074334976.000000, d: 1.024858e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v15=000000007ba3d70a (f: 2074334976.000000, d: 1.024858e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v16=bfd0000000000000 (f: 0.000000, d: -2.500000e-01)
[2024-10-28T15:31:10.892Z] HHLT stderr v17=3fd5643ec1155555 (f: 3239400704.000000, d: 3.342435e-01)
[2024-10-28T15:31:10.892Z] HHLT stderr v18=bf6de0c5f2793bc1 (f: 4068031488.000000, d: -3.647219e-03)
[2024-10-28T15:31:10.892Z] HHLT stderr v19=3fe62e42fefa39ef (f: 4277811712.000000, d: 6.931472e-01)
[2024-10-28T15:31:10.892Z] HHLT stderr v20=000000007b03126e (f: 2063798912.000000, d: 1.019652e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v21=00000000fb03126e (f: 4211282432.000000, d: 2.080650e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v22=00000000fb03126e (f: 4211282432.000000, d: 2.080650e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v23=00000000fb03126e (f: 4211282432.000000, d: 2.080650e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v24=00000000000007d0 (f: 2000.000000, d: 9.881313e-321)
[2024-10-28T15:31:10.892Z] HHLT stderr v25=00000000000007d0 (f: 2000.000000, d: 9.881313e-321)
[2024-10-28T15:31:10.892Z] HHLT stderr v26=00000000800007d0 (f: 2147485696.000000, d: 1.060999e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v27=00000000800007d0 (f: 2147485696.000000, d: 1.060999e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v28=000000003f800000 (f: 1065353216.000000, d: 5.263544e-315)
[2024-10-28T15:31:10.892Z] HHLT stderr v29=4010000000000000 (f: 0.000000, d: 4.000000e+00)
[2024-10-28T15:31:10.892Z] HHLT stderr v30=0000000280ffa780 (f: 2164238336.000000, d: 5.313267e-314)
[2024-10-28T15:31:10.892Z] HHLT stderr v31=616c2f747365742f (f: 1936028672.000000, d: 1.981306e+161)
[2024-10-28T15:31:10.892Z] HHLT stderr Module=/Users/jenkins/workspace/Test_openjdk17_j9_extended.system_aarch64_mac/jdkbinary/j2sdk-image/Contents/Home/lib/default/libj9vm29.dylib
[2024-10-28T15:31:10.892Z] HHLT stderr Module_base_address=0000000105220000 Symbol=_ZN26VM_BytecodeInterpreterFull3runEP10J9VMThread
[2024-10-28T15:31:10.892Z] HHLT stderr Symbol_address=000000010528F900
[2024-10-28T15:31:10.892Z] HHLT stderr Target=2_90_20241015_681 (Mac OS X 14.2.1)
[2024-10-28T15:31:10.892Z] HHLT stderr CPU=aarch64 (8 logical CPUs) (0x400000000 RAM)
[2024-10-28T15:31:10.892Z] HHLT stderr ----------- Stack Backtrace -----------

[2024-10-28T15:31:38.765Z] HeapHogLoadTest_5m_0_FAILED

50x grinder - passed

@knn-k
Copy link
Contributor

knn-k commented Jan 10, 2025

One more 40x Grinder on AIX: https://openj9-jenkins.osuosl.org/job/Grinder/4057/
No failures.

