Bug 1683095

Summary: [F30] java-11-openjdk intermittently FTBFS on i686 in G1 code due to a race condition
Product: [Fedora] Fedora Reporter: Severin Gehwolf <sgehwolf>
Component: java-11-openjdkAssignee: Severin Gehwolf <sgehwolf>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 30CC: jerboaa, jvanek
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Unspecified   
Whiteboard:
Fixed In Version: java-11-openjdk-11.0.3.7-5.fc31 java-11-openjdk-11.0.5.10-0.fc30 java-11-openjdk-11.0.5.10-0.fc29 java-11-openjdk-11.0.5.10-0.fc31 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1712370 (view as bug list) Environment:
Last Closed: 2019-10-21 16:29:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
hs_err.log file froma different build failure.
none
hs_err.log from javadoc reproducer from comment 3
none
gdb backtrace from a release build from a core file
none
hs_err #1
none
hs_err #2
none
hs_err #3
none
hs_err #4
none
hs_err #5
none
preprocessed C++ file for g1CollectedHeap.o none

Description Severin Gehwolf 2019-02-26 09:16:13 UTC
Description of problem:
We've seen various build failures for java-11-openjdk on i686 in rawhide (F31). The boot JDK 11 crashes with a SEGV like this:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf73418a5, pid=35039, tid=35258
#
# JRE version: OpenJDK Runtime Environment (11.0.2+7) (build 11.0.2+7)
# Java VM: OpenJDK Server VM (11.0.2+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5798a5]  HeapRegion::block_size(HeapWord const*) const+0x85
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to /builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/make/core.35039)
#
# An error report file with more information is saved as:
# /builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/make/hs_err_pid35039.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
BUILDSTDERR: /usr/bin/bash: line 1: 35039 Aborted                 (core dumped) /usr/lib/jvm/java-11-openjdk/bin/java -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto -Djava.awt.headless=true -Dextlink.spec.version=11 --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path /builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim -m jdk.javadoc.interim/jdk.javadoc.internal.tool.Main -d /builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/images/docs/api -use -keywords -notimestamp -serialwarn -encoding ISO-8859-1 -docencoding UTF-8 -breakiterator -splitIndex --system none -javafx --expand-requires transitive --override-methods=summary -tag beaninfo:X -tag revised:X -tag since.unbundled:X -tag spec:X -tag specdefault:X -tag Note:X -tag ToDo:X -tag 'apiNote:a:API Note:' -tag 'implSpec:a:Implementation Requirements:' -tag 'implNote:a:Implementation Note:' -tag param -tag return -tag throws -taglet build.tools.taglet.ModuleGraph -tag since -tag serialData -tag factory -tag see -tag 'jvms:a:See <cite>The Java&trade; Virtual Machine Specification</cite>:' -tag 'jls:a:See <cite>The Java&trade; Language Specification</cite>:' -taglet build.tools.taglet.ExtLink -taglet build.tools.taglet.Incubating -tagletpath /builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/buildtools/jdk_tools_classes --module-source-path "/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/src/*/share/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/support/rmic/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/src/*/share/doc/stub" --module java.se,java.smartcardio,jdk.accessibility,jdk.attach,jdk.charsets,jdk.compiler,jdk.crypto.cryptoki,jdk.crypto.ec,jdk.dynalink,jdk.editpad,jdk.hotspot.agent,jdk.httpserver,jdk.jartool,jdk.javadoc,jdk.jcmd,jdk.jconsole,jdk.jdeps,jdk.jdi,jdk.jdwp.agent,jdk.jfr,jdk.jlink,jdk.jshell,jdk.jsobject,jdk.jstatd,jdk.localedata,jdk.management,jdk.management.agent,jdk.management.jfr,jdk.naming.dns,jdk.naming.rmi,jdk.net,jdk.pack,jdk.rmic,jdk.scripting.nashorn,jdk.sctp,jdk.security.auth,jdk.security.jgss,jdk.xml.dom,jdk.zipfs -Xdoclint:all,-accessibility,-html,-missing,-syntax,-reference -doctitle 'Java<sup>&reg;</sup> Platform, Standard Edition &amp;&nbsp;Java&nbsp;Development&nbsp;Kit<br>Version 11 API Specification' -windowtitle 'Java SE 11 & JDK 11 ' -header '<div style="margin-top: 14px;"><strong>Java SE 11 &amp; JDK 11</strong> </div>' -bottom '<a href="http://bugreport.java.com/bugreport/">Report a bug or suggest an enhancement</a><br> For further API reference and developer documentation see the <a href="http://www.oracle.com/pls/topic/lookup?ctx=javase11.0.2&amp;id=homepage" target="_blank">Java SE Documentation</a>, which contains more detailed, developer-targeted descriptions with conceptual overviews, definitions of terms, workarounds, and working code examples.<br> Java is a trademark or registered trademark of Oracle and/or its affiliates in the US and other countries.<br> <a href="{@docroot}/../legal/copyright.html">Copyright</a> &copy; 1993, 2019, Oracle and/or its affiliates, 500 Oracle Parkway, Redwood Shores, CA 94065 USA.<br>All rights reserved. Use is subject to <a href="http://www.oracle.com/technetwork/java/javase/terms/license/java11.0.2speclicense.html">license terms</a> and the <a href="http://www.oracle.com/technetwork/java/redist-137594.html">documentation redistribution policy</a>. <!-- Version 11.0.2+7 -->' -overview /builddir/build/BUILD/java-11-openjdk-11.0.2.7-5.fc31.i386/openjdk/build/support/docs/JDK_API-overview.html -group "Java SE" "java.base:java.compiler:java.datatransfer:java.desktop:java.instrument:java.logging:java.management:java.management.rmi:java.naming:java.net.http:java.prefs:java.rmi:java.scripting:java.se:java.security.jgss:java.security.sasl:java.sql:java.sql.rowset:java.transaction.xa:java.xml:java.xml.crypto" -group "JDK" "jdk.*" -quiet

Most recent failure:
https://koji.fedoraproject.org/koji/taskinfo?taskID=33043436

Unfortunately we don't have a deterministic reproducer just yet.

Comment 1 Severin Gehwolf 2019-02-26 09:18:55 UTC
Created attachment 1538713 [details]
hs_err.log file froma different build failure.

Comment 3 Severin Gehwolf 2019-02-26 15:48:59 UTC
One reproducer is to rebuild in a local i386 mock and then run something like this:

/usr/lib/jvm/java-11-openjdk/bin/java -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto -Djava.awt.headless=true -Dextlink.spec.version=11 --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim -m jdk.javadoc.interim/jdk.javadoc.internal.tool.Main -d /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/images/docs/api -use -keywords -notimestamp -serialwarn -encoding ISO-8859-1 -docencoding UTF-8 -breakiterator -splitIndex --system none -javafx --expand-requires transitive --override-methods=summary -tag beaninfo:X -tag revised:X -tag since.unbundled:X -tag spec:X -tag specdefault:X -tag Note:X -tag ToDo:X -tag 'apiNote:a:API Note:' -tag 'implSpec:a:Implementation Requirements:' -tag 'implNote:a:Implementation Note:' -tag param -tag return -tag throws -taglet build.tools.taglet.ModuleGraph -tag since -tag serialData -tag factory -tag see -tag 'jvms:a:See <cite>The Java&trade; Virtual Machine Specification</cite>:' -tag 'jls:a:See <cite>The Java&trade; Language Specification</cite>:' -taglet build.tools.taglet.ExtLink -taglet build.tools.taglet.Incubating -tagletpath /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/buildtools/jdk_tools_classes --module-source-path "/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/share/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/support/rmic/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/share/doc/stub" --module java.se,java.smartcardio,jdk.accessibility,jdk.attach,jdk.charsets,jdk.compiler,jdk.crypto.cryptoki,jdk.crypto.ec,jdk.dynalink,jdk.editpad,jdk.hotspot.agent,jdk.httpserver,jdk.jartool,jdk.javadoc,jdk.jcmd,jdk.jconsole,jdk.jdeps,jdk.jdi,jdk.jdwp.agent,jdk.jfr,jdk.jlink,jdk.jshell,jdk.jsobject,jdk.jstatd,jdk.localedata,jdk.management,jdk.management.agent,jdk.management.jfr,jdk.naming.dns,jdk.naming.rmi,jdk.net,jdk.pack,jdk.rmic,jdk.scripting.nashorn,jdk.sctp,jdk.security.auth,jdk.security.jgss,jdk.xml.dom,jdk.zipfs -Xdoclint:all,-accessibility,-html,-missing,-syntax,-reference -doctitle 'Java<sup>&reg;</sup> Platform, Standard Edition &amp;&nbsp;Java&nbsp;Development&nbsp;Kit<br>Version 11 API Specification' -windowtitle 'Java SE 11 & JDK 11 ' -header '<div style="margin-top: 14px;"><strong>Java SE 11 &amp; JDK 11</strong> </div>' -bottom '<a href="http://bugreport.java.com/bugreport/">Report a bug or suggest an enhancement</a><br> For further API reference and developer documentation see the <a href="http://www.oracle.com/pls/topic/lookup?ctx=javase11.0.2&amp;id=homepage" target="_blank">Java SE Documentation</a>, which contains more detailed, developer-targeted descriptions with conceptual overviews, definitions of terms, workarounds, and working code examples.<br> Java is a trademark or registered trademark of Oracle and/or its affiliates in the US and other countries.<br> <a href="{@docroot}/../legal/copyright.html">Copyright</a> &copy; 1993, 2019, Oracle and/or its affiliates, 500 Oracle Parkway, Redwood Shores, CA 94065 USA.<br>All rights reserved. Use is subject to <a href="http://www.oracle.com/technetwork/java/javase/terms/license/java11.0.2speclicense.html">license terms</a> and the <a href="http://www.oracle.com/technetwork/java/redist-137594.html">documentation redistribution policy</a>. <!-- Version 11.0.2+7 -->' -overview /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/support/docs/JDK_API-overview.html -group "Java SE" "java.base:java.compiler:java.datatransfer:java.desktop:java.instrument:java.logging:java.management:java.management.rmi:java.naming:java.net.http:java.prefs:java.rmi:java.scripting:java.se:java.security.jgss:java.security.sasl:java.sql:java.sql.rowset:java.transaction.xa:java.xml:java.xml.crypto" -group "JDK" "jdk.*" -verbose

