OpenJDK crash in G1ParScanThreadState::copy_to_survivor_space

Issue

• JDK8 JVM has crashed with the following in the fatal error log:

#  SIGSEGV (0xb) at pc=0x00007f510e83bab3, pid=205542, tid=0x00007f510c1d4700
#
# JRE version: OpenJDK Runtime Environment (8.0_222-b10) (build 1.8.0_222-b10)
# Java VM: OpenJDK 64-Bit Server VM (25.222-b10 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# V  [libjvm.so+0x5b4ab3]  G1ParScanThreadState::copy_to_survivor_space(InCSetState, oopDesc*, markOopDesc*)+0x2e3
...
Stack: [0x00007f510c0d5000,0x00007f510c1d5000],  sp=0x00007f510c1d36a0,  free space=1017k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x5b4ab3]  G1ParScanThreadState::copy_to_survivor_space(InCSetState, oopDesc*, markOopDesc*)+0x2e3
V  [libjvm.so+0x5b54ae]  G1ParScanThreadState::trim_queue()+0x59e
V  [libjvm.so+0x598db7]  G1ParEvacuateFollowersClosure::do_void()+0x37
V  [libjvm.so+0x5998e1]  G1ParTask::work(unsigned int) [clone .part.431]+0x491
V  [libjvm.so+0xae685a]  GangWorker::loop()+0xca
V  [libjvm.so+0x8c3a72]  java_start(Thread*)+0xf2

• Backtrace:

#0  0x00007f6d5990a3d7 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f6d5990bac8 in __GI_abort () at abort.c:90
#2  0x00007f6d591a7b29 in os::abort (dump_core=<optimized out>)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:1576
#3  0x00007f6d593b21f6 in VMError::report_and_die (this=this@entry=0x7f6d3bffdf90)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/utilities/vmError.cpp:1107
#4  0x00007f6d591b1b75 in JVM_handle_linux_signal (sig=11, info=0x7f6d3bffe230, ucVoid=0x7f6d3bffe100, 
    abort_if_unrecognized=<optimized out>)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp:541
#5  0x00007f6d591a4ce8 in signalHandler (sig=11, info=0x7f6d3bffe230, uc=0x7f6d3bffe100)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:4556
#6  <signal handler called>
#7  age (this=<error reading variable: Cannot access memory at address 0x2f8002268>)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/oops/markOop.hpp:336
#8  next_state (age=<synthetic pointer>, m=0x2f8002268, state=..., this=0x7f6d3bffec50)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ParScanThreadState.cpp:193
#9  G1ParScanThreadState::copy_to_survivor_space (this=this@entry=0x7f6d3bffec50, state=..., 
    old=old@entry=0x6a6dde810, old_mark=0x2f8002268)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ParScanThreadState.cpp:213
#10 0x00007f6d58e984ae in do_oop_evac<unsigned int> (from=0x7f6d041524f0, p=0x666ed1df0, 
    this=0x7f6d3bffec50)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ParScanThreadState.inline.hpp:48
#11 deal_with_reference<unsigned int> (ref_to_scan=0x666ed1df0, this=0x7f6d3bffec50)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ParScanThreadState.inline.hpp:117
#12 dispatch_reference (ref=..., this=0x7f6d3bffec50)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ParScanThreadState.inline.hpp:126
#13 G1ParScanThreadState::trim_queue (this=this@entry=0x7f6d3bffec50)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ParScanThreadState.cpp:157
#14 0x00007f6d58e7bdb7 in G1ParEvacuateFollowersClosure::do_void (this=this@entry=0x7f6d3bffe8b0)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp:4609
#15 0x00007f6d58e7c8e1 in G1ParTask::work (this=0x7f6d382326a0, worker_id=3)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp:4784
#16 0x00007f6d593c985a in GangWorker::loop (this=0x7f6d54061800)
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/share/vm/utilities/workgroup.cpp:329
#17 0x00007f6d591a6a72 in java_start (thread=0x7f6d54061800)
---Type <return> to continue, or q <return> to quit---
    at /usr/src/debug/java-1.8.0-openjdk-1.8.0.222.b10-1.el7_7.x86_64/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:847
#18 0x00007f6d5a2d2ea5 in start_thread (arg=0x7f6d3bfff700) at pthread_create.c:307
#19 0x00007f6d599d29fd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

• Code listing

331 
332   // age operations
333   markOop set_marked()   { return markOop((value() & ~lock_mask_in_place) | marked_value); }
334   markOop set_unmarked() { return markOop((value() & ~lock_mask_in_place) | unlocked_value); }
335 
336   uint    age()               const { return mask_bits(value() >> age_shift, age_mask); }
337   markOop set_age(uint v) const {
338     assert((v & ~age_mask) == 0, "shouldn't overflow age field");
339     return markOop((value() & ~age_mask_in_place) | (((uintptr_t)v & age_mask) << age_shift));
340   }

• JDK11 fatal error log:

#  SIGSEGV (0xb) at pc=0x00007f72766ef19c, pid=583249, tid=583305
#
# JRE version: OpenJDK Runtime Environment 18.9 (11.0.11+9) (build 11.0.11+9-LTS)
# Java VM: OpenJDK 64-Bit Server VM 18.9 (11.0.11+9-LTS, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x7c419c]  G1ParScanThreadState::copy_to_survivor_space(InCSetState, oopDesc*, markOopDesc*)+0x37c
...
Current thread (0x00007f7234014000):  GCTaskThread "GC Thread#14" [stack: 0x00007f7218663000,0x00007f7218763000] [id=583305]

Stack: [0x00007f7218663000,0x00007f7218763000],  sp=0x00007f7218761b50,  free space=1018k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x7c419c]  G1ParScanThreadState::copy_to_survivor_space(InCSetState, oopDesc*, markOopDesc*)+0x37c
V  [libjvm.so+0x7c4a58]  G1ParScanThreadState::trim_queue()+0x438
V  [libjvm.so+0x784c4c]  G1ParEvacuateFollowersClosure::do_void()+0x15c
V  [libjvm.so+0x78a369]  G1ParTask::work(unsigned int)+0x199
V  [libjvm.so+0xeed56d]  GangWorker::loop()+0x5d
V  [libjvm.so+0xe5818c]  Thread::call_run()+0x15c
V  [libjvm.so+0xc0d406]  thread_native_entry(Thread*)+0xf6