@JasonFengJ9
Copy link
Member

JasonFengJ9 commented Jan 10, 2025

openjdk17_j9_extended.system_aarch64_mac(macaarch64rt11)

[2025-01-04T18:39:33.550Z] variation: Mode110
[2025-01-04T18:39:33.550Z] JVM_OPTIONS:  -Xjit -Xgcpolicy:gencon -Xnocompressedrefs 

[2025-01-04T18:41:59.283Z] HHLT 10:41:55.864 - Completed 46.7%. Number of tests started=449318 (+69946)
[2025-01-04T18:42:16.585Z] HHLT stderr Unhandled exception
[2025-01-04T18:42:16.585Z] HHLT stderr Type=Segmentation error vmState=0x00000000
[2025-01-04T18:42:16.585Z] HHLT stderr J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002
[2025-01-04T18:42:16.585Z] HHLT stderr Handler1=00000001026D6B24 Handler2=0000000102584D80 InaccessibleAddress=6D726F6674616C98
[2025-01-04T18:42:16.585Z] HHLT stderr Unhandled exception
[2025-01-04T18:42:16.585Z] HHLT stderr Type=Segmentation error vmState=0x00000000
[2025-01-04T18:42:16.585Z] HHLT stderr Unhandled exception
[2025-01-04T18:42:16.585Z] HHLT stderr Type=Segmentation error vmState=0x00000000
[2025-01-04T18:42:16.585Z] HHLT stderr x0=000000012F0E2700 x1=000000012F0E2700 x2=00000003DCE4E8D8 x3=000000016E96E820
[2025-01-04T18:42:16.585Z] HHLT stderr x4=000000016E96E7D8 x5=000000016E96E7C8 x6=000000016E96E7C0 x7=000000016E96E7B8
[2025-01-04T18:42:16.585Z] HHLT stderr x8=6D726F6674616C90 x9=00000003D5C9BF48 x10=000000016E96E7C0 x11=000000016E96E7C8
[2025-01-04T18:42:16.585Z] HHLT stderr x12=000000016E96E7D8 x13=000000016E96E7B0 x14=0000000102721360 x15=0000000000000010
[2025-01-04T18:42:16.585Z] HHLT stderr x16=0000000102720ED8 x17=0000000000000000 x18=000000016E96E101 x19=0000000040000000
[2025-01-04T18:42:16.585Z] HHLT stderr x20=6D726F6674616C70 x21=000000016E96E7B0 x22=0000000111EA4AC4 x23=000000016E96E7C0
[2025-01-04T18:42:16.585Z] HHLT stderr x24=000000016E96E7D8 x25=000000016E96E7C8 x26=000000016E96E7C0 x27=000000016E96E7B8
[2025-01-04T18:42:16.585Z] HHLT stderr x28=00000001027FEE24 x29(FP)=000000016E96E7A0 x30(LR)=0000000102720ECC x31(SP)=000000016E96E520
[2025-01-04T18:42:16.585Z] HHLT stderr J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002
[2025-01-04T18:42:16.585Z] HHLT stderr Handler1=00000001026D6B24 Handler2=0000000102584D80 InaccessibleAddress=0000000000000018
[2025-01-04T18:42:16.585Z] HHLT stderr PC=00000001027371CC SP=000000016E96E520
[2025-01-04T18:42:16.585Z] HHLT stderr x0=000000012F0F1900 x1=000000012F0F1900 x2=00000003DCF7CD88 x3=000000016E9BA820
[2025-01-04T18:42:16.585Z] HHLT stderr x4=000000016E9BA7D8 x5=000000016E9BA7C8 x6=000000016E9BA7C0 x7=000000016E9BA7B8
[2025-01-04T18:42:16.585Z] HHLT stderr x8=0000000000000000 x9=0000000000000018 x10=000000016E9BA7C0 x11=000000016E9BA7C8
[2025-01-04T18:42:16.585Z] HHLT stderr x12=000000016E9BA7D8 x13=000000016E9BA7B0 x14=0000000102721360 x15=0000000000000010
[2025-01-04T18:42:16.585Z] HHLT stderr x16=0000000102720ED8 x17=0000000000000000 x18=000000012F119748 x19=0000000040000000
[2025-01-04T18:42:16.585Z] HHLT stderr x20=000000015801A4B8 x21=000000016E9BA7B0 x22=0000000111EA4AC4 x23=000000016E9BA7C0
[2025-01-04T18:42:16.585Z] HHLT stderr x24=000000016E9BA7D8 x25=000000016E9BA7C8 x26=000000016E9BA7C0 x27=000000016E9BA7B8
[2025-01-04T18:42:16.585Z] HHLT stderr x28=00000001027FEE24 x29(FP)=000000016E9BA7A0 x30(LR)=0000000102720ECC x31(SP)=000000016E9BA520
[2025-01-04T18:42:16.585Z] HHLT stderr PC=00000001027371D8 SP=000000016E9BA520