In my case I had to run this in a loop to reproduce (100 iterations triggered it for me).

Comment 4 Severin Gehwolf 2019-02-26 15:50:35 UTC
Created attachment 1538895 [details]
hs_err.log from javadoc reproducer from comment 3

Comment 5 Severin Gehwolf 2019-02-26 16:07:54 UTC
<mock-chroot> sh-5.0# for i in $(seq 100); do /usr/lib/jvm/java-11-openjdk/bin/java -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto -Djava.awt.headless=true -Dextlink.spec.version=11 --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim -m jdk.javadoc.interim/jdk.javadoc.internal.tool.Main -d /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/images/docs/api -use -keywords -notimestamp -serialwarn -encoding ISO-8859-1 -docencoding UTF-8 -breakiterator -splitIndex --system none -javafx --expand-requires transitive --override-methods=summary -tag beaninfo:X -tag revised:X -tag since.unbundled:X -tag spec:X -tag specdefault:X -tag Note:X -tag ToDo:X -tag 'apiNote:a:API Note:' -tag 'implSpec:a:Implementation Requirements:' -tag 'implNote:a:Implementation Note:' -tag param -tag return -tag throws -taglet build.tools.taglet.ModuleGraph -tag since -tag serialData -tag factory -tag see -tag 'jvms:a:See <cite>The Java&trade; Virtual Machine Specification</cite>:' -tag 'jls:a:See <cite>The Java&trade; Language Specification</cite>:' -taglet build.tools.taglet.ExtLink -taglet build.tools.taglet.Incubating -tagletpath /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/buildtools/jdk_tools_classes --module-source-path "/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/share/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/support/rmic/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/*/share/doc/stub" --module java.se,java.smartcardio,jdk.accessibility,jdk.attach,jdk.charsets,jdk.compiler,jdk.crypto.cryptoki,jdk.crypto.ec,jdk.dynalink,jdk.editpad,jdk.hotspot.agent,jdk.httpserver,jdk.jartool,jdk.javadoc,jdk.jcmd,jdk.jconsole,jdk.jdeps,jdk.jdi,jdk.jdwp.agent,jdk.jfr,jdk.jlink,jdk.jshell,jdk.jsobject,jdk.jstatd,jdk.localedata,jdk.management,jdk.management.agent,jdk.management.jfr,jdk.naming.dns,jdk.naming.rmi,jdk.net,jdk.pack,jdk.rmic,jdk.scripting.nashorn,jdk.sctp,jdk.security.auth,jdk.security.jgss,jdk.xml.dom,jdk.zipfs -Xdoclint:all,-accessibility,-html,-missing,-syntax,-reference -doctitle 'Java<sup>&reg;</sup> Platform, Standard Edition &amp;&nbsp;Java&nbsp;Development&nbsp;Kit<br>Version 11 API Specification' -windowtitle 'Java SE 11 & JDK 11 ' -header '<div style="margin-top: 14px;"><strong>Java SE 11 &amp; JDK 11</strong> </div>' -bottom '<a href="http://bugreport.java.com/bugreport/">Report a bug or suggest an enhancement</a><br> For further API reference and developer documentation see the <a href="http://www.oracle.com/pls/topic/lookup?ctx=javase11.0.2&amp;id=homepage" target="_blank">Java SE Documentation</a>, which contains more detailed, developer-targeted descriptions with conceptual overviews, definitions of terms, workarounds, and working code examples.<br> Java is a trademark or registered trademark of Oracle and/or its affiliates in the US and other countries.<br> <a href="{@docroot}/../legal/copyright.html">Copyright</a> &copy; 1993, 2019, Oracle and/or its affiliates, 500 Oracle Parkway, Redwood Shores, CA 94065 USA.<br>All rights reserved. Use is subject to <a href="http://www.oracle.com/technetwork/java/javase/terms/license/java11.0.2speclicense.html">license terms</a> and the <a href="http://www.oracle.com/technetwork/java/redist-137594.html">documentation redistribution policy</a>. <!-- Version 11.0.2+7 -->' -overview /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/build/support/docs/JDK_API-overview.html -group "Java SE" "java.base:java.compiler:java.datatransfer:java.desktop:java.instrument:java.logging:java.management:java.management.rmi:java.naming:java.net.http:java.prefs:java.rmi:java.scripting:java.se:java.security.jgss:java.security.sasl:java.sql:java.sql.rowset:java.transaction.xa:java.xml:java.xml.crypto" -group "JDK" "jdk.*" -verbose; retval=$?; echo "Iteration $i"; if [ $retval -ne 0 ]; then break; fi; done

...

[parsing completed 1ms]
[loading /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/java.management/share/classes/sun/management/LockInfoCompositeData.java]
[parsing started DirectoryFileObject[/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/java.management/share/classes:sun/management/LockInfoCompositeData.java]]
[parsing completed 0ms]
[loading /builddir/build/BUILD/j#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf72eb8a5, pid=1838, tid=1860
#
# JRE version: OpenJDK Runtime Environment (11.0.2+7) (build 11.0.2+7)
# Java VM: OpenJDK Server VM (11.0.2+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5798a5]  HeapRegion::block_size(HeapWord const*) const+0x85
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to //core.1838)
#
# An error report file with more information is saved as:
# //hs_err_pid1838.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)
Iteration 12

Comment 6 Severin Gehwolf 2019-02-27 10:31:35 UTC
Created attachment 1539124 [details]
gdb backtrace from a release build from a core file

Not sure how helpful this is.

Comment 8 Severin Gehwolf 2019-02-27 19:18:31 UTC
Created attachment 1539255 [details]
hs_err #1

Comment 9 Severin Gehwolf 2019-02-27 19:18:59 UTC
Created attachment 1539256 [details]
hs_err #2

Comment 10 Severin Gehwolf 2019-02-27 19:19:52 UTC
Created attachment 1539257 [details]
hs_err #3

Comment 11 Severin Gehwolf 2019-02-27 19:20:16 UTC
Created attachment 1539258 [details]
hs_err #4

Comment 12 Severin Gehwolf 2019-02-27 19:20:40 UTC
Created attachment 1539266 [details]
hs_err #5

Comment 13 Severin Gehwolf 2019-03-05 13:45:07 UTC
When configuring with the distro C flags like [1] and then compiling at level INFO I get this worrisome warning:

In file included from /openjdk-11/src/hotspot/share/asm/assembler.hpp:454,
                 from /openjdk-11/src/hotspot/share/precompiled/precompiled.hpp:31:
/openjdk-11/src/hotspot/cpu/x86/assembler_x86.hpp: In member function 'virtual void jumpXtndNode::emit(CodeBuffer&, PhaseRegAlloc*) const':
/openjdk-11/src/hotspot/cpu/x86/assembler_x86.hpp:467:78: warning: 'index.Address::_rspec.RelocationHolder::_relocbuf[2]' is used uninitialized in this function [-Wuninitialized]
  467 |   ArrayAddress(AddressLiteral base, Address index): _base(base), _index(index) {};
      |                                                                              ^
/openjdk-11/src/hotspot/cpu/x86/x86_32.ad:12321:13: note: 'index.Address::_rspec.RelocationHolder::_relocbuf[2]' was declared here
12321 |     Address index(noreg, $switch_val$$Register, Address::times_1);
      |             ^~~~~
In file included from /openjdk-11/src/hotspot/share/asm/assembler.hpp:454,
                 from /openjdk-11/src/hotspot/share/precompiled/precompiled.hpp:31:
/openjdk-11/src/hotspot/cpu/x86/assembler_x86.hpp:467:78: warning: 'index.Address::_rspec.RelocationHolder::_relocbuf[3]' is used uninitialized in this function [-Wuninitialized]
  467 |   ArrayAddress(AddressLiteral base, Address index): _base(base), _index(index) {};
      |                                                                              ^
/openjdk-11/src/hotspot/cpu/x86/x86_32.ad:12321:13: note: 'index.Address::_rspec.RelocationHolder::_relocbuf[3]' was declared here
12321 |     Address index(noreg, $switch_val$$Register, Address::times_1);
      |             ^~~~~
In file included from /openjdk-11/src/hotspot/share/asm/assembler.hpp:454,
                 from /openjdk-11/src/hotspot/share/precompiled/precompiled.hpp:31:
/openjdk-11/src/hotspot/cpu/x86/assembler_x86.hpp:467:78: warning: 'index.Address::_rspec.RelocationHolder::_relocbuf[4]' is used uninitialized in this function [-Wuninitialized]
  467 |   ArrayAddress(AddressLiteral base, Address index): _base(base), _index(index) {};
      |                                                                              ^
/openjdk-11/src/hotspot/cpu/x86/x86_32.ad:12321:13: note: 'index.Address::_rspec.RelocationHolder::_relocbuf[4]' was declared here
12321 |     Address index(noreg, $switch_val$$Register, Address::times_1);
      |             ^~~~~


[1] bash configure --with-version-build=7 --with-version-pre= --with-version-opt= --with-vendor-version-string=18.9 --with-boot-jdk=/usr/lib/jvm/java-11-openjdk --with-debug-level=release --with-native-debug-symbols=internal --enable-unlimited-crypto --enable-system-nss --with-zlib=system --with-libjpeg=system --with-giflib=system --with-libpng=system --with-lcms=system --with-stdc++lib=dynamic '--with-extra-cxxflags=-g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS  -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -fno-delete-null-pointer-checks -fno-lifetime-dse' '--with-extra-cflags=-g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS  -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -Wno-error -fno-delete-null-pointer-checks -fno-lifetime-dse' '--with-extra-ldflags=-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' --with-num-cores=8 --disable-javac-server --disable-warnings-as-errors
    make images

Comment 14 Severin Gehwolf 2019-03-05 16:06:51 UTC
And there is another one:

/openjdk-11/src/hotspot/cpu/x86/macroAssembler_x86.cpp: In member function 'void MacroAssembler::serialize_memory(Register, Register)':
/openjdk-11/src/hotspot/cpu/x86/macroAssembler_x86.cpp:3734:11: warning: 'index.Address::_rspec.RelocationHolder::_relocbuf[2]' is used uninitialized in this function [-Wuninitialized]
 3734 |   Address index(noreg, tmp, Address::times_1);
      |           ^~~~~
/openjdk-11/src/hotspot/cpu/x86/macroAssembler_x86.cpp:3734:11: warning: 'index.Address::_rspec.RelocationHolder::_relocbuf[3]' is used uninitialized in this function [-Wuninitialized]
/openjdk-11/src/hotspot/cpu/x86/macroAssembler_x86.cpp:3734:11: warning: 'index.Address::_rspec.RelocationHolder::_relocbuf[4]' is used uninitialized in this function [-Wuninitialized]

Both of these only happen for "release" builds. "fastdebug" builds don't show this warning in my build log. Also, the javadoc reproducer doesn't crash on fastdebug either. What's more, I've also tried to reproduce the SEGV on a slowdebug build using the javadoc reproducer, without success.

Comment 15 Severin Gehwolf 2019-03-05 16:19:34 UTC
GCC commands to reproduce the warnings:

Warning from comment 13:

/usr/bin/g++ -I/openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/precompiled -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS -D_GNU_SOURCE -D_REENTRANT -pipe -fno-rtti -fno-exceptions -fvisibility=hidden -fno-strict-aliasing -fno-omit-frame-pointer -fcheck-new -fstack-protector -std=gnu++98 -DSUPPORTS_CLOCK_MONOTONIC -DLINUX -Wpointer-arith -Wsign-compare -Wunused-function -Wundef -Wformat=2 -Wunused-value -Woverloaded-virtual -Wreturn-type -fPIC -DVM_LITTLE_ENDIAN -march=i586 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wno-format-zero-length -Wtype-limits -Wuninitialized -m32 -g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -fno-delete-null-pointer-checks -fno-lifetime-dse -DPRODUCT -DTARGET_ARCH_x86 -DINCLUDE_SUFFIX_OS=_linux -DINCLUDE_SUFFIX_CPU=_x86 -DINCLUDE_SUFFIX_COMPILER=_gcc -DTARGET_COMPILER_gcc -DIA32 -DHOTSPOT_LIB_ARCH='"i386"' -DCOMPILER1 -DCOMPILER2 -DDTRACE_ENABLED -DINCLUDE_JVMCI=0 -DINCLUDE_AOT=0 -DINCLUDE_ZGC=0 -I/openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/gensrc/adfiles -I/openjdk-11/src/hotspot/share -I/openjdk-11/src/hotspot/os/linux -I/openjdk-11/src/hotspot/os/posix -I/openjdk-11/src/hotspot/cpu/x86 -I/openjdk-11/src/hotspot/os_cpu/linux_x86 -I/openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/gensrc -I/openjdk-11/src/hotspot/share/precompiled -I/openjdk-11/src/hotspot/share/include -I/openjdk-11/src/hotspot/os/posix/include -I/openjdk-11/build/linux-x86-normal-server-release/support/modules_include/java.base -I/openjdk-11/build/linux-x86-normal-server-release/support/modules_include/java.base/linux -I/openjdk-11/src/java.base/share/native/libjimage -m32 -g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -Wno-error -fno-delete-null-pointer-checks -fno-lifetime-dse -g -O3 -DTHIS_FILE='""' -c -MMD -MF /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/ad_x86.d -o /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/ad_x86.o /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/gensrc/adfiles/ad_x86.cpp

Warning from comment 14:

/usr/bin/g++ -I/openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/precompiled -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS -D_GNU_SOURCE -D_REENTRANT -pipe -fno-rtti -fno-exceptions -fvisibility=hidden -fno-strict-aliasing -fno-omit-frame-pointer -fcheck-new -fstack-protector -std=gnu++98 -DSUPPORTS_CLOCK_MONOTONIC -DLINUX -Wpointer-arith -Wsign-compare -Wunused-function -Wundef -Wformat=2 -Wunused-value -Woverloaded-virtual -Wreturn-type -fPIC -DVM_LITTLE_ENDIAN -march=i586 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wno-format-zero-length -Wtype-limits -Wuninitialized -m32 -g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -fno-delete-null-pointer-checks -fno-lifetime-dse -DPRODUCT -DTARGET_ARCH_x86 -DINCLUDE_SUFFIX_OS=_linux -DINCLUDE_SUFFIX_CPU=_x86 -DINCLUDE_SUFFIX_COMPILER=_gcc -DTARGET_COMPILER_gcc -DIA32 -DHOTSPOT_LIB_ARCH='"i386"' -DCOMPILER1 -DCOMPILER2 -DDTRACE_ENABLED -DINCLUDE_JVMCI=0 -DINCLUDE_AOT=0 -DINCLUDE_ZGC=0 -I/openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/gensrc/adfiles -I/openjdk-11/src/hotspot/share -I/openjdk-11/src/hotspot/os/linux -I/openjdk-11/src/hotspot/os/posix -I/openjdk-11/src/hotspot/cpu/x86 -I/openjdk-11/src/hotspot/os_cpu/linux_x86 -I/openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/gensrc -I/openjdk-11/src/hotspot/share/precompiled -I/openjdk-11/src/hotspot/share/include -I/openjdk-11/src/hotspot/os/posix/include -I/openjdk-11/build/linux-x86-normal-server-release/support/modules_include/java.base -I/openjdk-11/build/linux-x86-normal-server-release/support/modules_include/java.base/linux -I/openjdk-11/src/java.base/share/native/libjimage -m32 -g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -Wno-error -fno-delete-null-pointer-checks -fno-lifetime-dse -g -O3 -DTHIS_FILE='""' -c -MMD -MF /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/macroAssembler_x86.d -o /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/macroAssembler_x86.o /openjdk-11/src/hotspot/cpu/x86/macroAssembler_x86.cpp

# gcc --version
gcc (GCC) 9.0.1 20190209 (Red Hat 9.0.1-0.4)
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Comment 16 Severin Gehwolf 2019-03-27 09:25:43 UTC
Those warnings seem to be a red herring.