[2025-01-04T18:42:46.482Z] HeapHogLoadTest_5m_0_FAILED

50x internal grinder - 13/50 failed

@knn-k
Copy link
Contributor

knn-k commented Jan 14, 2025

Failure rate in the previous comment (13/50) is much higher than before.

I ran these Grinder jobs using binaries from weekly tests:

Version outputs:

[20250114 binary for macOS]
Eclipse OpenJ9 VM 17.0.14+6-202501041533 (build master-b0ab9a37c2, JRE 17 Mac OS X aarch64-64-Bit 20250104_735 (JIT enabled, AOT enabled)
OpenJ9   - b0ab9a37c2
OMR      - 3ddaad3c1
JCL      - a14738d7dd based on jdk-17.0.14+6)

[20250111 binary for macOS]
Eclipse OpenJ9 VM 17.0.14+6-202501111533 (build master-e0743f2495, JRE 17 Mac OS X aarch64-64-Bit 20250111_740 (JIT enabled, AOT enabled)
OpenJ9   - e0743f2495
OMR      - 9e718a6f9
JCL      - cbb8509130 based on jdk-17.0.14+6)

[20250111 binary for Linux]
Eclipse OpenJ9 VM 17.0.14+6-202501111534 (build master-e0743f2495, JRE 17 Linux aarch64-64-Bit Compressed References 20250111_848 (JIT enabled, AOT enabled)
OpenJ9   - e0743f2495
OMR      - 9e718a6f9
JCL      - cbb8509130 based on jdk-17.0.14+6)

@knn-k
Copy link
Contributor

knn-k commented Jan 15, 2025

I ran two other Grinder jobs with a change in #19081 (comment) that disables the optimization for MethodHandle.linkToVirtual(). No failure in 80x runs in total on macOS.
https://hyc-runtimes-jenkins.swg-devops.com/job/Grinder/46461/
https://hyc-runtimes-jenkins.swg-devops.com/job/Grinder/46488/

@knn-k
Copy link
Contributor

knn-k commented Jan 16, 2025

Eclipse OpenJ9 VM 17.0.14+6-202412281534 (build master-9838ac7fa8, JRE 17 Mac OS X aarch64-64-Bit 20241228_730 (JIT enabled, AOT enabled)
OpenJ9   - 9838ac7fa8
OMR      - 3ddaad3c1
JCL      - a93e26b49b based on jdk-17.0.14+6)

@hzongaro
Copy link
Member

@nbhuiyan, may I ask you to help @knn-k with the investigation of this problem? I'm going to push it out of 0.51 for now, as you have higher priority items that you're working on, and then we can schedule it for the next release that will include all versions.

@knn-k
Copy link
Contributor

knn-k commented Jan 20, 2025

@nbhuiyan Any suggestion for what to try for investigating this problem?

Summary of the current status:

  • High failure rate on AArch64 macOS
  • Less frequent on AArch64 Linux
  • There is one failure case on AIX, but it is not clear if that is the same problem or not
  • The problem disappears when you disable the optimization for MethodHandle.linkToVirtual() by knn-k@6b5ad9b
  • You can also stop the crashes by -Xjit:{java/lang/invoke/LambdaForm*.invokeVirtual*}(disableRecognizedCallTransformer)

@nbhuiyan
Copy link
Member

@knn-k Any suggestion for what to try for investigating this problem?

It seems like some of the assumptions made in RecognizedCallTransformer regarding the linkToVirtual may have been incorrect when it comes to these failing tests. Do you have any JIT logs of the compilation of top level methods from the failure call stack such as testChar? My immediate next step is to attempt to reproduce this locally to be able to trace the outcome of the transformation in question.

@knn-k
Copy link
Contributor

knn-k commented Jan 23, 2025

I shared some trace files, javacore files, and a jitdump file with @nbhuiyan via internal file sharing.
I got the trace files by running the test in my local macOS environment with export OPENJ9_JAVA_OPTIONS="-Xjit:{java/lang/invoke/LambdaForm*.invokeVirtual*}(traceFull,log=invokeV.txt)".

@nbhuiyan
Copy link
Member

nbhuiyan commented Jan 30, 2025

I have been able to reproduce this locally. Having examined some of my locally generated core dumps, I was first looking for what may be platform-specific that could explain why this issue was only showing up on aarch64, and I found that there may have been involvement of some FFI call that could have gone wrong. Upon further investigation, I realized I was headed down the wrong path and the issue seemed to be within the invokeBasic bytecode handler.

In my local setup, here is the Java call stack of a crash:

1XMCURTHDINFO  Current thread
3XMTHREADINFO      "load-1" J9VMThread:0x000000014D986300,
...
3XMTHREADINFO3           Java callstack:
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NFI/0x0000000003c27e90.invoke_L3_L(LambdaForm$NFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$DMH/0x000000004d046e20.invokeStatic(LambdaForm$DMH(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$NamedFunction.invokeWithArguments(LambdaForm.java:1179(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretName(LambdaForm.java:964(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm.interpretWithArguments(LambdaForm.java:941(Compiled Code))
4XESTACKTRACE                at java/lang/invoke/LambdaForm$LFI/0x000000003a713ca0.interpret_F(LambdaForm$LFI)
4XESTACKTRACE                at java/lang/invoke/LambdaForm$MH/0x000000003a873420.invokeExact_MT(LambdaForm$MH(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/AsTypeTest.testConvertShort(AsTypeTest.java:2147(Compiled Code))
4XESTACKTRACE                at net/adoptopenjdk/test/lang/invoke/AsTypeTest.testShort(AsTypeTest.java:874(Compiled Code))

Topmost method where the crash occurs is interpreted. I also encounter a corrupt data issue while reading this:

> !stackslots 0x000000014D986300
<14d986300> *** BEGIN STACK WALK, flags = 00400001 walkThread = 5,596,799,744 ***
<14d986300> 	ITERATE_O_SLOTS
<14d986300> 	RECORD_BYTECODE_PC_OFFSET
<14d986300> Initial values: walkSP = 0x000000013A838FD0, PC = 0x0000000103C27F8E, literals = 0x000000013A825148, A0 = 0x000000013A8390B8, j2iFrame = 0x000000013A8390A8, decomp = 0x0000000000000000
<14d986300> J2I frame: bp = 0x000000013A8390A8, sp = 0x000000013A838FD0, pc = 0x0000000103C27F8E, cp = 0x000000013A8250C0, arg0EA = 0x000000013A8390B8, flags = 0x0000000010000000
<14d986300> 	Method: java/lang/invoke/LambdaForm$NFI/0x0000000003c27e90.invoke_L3_L(Ljava/lang/invoke/MethodHandle;[Ljava/lang/Object;)Ljava/lang/Object; !j9method 0x000000013A825148
<14d986300> 	Bytecode index = 10
<14d986300> 	Using local mapper
<14d986300> 	Locals starting at 0x000000013A8390B8 for 0x0000000000000002 slots
<14d986300> 		I-Slot: a0[0x000000013A8390B8] = 0x0000000300134C60
<14d986300> 		I-Slot: a1[0x000000013A8390B0] = 0x00000004C001BA18
Jan. 29, 2025 5:15:03 P.M. com.ibm.j9ddr.vm29.events.DefaultEventListener corruptData
WARNING: CorruptData encountered iterating o-slots. walkThread = 0x000000014D986300