Comment 17 Severin Gehwolf 2019-03-27 09:27:11 UTC
Latest failed task:
https://koji.fedoraproject.org/koji/taskinfo?taskID=33780455

Comment 18 Severin Gehwolf 2019-03-28 18:46:48 UTC
Here is a summary as to what we know so far:

- Reproducer fails only with a product (release) type build.
  fastdebug and slowdebug builds seem OK.
- We don't see those failures in java-11-openjdk i686 F29 or
  F28.
- F30 has GCC 9.0.1. It seems to have started with GCC 9.

Those symptoms might point to a problem in hotspot where code is undefined behaviour. Or it might be a GCC bug.

I'm currently running the following reproducer (since -7 build) on a GCC 8.2.1 built JDK 11 as it fails with this on a GCC 9 built JDK 11 like so:

<mock-chroot> sh-5.0# for i in $(seq 100); do /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/images/jdk/bin/java -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim -m jdk.compiler.interim/com.sun.tools.javac.Main -g -source 11 -target 11 --doclint-format html5 -encoding ascii -XDignore.symbol.file=true -Xlint:all -Werror -Xdoclint:all/protected,-reference '-Xdoclint/package:java.*,javax.*' -XDstringConcat=inline --module-source-path "/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/*/share/classes" --module-path "" --system none -g -implicit:none -classpath /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/buildtools/depend -Xplugin:"depend /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/jdk/modules/java.base/_the.java.base_pubapi" -d /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/jdk/modules -h /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/support/headers.java.base.tmp @/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/jdk/modules/java.base/_the.java.base_batch.tmp; retval=$?; echo "iteration $i"; if [ $retval -ne 0 ]; then break; fi; done
iteration 1
iteration 2
iteration 3
iteration 4
iteration 5
iteration 6
iteration 7
iteration 8
iteration 9
iteration 10
iteration 11
iteration 12
iteration 13
iteration 14
iteration 15
iteration 16
iteration 17
iteration 18
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf73618b6, pid=902, tid=930
#
# JRE version: OpenJDK Runtime Environment (11.0.2+7) (build 11.0.2+7)
# Java VM: OpenJDK Server VM (11.0.2+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5ca8b6]  G1RemSet::refine_card_during_gc(signed char*, G1ScanObjsDuringUpdateRSClosure*) [clone .part.0]+0x176
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to //core.902)
#
# An error report file with more information is saved as:
# //hs_err_pid902.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)

Reproducer:

for i in $(seq 100); do /usr/lib/jvm/java-11-openjdk/bin/java -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim -m jdk.compiler.interim/com.sun.tools.javac.Main -g -source 11 -target 11 --doclint-format html5 -encoding ascii -XDignore.symbol.file=true -Xlint:all -Werror -Xdoclint:all/protected,-reference '-Xdoclint/package:java.*,javax.*' -XDstringConcat=inline --module-source-path "/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/*/share/classes" --module-path "" --system none -g -implicit:none -classpath /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/buildtools/depend -Xplugin:"depend /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/jdk/modules/java.base/_the.java.base_pubapi" -d /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/jdk/modules -h /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/support/headers.java.base.tmp @/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/bootcycle-build/jdk/modules/java.base/_the.java.base_batch.tmp; retval=$?; echo "iteration $i"; if [ $retval -ne 0 ]; then break; fi; done

Comment 19 Severin Gehwolf 2019-03-28 19:08:56 UTC
Speaking of undefined behaviour. I've instrumented the JVM with -fsanitize=undefined on i686 and got this list of issues:

/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/os_cpu/linux_x86/os_linux_x86.cpp:884:73: runtime error: pointer index expression with base 0x00000000 overflowed to 0xffffb000
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/utilities/utf8.cpp:471:11: runtime error: pointer index expression with base 0xed4dc54c overflowed to 0x6d4dc54b
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:1770:30: runtime error: signed integer overflow: 9223372036854775807 + 4 cannot be represented in type 'long long int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:1770:23: runtime error: signed integer overflow: 9223372036854775807 + 3 cannot be represented in type 'long long int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:2015:9: runtime error: signed integer overflow: -1409789926 + -1409789928 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:2128:26: runtime error: signed integer overflow: -1409789860 + -1409788704 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:4218:44: runtime error: signed integer overflow: -1409785792 + -2147483636 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/code/relocInfo.cpp:162:30: runtime error: pointer index expression with base 0x00000000 overflowed to 0xfffffffe
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:5316:40: runtime error: signed integer overflow: -1409432240 + -1409432120 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/code/relocInfo.hpp:570:13: runtime error: pointer index expression with base 0xfffffffe overflowed to 0x00000000
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:2935:42: runtime error: signed integer overflow: -567277728 + -2147483647 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/prims/unsafe.cpp:131:32: runtime error: pointer index expression with base 0x00000000 overflowed to 0xaa622560
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/prims/unsafe.cpp:131:32: runtime error: pointer index expression with base 0x00000000 overflowed to 0xaa6225b8
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/c1/c1_ValueMap.cpp:574:7: runtime error: load of value 224, which is not a valid value for type 'bool'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/prims/unsafe.cpp:131:32: runtime error: pointer index expression with base 0x00000000 overflowed to 0xaa659e20
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/prims/unsafe.cpp:131:32: runtime error: pointer index expression with base 0x00000000 overflowed to 0xaa659e20
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/code/vtableStubs.hpp:175:60: runtime error: load of value 255, which is not a valid value for type 'bool'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/mulnode.cpp:452:25: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/cpu/x86/c1_LIRAssembler_x86.cpp:267:81: runtime error: signed integer overflow: 2147483647 + 4 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/c1/c1_Canonicalizer.cpp:359:26: runtime error: shift exponent 32 is too large for 32-bit type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/prims/unsafe.cpp:131:32: runtime error: pointer index expression with base 0x00000000 overflowed to 0xf7f95c48
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/prims/unsafe.cpp:131:32: runtime error: pointer index expression with base 0x00000000 overflowed to 0xf7f95c48
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/mulnode.cpp:722:26: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/subnode.cpp:180:45: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/parse2.cpp:776:61: runtime error: signed integer overflow: 60 - -2147483648 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/mulnode.cpp:519:35: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/mulnode.cpp:1125:20: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
[loading /builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386//builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp:1770:19: runtime error: signed integer overflow: 9223372036854775807 + 9223372036854775807 cannot be represented in type 'long long int'
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/libadt/dict.cpp:339:12: runtime error: signed integer overflow: -1449879680 - 1484517232 cannot be represented in type 'int'

Looking at the first one:
/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/os_cpu/linux_x86/os_linux_x86.cpp:884:73: runtime error: pointer index expression with base 0x00000000 overflowed to 0xffffb000

We notice that this is actually wrong code running:

<mock-chroot> sh-5.0# /usr/lib/jvm/java-11-openjdk/bin/java -Xlog:os=info -version
[0.001s][info][os] Use of CLOCK_MONOTONIC is supported
[0.001s][info][os] Use of pthread_condattr_setclock is supported
[0.001s][info][os] Relative timed-wait using pthread_cond_timedwait is associated with CLOCK_MONOTONIC
[0.001s][info][os] [CS limit NX emulation work-around, exec code at: 0xffffb000]


Note the line: [CS limit NX emulation work-around, exec code at: 0xffffb000]. It seems one issue got introduced with JDK-8199717. Prior this bug Linux::capture_initial_stack(JavaThread::stack_size_at_create()) was called unconditionally. After it only when launched without the java launchers (embedded jvm). This is a problem as workaround_expand_exec_shield_cs_limit() in src/hotspot/os_cpu/linux_x86/os_linux_x86.cpp relies on Linux::initial_thread_stack_bottom() being set - via Linux::capture_initial_stack(). Since it's unset (NULL), the pointer arithmetic wraps around.

On JDK 8 (slowdebug) this looks like:
<mock-chroot> sh-5.0# java -XX:+PrintMiscellaneous -XX:+Verbose -version 2>&1 | grep 'CS limit NX'
[CS limit NX emulation work-around, exec code at: 0xffb21000]
<mock-chroot> sh-5.0# java -XX:+PrintMiscellaneous -XX:+Verbose -version 2>&1 | grep 'CS limit NX'
[CS limit NX emulation work-around, exec code at: 0xff76d000]
<mock-chroot> sh-5.0# java -XX:+PrintMiscellaneous -XX:+Verbose -version 2>&1 | grep 'CS limit NX'
[CS limit NX emulation work-around, exec code at: 0xff95e000]

Contrast this to JDK 11 (deterministic address):
<mock-chroot> sh-5.0# /usr/lib/jvm/java-11-openjdk/bin/java -Xlog:os=info -version 2>&1 | grep 'CS limit NX'
[0.002s][info][os] [CS limit NX emulation work-around, exec code at: 0xffffb000]
<mock-chroot> sh-5.0# /usr/lib/jvm/java-11-openjdk/bin/java -Xlog:os=info -version 2>&1 | grep 'CS limit NX'
[0.002s][info][os] [CS limit NX emulation work-around, exec code at: 0xffffb000]
<mock-chroot> sh-5.0# /usr/lib/jvm/java-11-openjdk/bin/java -Xlog:os=info -version 2>&1 | grep 'CS limit NX'
[0.002s][info][os] [CS limit NX emulation work-around, exec code at: 0xffffb000]

That's probably not the issue causing this, though, as the same code runs on F29 i686 for example.

Comment 20 Severin Gehwolf 2019-04-01 14:47:34 UTC
(In reply to Severin Gehwolf from comment #18)
> Here is a summary as to what we know so far:
> 
> - Reproducer fails only with a product (release) type build.
>   fastdebug and slowdebug builds seem OK.
> - We don't see those failures in java-11-openjdk i686 F29 or
>   F28.
> - F30 has GCC 9.0.1. It seems to have started with GCC 9.
> 
> Those symptoms might point to a problem in hotspot where code is undefined
> behaviour. Or it might be a GCC bug.
> 
> I'm currently running the following reproducer (since -7 build) on a GCC
> 8.2.1 built JDK 11 as it fails with this on a GCC 9 built JDK 11 like so:

Reproducer with a 8.2.1 GCC built JDK 11 seems to work OK. Thus, latest known working version is:

# rpm -q java-11-openjdk
java-11-openjdk-11.0.1.13-10.fc30.i686

java-11-openjdk-11.0.1.13-11.fc30 and better were built with GCC 9.

Comment 21 Severin Gehwolf 2019-04-08 11:51:20 UTC
This cannot be the -mstackrealign issue as redhat-rpm-config from F30 sets "%{optflags}", passed via extra C flags to configure of OpenJDK, to include -mstackrealign:

<mock-chroot> sh-5.0# rpm --eval '%{optflags}'
-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
<mock-chroot> sh-5.0# rpm -q redhat-rpm-config
redhat-rpm-config-128-1.fc30.noarch

From a failed OpenJDK build post GCC 9:

+ bash ../configure --with-version-build=7 --with-version-pre= --with-version-opt= --with-vendor-version-string=18.9 --with-boot-jdk=/usr/lib/jvm/java-11-openjdk --with-debug-level=release --with-native-debug-symbols=internal --enable-unlimited-crypto --enable-system-nss --with-zlib=system --with-libjpeg=system --with-giflib=system --with-libpng=system --with-lcms=system --with-stdc++lib=dynamic '--with-extra-cxxflags=-g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS  -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wa,--generate-missing-build-notes=yes' '--with-extra-cflags=-g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS  -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -Wno-error -fno-delete-null-pointer-checks -fno-lifetime-dse -Wa,--generate-missing-build-notes=yes' '--with-extra-ldflags=-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' --with-num-cores=8 --disable-javac-server --disable-warnings-as-errors

...

/usr/bin/g++ -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/hotspot/variant-server/libjvm/objs/precompiled -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS -D_GNU_SOURCE -D_REENTRANT -pipe -fno-rtti -fno-exceptions -fvisibility=hidden -fno-strict-aliasing -fno-omit-frame-pointer -fcheck-new -fstack-protector -std=gnu++98 -DSUPPORTS_CLOCK_MONOTONIC -DLINUX -Wpointer-arith -Wsign-compare -Wunused-function -Wundef -Wformat=2 -Wunused-value -Woverloaded-virtual -Wreturn-type -fPIC -DVM_LITTLE_ENDIAN -march=i586 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wno-format-zero-length -Wtype-limits -Wuninitialized -m32 -g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wa,--generate-missing-build-notes=yes -DPRODUCT -DTARGET_ARCH_x86 -DINCLUDE_SUFFIX_OS=_linux -DINCLUDE_SUFFIX_CPU=_x86 -DINCLUDE_SUFFIX_COMPILER=_gcc -DTARGET_COMPILER_gcc -DIA32 -DHOTSPOT_LIB_ARCH='"i386"' -DCOMPILER1 -DCOMPILER2 -DDTRACE_ENABLED -DINCLUDE_JVMCI=0 -DINCLUDE_AOT=0 -DINCLUDE_ZGC=0 -DSUPPORT_BARRIER_ON_PRIMITIVES -DSUPPORT_NOT_TO_SPACE_INVARIANT -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/hotspot/variant-server/gensrc/adfiles -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/share -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/os/linux -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/os/posix -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/cpu/x86 -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/os_cpu/linux_x86 -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/hotspot/variant-server/gensrc -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/share/precompiled -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/share/include -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/os/posix/include -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/support/modules_include/java.base -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/support/modules_include/java.base/linux -I/builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/java.base/share/native/libjimage -m32 -g -pipe -Wformat -Wno-cpp -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -std=gnu++98 -Wno-error -fno-delete-null-pointer-checks -fno-lifetime-dse -Wa,--generate-missing-build-notes=yes -g -O3 -DTHIS_FILE='""' -c -MMD -MF /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/hotspot/variant-server/libjvm/objs/type.d -o /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/build/hotspot/variant-server/libjvm/objs/type.o /builddir/build/BUILD/java-11-openjdk-11.0.2.7-7.fc30.i386/openjdk/src/hotspot/share/opto/type.cpp

Comment 22 Severin Gehwolf 2019-04-08 15:37:53 UTC
I've done the exercise and built java-11-openjdk-11.0.1.13-10.fc30.i686 with GCC 9 (gcc-9.0.1-0.10.fc30.i686) and it fails (note: GCC 8.x build was good):

<mock-chroot> sh-5.0# for i in $(seq 100); do /builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/images/jdk/bin/java -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto --limit-modules java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path /builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports java.base/jdk.internal.misc=jdk.compiler.interim -m jdk.compiler.interim/com.sun.tools.javac.Main -g -source 11 -target 11 --doclint-format html5 -encoding ascii -XDignore.symbol.file=true -Xlint:all -Werror -Xdoclint:all/protected,-reference '-Xdoclint/package:java.*,javax.*' -XDstringConcat=inline --module-source-path '/builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/bootcycle-build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/src/*/share/classes' --module-path '' --system none -g -implicit:none -classpath /builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/bootcycle-build/buildtools/depend '-Xplugin:depend /builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/bootcycle-build/jdk/modules/java.base/_the.java.base_pubapi' -d /builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/bootcycle-build/jdk/modules -h /builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/bootcycle-build/support/headers.java.base.tmp @/builddir/build/BUILD/java-11-openjdk-11.0.1.13-10.fc30.i386/openjdk/build/bootcycle-build/jdk/modules/java.base/_the.java.base_batch; retval=$?; echo "iteration $i"; if [ $retval -ne 0 ]; then break; fi; done
iteration 1
iteration 2
iteration 3
iteration 4
iteration 5
iteration 6
iteration 7
iteration 8
iteration 9
iteration 10
iteration 11
iteration 12
iteration 13
iteration 14
iteration 15
iteration 16
iteration 17
iteration 18
iteration 19
iteration 20
iteration 21
iteration 22
iteration 23
iteration 24
iteration 25
iteration 26
iteration 27
iteration 28
iteration 29
iteration 30
iteration 31
iteration 32
iteration 33
iteration 34
iteration 35
iteration 36
iteration 37
iteration 38
iteration 39
iteration 40
iteration 41
iteration 42
iteration 43
iteration 44
iteration 45
iteration 46
iteration 47
iteration 48
iteration 49
iteration 50
iteration 51
iteration 52
iteration 53
iteration 54
iteration 55
iteration 56
iteration 57
iteration 58
iteration 59
iteration 60
iteration 61
iteration 62
iteration 63
iteration 64
iteration 65
iteration 66
iteration 67
iteration 68
iteration 69
iteration 70
iteration 71
iteration 72
iteration 73
iteration 74
iteration 75
iteration 76
iteration 77
iteration 78
iteration 79
iteration 80
iteration 81
iteration 82
iteration 83
iteration 84
iteration 85
iteration 86
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf7376905, pid=3753, tid=3780
#
# JRE version: OpenJDK Runtime Environment (11.0.1+13) (build 11.0.1+13)
# Java VM: OpenJDK Server VM (11.0.1+13, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x58d905]  HeapRegion::block_size(HeapWord const*) const+0x85
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to //core.3753)
#
# An error report file with more information is saved as:
# //hs_err_pid3753.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)
iteration 87

...