Bytecode index 10 of the method above is an invokeBasic call:

> !bytecodes 0x000000013A825148
  Name: invoke_L3_L
  Signature: (Ljava/lang/invoke/MethodHandle;[Ljava/lang/Object;)Ljava/lang/Object;
  Access Flags (21080008): default static
  Internal Attribute Flags: @FrameIteratorSkip
  Max Stack: 5
  Argument Count: 2
  Temp Count: 0

    0 aload0
    1 aload1
    2 iconst0
    3 aaload
    4 aload1
    5 iconst1
    6 aaload
    7 aload1
    8 iconst2
    9 aaload
   10 invokevirtual 4 java/lang/invoke/MethodHandle.invokeBasic(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
   13 return1

The caller of that interpreted method invoke_L3_L is invokeStatic, which is compiled:

<14d986300> JIT frame: bp = 0x000000013A8390D8, pc = 0x000000011706D35C, unwindSP = 0x000000013A8390B0, cp = 0x000000014D0512C0, arg0EA = 0x000000013A8390F0, jitInfo = 0x00000005081B9768
<14d986300> 	Method: java/lang/invoke/LambdaForm$DMH/0x000000004d046e20.invokeStatic(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; !j9method 0x000000014D0513C8
<14d986300> 	Bytecode index = 11, inlineDepth = 0, PC offset = 0x00000000000000D4
<14d986300> 	stackMap=0x00000005081B9881, slots=I16(0x0003) parmBaseOffset=I16(0x0008), parmSlots=U16(0x0003), localBaseOffset=I16(0x0000)
<14d986300> 	Described JIT args starting at 0x000000013A8390E0 for U16(0x0003) slots
<14d986300> 		I-Slot: : a2[0x000000013A8390E0] = 0x00000004C001B7A8
<14d986300> 		I-Slot: : a1[0x000000013A8390E8] = 0x00000004C001B6B8
<14d986300> 		O-Slot: : a0[0x000000013A8390F0] = 0x00000003003E7D30
<14d986300> 	Described JIT temps starting at 0x000000013A8390D8 for IDATA(0x0000000000000000) slots

invokeStatic contains a call to linkToStatic which would have been avoided and instead called through a computed call mechanism if the call target was compiled. Since invoke_L3_L was not compiled, we take the slow path of calling linkToStatic, verified through JIT logs as well as the JIT dumps shared by @knn-k .

> !bytecodes 0x000000014D0513C8
  Name: invokeStatic
  Signature: (Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
  Access Flags (21080008): default static
  Internal Attribute Flags: @FrameIteratorSkip
  Max Stack: 3
  Argument Count: 3
  Temp Count: 1

    0 aload0
    1 invokestatic 6 java/lang/invoke/DirectMethodHandle.internalMemberName(Ljava/lang/Object;)Ljava/lang/Object;
    4 astore3
    5 aload1
    6 aload2
    7 aload3
    8 checkcast 7 java/lang/invoke/MemberName
   11 invokestatic 9 java/lang/invoke/MethodHandle.linkToStatic(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/invoke/MemberName;)Ljava/lang/Object;
   14 return1

Prior to dispatching into linkToStatic, we would store the number of stack slots to J9VMThread.tempSlot, and set J9VMThread.floatTemp1 to -1:

n148n     lstore  j9VMThreadTempSlotField[#338  MethodMeta +232] [flags 0x207 0x0 ]           [       0x114139e00] bci=[-1,11,-] rc=0 vc=0 vn=- li=- udi=- nc=1
n147n       lconst 3 (highWordZero X!=0 X>=0 )                                                [       0x114139db0] bci=[-1,11,-] rc=1 vc=0 vn=- li=- udi=- nc=0 flg=0x4104
n150n     lstore  j9VMThreadFloatTemp1[#340  MethodMeta +248] [flags 0x207 0x0 ]              [       0x114139ea0] bci=[-1,11,-] rc=0 vc=0 vn=- li=- udi=- nc=1
n149n       lconst -1 (X!=0 X<=0 )                                                            [       0x114139e50] bci=[-1,11,-] rc=1 vc=0 vn=- li=- udi=- nc=0 flg=0x204
n90n      treetop                                                                             [       0x114138be0] bci=[-1,11,-] rc=0 vc=636 vn=- li=6 udi=- nc=1
n62n        acall  java/lang/invoke/MethodHandle.linkToStatic(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/invoke/MemberName;)Ljava/lang/Object;[#357  native static Method] (Abstract class) [flags 0x500 0x0 ] ()  [       0x114138320] bci=[-1,11,-] rc=3 vc=636 vn=- li=6 udi=- nc=3 flg=0x20
n130n         ==>aRegLoad
n129n         ==>aRegLoad
n128n         ==>aRegLoad

Coming back to invoke_L3_L being interpreted, we eventually get to bytecode 10, which gets us to

invokeBasic(REGISTER_ARGS_LIST)
{
VM_BytecodeAction rc = GOTO_RUN_METHOD;
bool fromJIT = J9_ARE_ANY_BITS_SET(jitStackFrameFlags(REGISTER_ARGS, 0), J9_SSF_JIT_NATIVE_TRANSITION_FRAME);
UDATA mhReceiverIndex = 0;
if (fromJIT) {
/* tempSlot contains the number of stack slots for the arguments, and the MH
* receiver is the first argument.
*/
mhReceiverIndex = _currentThread->tempSlot - 1;

If we took the fromJIT path above, we would end up with an access of the stack outside of its bounds, given that these are the following values we have in the J9VMThread struct:


> !j9vmthread 0x14d986300
J9VMThread at 0x14d986300 {
  Fields for J9VMThread:
	0x0: struct JNINativeInterface_* functions = !jninativeinterface_ 0x00000001031E5AD8
	0x8: struct J9JavaVM* javaVM = !j9javavm 0x000000014D817620
........
	0xe8: UDATA tempSlot = 0xFFFFFFFFFFFFFFA8 (-88)
	0xf0: void* jitReturnAddress = !j9x 0x00000001170EEB70
	0xf8: void* floatTemp1 = !j9x 0xFFFFFFFFFFFFFFFF

Notice how the floatTemp1 field is still -1, which is a remnant of what the jitted code set prior to the linkToStatic call. However, the tempSlot field holds a value that would not have been set by the compiled code. It was likely overwritten by some other user of tempSlot. The invokeBasic call may have determined that we arrived there directly from the JIT based on the state of J9_SSF_JIT_NATIVE_TRANSITION_FRAME flag, which may not have been reset prior to the invokeBasic INL call. This then results in the invalid mhReceiverIndex calculated, with an invalid stack slot being deferenced as a result, resulting in a segfault. I think a similar issue was seen in the past and discussed in #16741. #17244 was a fix for that issue, attempting to reset the state of that flag as soon as possible after use, but I don't think it would cover this specific situation. @babsingh FYI, since we were involved in that issue.

I still do not know why disabling recognized call transformer or disabling just linkToVirtual transformer fixes this issue. I also do not know why this problem is only seen in aarch64.