From the hserr file the backtrace looks similar to java-11-openjdk-11.0.2.7-6.fc30.i386 and earlier:

Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x58d905]  HeapRegion::block_size(HeapWord const*) const+0x85
V  [libjvm.so+0x5de8fc]  G1RemSet::refine_card_during_gc(signed char*, G1ScanObjsDuringUpdateRSClosure*) [clone .part.0]+0x19c
V  [libjvm.so+0x5e38e1]  G1RefineCardClosure::do_card_ptr(signed char*, unsigned int)+0x21
V  [libjvm.so+0x54fcca]  DirtyCardQueueSet::apply_closure_to_completed_buffer(CardTableEntryClosure*, unsigned int, unsigned int, bool)+0x13a
V  [libjvm.so+0x54fdac]  DirtyCardQueueSet::apply_closure_during_gc(CardTableEntryClosure*, unsigned int)+0x1c
V  [libjvm.so+0x59203a]  G1CollectedHeap::iterate_dirty_card_closure(CardTableEntryClosure*, unsigned int)+0x3a
V  [libjvm.so+0x5e054e]  G1RemSet::update_rem_set(G1ParScanThreadState*, unsigned int)+0x11e
V  [libjvm.so+0x5e06ce]  G1RemSet::oops_into_collection_set_do(G1ParScanThreadState*, unsigned int)+0x1e
V  [libjvm.so+0x59deef]  G1ParTask::work(unsigned int)+0x12f
V  [libjvm.so+0xc62ea0]  GangWorker::loop()+0x70
V  [libjvm.so+0x9cf3b5]  thread_native_entry(Thread*)+0x115
C  [libpthread.so.0+0x7595]  start_thread+0x105

Comment 23 Severin Gehwolf 2019-04-09 15:29:28 UTC
Looks like JDK-8213419 and JDK-8214206 would fix this UB issue:

/builddir/build/BUILD/java-11-openjdk-11.0.2.7-6.fc30.i386/openjdk/src/hotspot/share/opto/mulnode.cpp:452:25: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'

Code around line 452 in mulnode.cpp reads:

    if (t1 != NULL && t1->_lo >= 0) {
      jint t1_support = right_n_bits(1 + log2_intptr(t1->_hi)); // UB issue observed here
      if ((t1_support & con) == t1_support)
        return in1;
    }

I'm testing it right now. Note that JDK-8213419 and JDK-8214206 are part of the upcoming 11.0.3 release.

Comment 24 Severin Gehwolf 2019-04-15 18:08:00 UTC
(In reply to Severin Gehwolf from comment #23)
> I'm testing it right now.

This didn't make a difference.

Comment 25 Severin Gehwolf 2019-04-19 09:32:28 UTC
Latest failure on rawhide: https://koji.fedoraproject.org/koji/taskinfo?taskID=34255476

Failed with:
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf7387be9, pid=8864, tid=8870
#
# JRE version: OpenJDK Runtime Environment (11.0.2+7) (build 11.0.2+7)
# Java VM: OpenJDK Server VM (11.0.2+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5cbbe9]  G1ScanRSForRegionClosure::scan_card(MemRegion, unsigned int)+0xf9
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to /builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/make/core.8864)
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
---------------  S U M M A R Y ------------
Command Line: -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto -Djava.awt.headless=true -Dextlink.spec.version=11 --limit-modules=java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules=java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path=/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports=java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports=java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports=java.base/jdk.internal.misc=jdk.compiler.interim -Djdk.module.main=jdk.javadoc.interim jdk.javadoc.interim/jdk.javadoc.internal.tool.Main -d /builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/images/docs/api -use -keywords -notimestamp -serialwarn -encoding ISO-8859-1 -docencoding UTF-8 -breakiterator -splitIndex --system none -javafx --expand-requires transitive --override-methods=summary -tag beaninfo:X -tag revised:X -tag since.unbundled:X -tag spec:X -tag specdefault:X -tag Note:X -tag ToDo:X -tag apiNote:a:API Note: -tag implSpec:a:Implementation Requirements: -tag implNote:a:Implementation Note: -tag param -tag return -tag throws -taglet build.tools.taglet.ModuleGraph -tag since -tag serialData -tag factory -tag see -tag jvms:a:See <cite>The Java&trade; Virtual Machine Specification</cite>: -tag jls:a:See <cite>The Java&trade; Language Specification</cite>: -taglet build.tools.taglet.ExtLink -taglet build.tools.taglet.Incubating -tagletpath /builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/buildtools/jdk_tools_classes --module-source-path /builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/src/*/share/classes:/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/support/rmic/*:/builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/src/*/share/doc/stub --module java.se,java.smartcardio,jdk.accessibility,jdk.attach,jdk.charsets,jdk.compiler,jdk.crypto.cryptoki,jdk.crypto.ec,jdk.dynalink,jdk.editpad,jdk.hotspot.agent,jdk.httpserver,jdk.jartool,jdk.javadoc,jdk.jcmd,jdk.jconsole,jdk.jdeps,jdk.jdi,jdk.jdwp.agent,jdk.jfr,jdk.jlink,jdk.jshell,jdk.jsobject,jdk.jstatd,jdk.localedata,jdk.management,jdk.management.agent,jdk.management.jfr,jdk.naming.dns,jdk.naming.rmi,jdk.net,jdk.pack,jdk.rmic,jdk.scripting.nashorn,jdk.sctp,jdk.security.auth,jdk.security.jgss,jdk.xml.dom,jdk.zipfs -Xdoclint:all,-accessibility,-html,-missing,-syntax,-reference -doctitle Java<sup>&reg;</sup> Platform, Standard Edition &amp;&nbsp;Java&nbsp;Development&nbsp;Kit<br>Version 11 API Specification -windowtitle Java SE 11 & JDK 11  -header <div style="margin-top: 14px;"><strong>Java SE 11 &amp; JDK 11</strong> </div> -bottom <a href="http://bugreport.java.com/bugreport/">Report a bug or suggest an enhancement</a><br> For further API reference and developer documentation see the <a href="http://www.oracle.com/pls/topic/lookup?ctx=javase11.0.3&amp;id=homepage" target="_blank">Java SE Documentation</a>, which contains more detailed, developer-targeted descriptions with conceptual overviews, definitions of terms, workarounds, and working code examples.<br> Java is a trademark or registered trademark of Oracle and/or its affiliates in the US and other countries.<br> <a href="{@docroot}/../legal/copyright.html">Copyright</a> &copy; 1993, 2019, Oracle and/or its affiliates, 500 Oracle Parkway, Redwood Shores, CA 94065 USA.<br>All rights reserved. Use is subject to <a href="http://www.oracle.com/technetwork/java/javase/terms/license/java11.0.3speclicense.html">license terms</a> and the <a href="http://www.oracle.com/technetwork/java/redist-137594.html">documentation redistribution policy</a>. <!-- Version 11.0.3+6 --> -overview /builddir/build/BUILD/java-11-openjdk-11.0.3.6-0.fc31.i386/openjdk/build/support/docs/JDK_API-overview.html -group Java SE java.base:java.compiler:java.datatransfer:java.desktop:java.instrument:java.logging:java.management:java.management.rmi:java.naming:java.net.http:java.prefs:java.rmi:java.scripting:java.se:java.security.jgss:java.security.sasl:java.sql:java.sql.rowset:java.transaction.xa:java.xml:java.xml.crypto -group JDK jdk.* -verbose
Host: Intel Core Processor (Haswell, no TSX, IBRS), 6 cores, 14G, Fedora release 31 (Rawhide)
Time: Thu Apr 18 17:44:04 2019 UTC elapsed time: 10 seconds (0d 0h 0m 10s)
---------------  T H R E A D  ---------------
Current thread (0xf6920c00):  GCTaskThread "GC Thread#0" [stack: 0xe753f000,0xe75bf000] [id=8870]
Stack: [0xe753f000,0xe75bf000],  sp=0xe75bdee0,  free space=507k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x5cbbe9]  G1ScanRSForRegionClosure::scan_card(MemRegion, unsigned int)+0xf9
V  [libjvm.so+0x5cc12c]  G1ScanRSForRegionClosure::scan_rem_set_roots(HeapRegion*)+0x1bc
V  [libjvm.so+0x5cc258]  G1ScanRSForRegionClosure::do_heap_region(HeapRegion*)+0x68
V  [libjvm.so+0x58a7e9]  G1CollectionSet::iterate_from(HeapRegionClosure*, unsigned int, unsigned int) const+0x49
V  [libjvm.so+0x57e2a5]  G1CollectedHeap::collection_set_iterate_from(HeapRegionClosure*, unsigned int)+0x35
V  [libjvm.so+0x5cae46]  G1RemSet::scan_rem_set(G1ParScanThreadState*, unsigned int)+0xe6
V  [libjvm.so+0x589d9f]  G1ParTask::work(unsigned int)+0x12f
V  [libjvm.so+0xc44980]  GangWorker::loop()+0x70
V  [libjvm.so+0x9aee25]  thread_native_entry(Thread*)+0x115

Comment 26 Severin Gehwolf 2019-05-07 08:44:35 UTC
Another rawhide failure:
https://koji.fedoraproject.org/koji/taskinfo?taskID=34684299

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf74728c9, pid=20453, tid=21728
#
# JRE version: OpenJDK Runtime Environment (11.0.3+7) (build 11.0.3+7)
# Java VM: OpenJDK Server VM (11.0.3+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5668c9]  G1ContiguousSpace::block_start(void const*)+0x79
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to /builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/make/core.20453)
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
---------------  S U M M A R Y ------------
Command Line: -Xms64M -Xmx768M -XX:ThreadStackSize=768 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/configure-support/classes.jsa -Xshare:auto --limit-modules=java.base,jdk.zipfs,java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --add-modules=java.compiler.interim,jdk.compiler.interim,jdk.javadoc.interim --module-path=/builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/buildtools/interim_langtools_modules --add-exports=java.base/sun.reflect.annotation=jdk.compiler.interim --add-exports=java.base/jdk.internal.jmod=jdk.compiler.interim --add-exports=java.base/jdk.internal.misc=jdk.compiler.interim -Djdk.module.main=jdk.compiler.interim jdk.compiler.interim/com.sun.tools.javac.Main -g -source 11 -target 11 --doclint-format html5 -encoding ascii -XDignore.symbol.file=true -Xlint:all -Werror -Xdoclint:all/protected,-reference -Xdoclint/package:java.*,javax.* -Xlint:exports --doclint-format html4 --module-source-path /builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/bootcycle-build/support/gensrc/*:/builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/src/*/linux/classes:/builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/src/*/unix/classes:/builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/src/*/share/classes --module-path  --system none -g -implicit:none -classpath /builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/bootcycle-build/buildtools/depend -Xplugin:depend /builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/bootcycle-build/jdk/modules/java.desktop/_the.java.desktop_pubapi -d /builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/bootcycle-build/jdk/modules -h /builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/bootcycle-build/support/headers.java.desktop.tmp @/builddir/build/BUILD/java-11-openjdk-11.0.3.7-3.fc31.i386/openjdk/build/bootcycle-build/jdk/modules/java.desktop/_the.java.desktop_batch.tmp
Host: Intel Core Processor (Haswell, no TSX, IBRS), 6 cores, 14G, Fedora release 31 (Rawhide)
Time: Mon May  6 18:32:31 2019 UTC elapsed time: 45 seconds (0d 0h 0m 45s)
---------------  T H R E A D  ---------------
Current thread (0xb4914000):  GCTaskThread "GC Thread#2" [stack: 0xb2680000,0xb2700000] [id=21728]
Stack: [0xb2680000,0xb2700000],  sp=0xb26fef10,  free space=507k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x5668c9]  G1ContiguousSpace::block_start(void const*)+0x79
V  [libjvm.so+0x5afcf9]  G1RemSet::refine_card_during_gc(signed char*, G1ScanObjsDuringUpdateRSClosure*) [clone .part.0]+0xf9
V  [libjvm.so+0x5b4e61]  G1RefineCardClosure::do_card_ptr(signed char*, unsigned int)+0x21
V  [libjvm.so+0x51adea]  DirtyCardQueueSet::apply_closure_to_completed_buffer(CardTableEntryClosure*, unsigned int, unsigned int, bool)+0x13a
V  [libjvm.so+0x51aecc]  DirtyCardQueueSet::apply_closure_during_gc(CardTableEntryClosure*, unsigned int)+0x1c
V  [libjvm.so+0x55c4ca]  G1CollectedHeap::iterate_dirty_card_closure(CardTableEntryClosure*, unsigned int)+0x3a
V  [libjvm.so+0x5b184e]  G1RemSet::update_rem_set(G1ParScanThreadState*, unsigned int)+0x11e
V  [libjvm.so+0x5b19ce]  G1RemSet::oops_into_collection_set_do(G1ParScanThreadState*, unsigned int)+0x1e
V  [libjvm.so+0x56b76f]  G1ParTask::work(unsigned int)+0x12f
V  [libjvm.so+0xba8a40]  GangWorker::loop()+0x70
V  [libjvm.so+0xb0eff7]  Thread::call_run()+0x157
V  [libjvm.so+0x990012]  thread_native_entry(Thread*)+0x112
C  [libpthread.so.0+0x84de]  start_thread+0xee
siginfo: si_signo: 11 (SIGSEGV), si_code: 2 (SEGV_ACCERR), si_addr: 0xb632ec33

Comment 27 Severin Gehwolf 2019-05-07 12:06:41 UTC
In a i686 chroot running GCBasher with G1 seems to reproduce quite nicely:

$ make run-test TEST=test/hotspot/jtreg/gc/stress/gcbasher/TestGCBasherWithG1.java
[...]
[3.879s][info][gc,cpu        ] GC(55) User=0.05s Sys=0.00s Real=0.01s
[3.951s][info][gc,start      ] GC(56) Pause Young (Normal) (G1 Evacuation Pause)
[3.951s][info][gc,task       ] GC(56) Using 6 workers of 8 for evacuation
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf73fd94f, pid=137, tid=165
#
# JRE version: OpenJDK Runtime Environment (11.0.3+7) (build 11.0.3+7)
# Java VM: OpenJDK Server VM (11.0.3+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5b194f]  HeapRegion::block_size(HeapWord const*) const+0x7f
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to /openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/scratch/0/core.137)
#
# An error report file with more information is saved as:
# /openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/scratch/0/hs_err_pid137.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp


$ cat /openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/scratch/0/hs_err_pid137.log
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xf73fd94f, pid=137, tid=165
#
# JRE version: OpenJDK Runtime Environment (11.0.3+7) (build 11.0.3+7)
# Java VM: OpenJDK Server VM (11.0.3+7, mixed mode, tiered, g1 gc, linux-x86)
# Problematic frame:
# V  [libjvm.so+0x5b194f]  HeapRegion::block_size(HeapWord const*) const+0x7f
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to /openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/scratch/0/core.137)
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -Dtest.class.path.prefix=/openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/classes/0/gc/stress/gcbasher/TestGCBasherWithG1.d:/openjdk-11/test/hotspot/jtreg/gc/stress/gcbasher -Dtest.src=/openjdk-11/test/hotspot/jtreg/gc/stress/gcbasher -Dtest.src.path=/openjdk-11/test/hotspot/jtreg/gc/stress/gcbasher -Dtest.classes=/openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/classes/0/gc/stress/gcbasher/TestGCBasherWithG1.d -Dtest.class.path=/openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/classes/0/gc/stress/gcbasher/TestGCBasherWithG1.d -Dtest.vm.opts=-XX:MaxRAMPercentage=6 -XX:OnError=gdb -p $$ -Dtest.tool.vm.opts=-J-XX:MaxRAMPercentage=6 -Dtest.compiler.opts= -Dtest.java.opts= -Dtest.jdk=/openjdk-11/build/linux-x86-normal-server-release/images/jdk -Dcompile.jdk=/openjdk-11/build/linux-x86-normal-server-release/images/jdk -Dtest.timeout.factor=4.0 -Dtest.nativepath=/openjdk-11/build/linux-x86-normal-server-release/images/test/hotspot/jtreg/native -XX:MaxRAMPercentage=6 -Djava.library.path=/openjdk-11/build/linux-x86-normal-server-release/images/test/hotspot/jtreg/native -Xlog:gc*=info -Xmx256m -XX:+UseG1GC com.sun.javatest.regtest.agent.MainWrapper /openjdk-11/build/linux-x86-normal-server-release/test-support/jtreg_test_hotspot_jtreg_gc_stress_gcbasher_TestGCBasherWithG1_java/gc/stress/gcbasher/TestGCBasherWithG1.d/main.0.jta 120000

Host: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz, 8 cores, 31G, Fedora release 30 (Rawhide)
Time: Tue May  7 14:01:00 2019 CEST elapsed time: 3 seconds (0d 0h 0m 3s)

---------------  T H R E A D  ---------------

Current thread (0xd5c3f800):  GCTaskThread "GC Thread#5" [stack: 0xd3978000,0xd39f8000] [id=165]

Stack: [0xd3978000,0xd39f8000],  sp=0xd39f6ec0,  free space=507k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x5b194f]  HeapRegion::block_size(HeapWord const*) const+0x7f
V  [libjvm.so+0x563edf]  G1ContiguousSpace::block_start(void const*)+0x9f
V  [libjvm.so+0x5ad4f9]  G1RemSet::refine_card_during_gc(signed char*, G1ScanObjsDuringUpdateRSClosure*) [clone .part.0]+0xf9
V  [libjvm.so+0x5b2531]  G1RefineCardClosure::do_card_ptr(signed char*, unsigned int)+0x21
V  [libjvm.so+0x51854a]  DirtyCardQueueSet::apply_closure_to_completed_buffer(CardTableEntryClosure*, unsigned int, unsigned int, bool)+0x13a
V  [libjvm.so+0x51862c]  DirtyCardQueueSet::apply_closure_during_gc(CardTableEntryClosure*, unsigned int)+0x1c
V  [libjvm.so+0x559b2a]  G1CollectedHeap::iterate_dirty_card_closure(CardTableEntryClosure*, unsigned int)+0x3a
V  [libjvm.so+0x5af03e]  G1RemSet::update_rem_set(G1ParScanThreadState*, unsigned int)+0x11e
V  [libjvm.so+0x5af1be]  G1RemSet::oops_into_collection_set_do(G1ParScanThreadState*, unsigned int)+0x1e
V  [libjvm.so+0x568def]  G1ParTask::work(unsigned int)+0x12f
V  [libjvm.so+0xba1620]  GangWorker::loop()+0x70
V  [libjvm.so+0xb07ca7]  Thread::call_run()+0x157
V  [libjvm.so+0x98afe2]  thread_native_entry(Thread*)+0x112
C  [libpthread.so.0+0x7595]  start_thread+0x105

[...]