@nbhuiyan
Copy link
Member

Last week I worked with @babsingh to try and determine the exact location of the segfault origin in the bytecode interpreter using some of the core files generated from my local setup. Unfortunately, we could not obtain that information from those cores. Therefore, we decided to re-run with -XX:+DebugInterpreter or use print statements in the invokebasic handler to output messages when something went wrong. One of the places of interest was the part discussed in my last comment. The code I inserted was inside the following block, which would only run if J9_SSF_JIT_NATIVE_TRANSITION_FRAME was set:

		if (fromJIT) {
			/* tempSlot contains the number of stack slots for the arguments, and the MH
			 * receiver is the first argument.
			 */
			PORT_ACCESS_FROM_JAVAVM(_vm);
			if (_currentThread->tempSlot <= 0 || _currentThread->tempSlot > 500){
				PORT_ACCESS_FROM_JAVAVM(_vm);
				j9tty_printf(PORTLIB, "In invokebasic, about to compute receiver index, using unusual tempSlot value %d\n", _currentThread->tempSlot);
				buildJITResolveFrame(REGISTER_ARGS);
				j9tty_printf(PORTLIB, "buildJitResolveFrame Done\n");
				return THROW_NPE;
			}
			mhReceiverIndex = _currentThread->tempSlot - 1;
		} ...

I chose to return with THROW_NPE instead of trying to access the MH receiver using the calculated index with an unusual tempSlot value and running into a segfault. When running under fromJIT, if we really did arrive there from a JIT compiled code, the tempSlot value that the compiled code would set would be a positive value representing the number of stack slots occupied by the args. This additional check also manages to make the problem less reproducible. I got 1 failure out of a 100 iterations, and the failed test had the following output:

HHLT 00:31:24.125 - Load test completed
HHLT 00:31:24.125 -   Ran     : 335948
HHLT 00:31:24.126 -   Passed  : 335938
HHLT 00:31:24.126 -   Failed  : 10
HHLT 00:31:24.126 -   Result  : FAILED
HHLT 00:31:24.126 - Note that only the first 1 failures have been reported
HHLT stderr In invokebasic, about to compute receiver index, using unusual tempSlot value -88
HHLT stderr buildJitResolveFrame Done
...

This confirms the possible cause for the segfault I described towards the end of my previous comment, that the J9_SSF_JIT_NATIVE_TRANSITION_FRAME being a false positive would result in a bad access.

Other things I have tried since my last update:

  • Compared the compiled code generated for both a passing run and failing run for the compiled methods leading up to the call to the invokeBasic INL, and found no issues.
  • Reset the J9_SSF_JIT_NATIVE_TRANSITION_FRAME at various locations in the bytecode interpreter that I believed to be running prior to entry into the invokebasic INL function, but have not been able to prevent the failure through that.

Therefore, I think this issue requires investigation by the VM team to determine how we end up with the incorrect J9_SSF_JIT_NATIVE_TRANSITION_FRAME flag.

@hzongaro hzongaro added comp:vm and removed comp:jit labels Feb 11, 2025
@hzongaro
Copy link
Member

hzongaro commented Feb 11, 2025

@babsingh, given the results of the investigation with @nbhuiyan, will you continue investigating this or somebody else on the VM team?

@babsingh
Copy link
Contributor

J9_SSF_JIT_NATIVE_TRANSITION_FRAME is set in jitStackFrameFlags. In #17732, we simplified the use of jitStackFrameFlags, particularly how it is reset. @gacholio, can you think of any cases where this field might not be reset during re-entry into the interpreter? @nbhuiyan found a scenario in #19081 (comment) where the JIT flag is set in the field while invoking invokeBasic from an interpreted method.

@gacholio
Copy link
Contributor

jitStackFrameFlags is set to 0 on every entry into the interpreter (in the run function). It is only set to non-0 on JIT to interpreter transition, and in a few special cases in JNI native compilation. Try running with -Xjit:disabledirecttojni to eliminate the edge cases.

@nbhuiyan
Copy link
Member

Failure was reproducible with -Xjit:disableDirectToJNI. Grinder job link.

@gacholio
Copy link
Contributor

I'm fairly certain that this rules out the JNI paths, though it may be worth confirming that the command line option guarantees no call to initializeDirectJNI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
blocker comp:vm segfault Issues that describe segfaults / JVM crashes test failure
Projects
None yet
Development

No branches or pull requests

7 participants