Comment 28 Severin Gehwolf 2019-05-09 09:52:06 UTC
(In reply to Severin Gehwolf from comment #27)
> In a i686 chroot running GCBasher with G1 seems to reproduce quite nicely:

It needs to be run in a loop, with a bound of ~50 iterations. It passes for Parallel GC (-XX:+UseParallelGC).

Comment 29 Severin Gehwolf 2019-05-10 10:10:23 UTC
Using -fno-tree-ch seems to fix the issue.

Comment 30 Severin Gehwolf 2019-05-10 14:51:21 UTC
Candidate fix so as to get beyond random failures at least:

https://src.fedoraproject.org/rpms/java-11-openjdk/pull-request/45

I'll continue investigation as to what exactly is causing this. GCC bug
or OpenJDK issue by first figuring out which object file causes the problem.

Comment 31 Severin Gehwolf 2019-05-13 08:32:09 UTC
The bad object file seems to be:

g1CollectedHeap.o

Comment 32 Severin Gehwolf 2019-05-13 08:34:13 UTC
(In reply to Severin Gehwolf from comment #29)
> Using -fno-tree-ch seems to fix the issue.

Commit of the hotspot-tools-find-compile-flag repo which was used to find this:
https://github.com/jerboaa/hotspot-tools-find-compile-flag/commit/69f9eebe17ee723b862966a39eff59f88bb2b015

Comment 33 Severin Gehwolf 2019-05-13 13:18:08 UTC
(In reply to Severin Gehwolf from comment #31)
> The bad object file seems to be:
> 
> g1CollectedHeap.o

Commit of the hotspot-tools-find-bad-object repo which was used to find this:
https://github.com/jerboaa/hotspot-tools-find-bad-object/commit/a002bebc26897d8bddf754648a12f7b3931a04a0

Comment 34 Severin Gehwolf 2019-05-13 14:48:04 UTC
Created attachment 1568004 [details]
preprocessed C++ file for g1CollectedHeap.o

Comment 35 Severin Gehwolf 2019-05-13 15:21:17 UTC
For the "bad" case, compile the pre-processed file from comment 34 (g1CollectedHeap.o.cpp) with:

/usr/bin/g++ -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS -D_GNU_SOURCE -D_REENTRANT -pipe -fno-rtti -fno-exceptions -fvisibility=hidden -fno-strict-aliasing -fno-omit-frame-pointer -fcheck-new -fstack-protector -std=gnu++98 -DSUPPORTS_CLOCK_MONOTONIC -DLINUX -Wpointer-arith -Wsign-compare -Wunused-function -Wundef -Wformat=2 -Wunused-value -Woverloaded-virtual -Wreturn-type -fPIC -DVM_LITTLE_ENDIAN -march=i586 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wno-format-zero-length -Wtype-limits -Wuninitialized -m32 -DPRODUCT -DTARGET_ARCH_x86 -DINCLUDE_SUFFIX_OS=_linux -DINCLUDE_SUFFIX_CPU=_x86 -DINCLUDE_SUFFIX_COMPILER=_gcc -DTARGET_COMPILER_gcc -DIA32 -DHOTSPOT_LIB_ARCH='"i386"' -DCOMPILER1 -DCOMPILER2 -DDTRACE_ENABLED -DINCLUDE_JVMCI=0 -DINCLUDE_AOT=0 -DINCLUDE_ZGC=0 -m32 -g -O3 -fno-PIC -DTHIS_FILE='""' -c -MMD -MF /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/g1CollectedHeap.d -o g1CollectedHeap.o g1CollectedHeap.o.cpp

For the "good" case, compile the pre-processed file from comment 34 with (-fno-tree-ch added):

/usr/bin/g++ -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS -D_GNU_SOURCE -D_REENTRANT -pipe -fno-rtti -fno-exceptions -fvisibility=hidden -fno-strict-aliasing -fno-omit-frame-pointer -fcheck-new -fstack-protector -std=gnu++98 -DSUPPORTS_CLOCK_MONOTONIC -DLINUX -Wpointer-arith -Wsign-compare -Wunused-function -Wundef -Wformat=2 -Wunused-value -Woverloaded-virtual -Wreturn-type -fPIC -DVM_LITTLE_ENDIAN -march=i586 -fno-delete-null-pointer-checks -fno-lifetime-dse -Wno-format-zero-length -Wtype-limits -Wuninitialized -m32 -DPRODUCT -DTARGET_ARCH_x86 -DINCLUDE_SUFFIX_OS=_linux -DINCLUDE_SUFFIX_CPU=_x86 -DINCLUDE_SUFFIX_COMPILER=_gcc -DTARGET_COMPILER_gcc -DIA32 -DHOTSPOT_LIB_ARCH='"i386"' -DCOMPILER1 -DCOMPILER2 -DDTRACE_ENABLED -DINCLUDE_JVMCI=0 -DINCLUDE_AOT=0 -DINCLUDE_ZGC=0 -m32 -g -O3 -fno-tree-ch -fno-PIC -DTHIS_FILE='""' -c -MMD -MF /openjdk-11/build/linux-x86-normal-server-release/hotspot/variant-server/libjvm/objs/g1CollectedHeap.d -o g1CollectedHeap.o g1CollectedHeap.o.cpp

Comment 36 Severin Gehwolf 2019-05-14 13:32:23 UTC
This reproduces with GCC 9.1.1 as well.

Comment 37 Severin Gehwolf 2019-05-15 13:14:18 UTC
Marking this fixed-in-version java-11-openjdk-11.0.3.7-5.fc31 (for rawhide) as the work-around has been incorporated there. I'll leave this bug open, though for root cause investigation and F30 fixes.

Comment 38 Fedora Update System 2019-05-20 14:45:35 UTC
java-11-openjdk-11.0.3.7-5.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-6396993578

Comment 39 Fedora Update System 2019-05-21 01:59:40 UTC
java-11-openjdk-11.0.3.7-5.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-6396993578

Comment 40 Severin Gehwolf 2019-05-21 12:04:50 UTC
This affects JDK 8u too. See bug 1712370.

Comment 41 Fedora Update System 2019-05-31 01:31:42 UTC
java-11-openjdk-11.0.3.7-5.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.

Comment 42 Severin Gehwolf 2019-06-13 15:33:59 UTC
Root cause of this is JDK-8225716. Thus -fno-tree-ch needs to get removed again once the fix has been backported.

Comment 43 Severin Gehwolf 2019-06-26 16:47:39 UTC
OpenJDK version 11.0.4+9 (an EA tag) and better will have the root cause of this fixed.

Comment 44 Fedora Update System 2019-10-18 13:02:24 UTC
FEDORA-2019-4bafcdb85f has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-4bafcdb85f

Comment 45 Fedora Update System 2019-10-18 13:02:27 UTC
FEDORA-2019-f36ac0db92 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-f36ac0db92

Comment 46 Fedora Update System 2019-10-18 13:02:31 UTC
FEDORA-2019-f14a32de28 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-f14a32de28

Comment 47 Fedora Update System 2019-10-18 17:36:08 UTC
java-11-openjdk-11.0.5.10-0.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-f14a32de28

Comment 48 Fedora Update System 2019-10-18 21:00:27 UTC
java-11-openjdk-11.0.5.10-0.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-f36ac0db92

Comment 49 Fedora Update System 2019-10-18 21:54:37 UTC
java-11-openjdk-11.0.5.10-0.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-4bafcdb85f

Comment 50 Fedora Update System 2019-10-21 16:29:02 UTC
java-11-openjdk-11.0.5.10-0.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.

Comment 51 Fedora Update System 2019-10-25 18:08:37 UTC
java-11-openjdk-11.0.5.10-0.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.

Comment 52 Fedora Update System 2019-10-26 17:27:10 UTC
java-11-openjdk-11.0.5.10-0.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report.