IV30765: REPEATEDLY LOADING A JVMTI AGENT CAN RESULT IN A SIGSEGV/GPF.

APAR status

• Closed as program error.

Error description

• Error Message: SIGSEGV/GPF
  
  Crash when iterating JVMTI object pools, this can manifest in
  multiple ways, for example:
  
  Stack Trace: poolPuddle_startDo ()     from libj9jvmti24.so
  pool_startDo ()     from libj9jvmti24.so
  jvmtiHookCheckForDataBreakpoint ()     from libj9jvmti24.so
  J9HookDispatch ()     from libj9hookable24.so
  triggerCheckForDataBreakpointEvent ()     from libj9jit24.so
  jitCTResolveInstanceFieldRef ()     from libj9jit24.so
  TR_ResolvedJ9Method::fieldAttributes ()     from libj9jit24.so
  TR_SymbolReferenceTable::findOrCreateShadowSymbol ()     from
  libj9jit24.so
  TR_ByteCodeIlGenerator::loadInstance ()     from libj9jit24.so
  TR_ByteCodeIlGenerator::walker ()     from libj9jit24.so
  TR_ByteCodeIlGenerator::genILFromByteCodes ()     from
  libj9jit24.so
  TR_ByteCodeIlGenerator::internalGenIL ()     from libj9jit24.so
  TR_ByteCodeIlGenerator::genIL ()     from libj9jit24.so
  TR_ResolvedMethodSymbol::genIL ()     from libj9jit24.so
  TR_Compilation::compile ()     from libj9jit24.so
  TR_CompilationInfo::compile ()     from libj9jit24.so
  TR_CompilationInfo::wrappedCompile ()     from libj9jit24.so
  j9sig_protect ()     from libj9prt24.so
  TR_CompilationInfo::compile ()     from libj9jit24.so
  protectedCompilationThreadProc ()     from libj9jit24.so
  j9sig_protect ()     from libj9prt24.so
  compilationThreadProc ()     from libj9jit24.so
  thread_wrapper ()     from libj9thr24.so
  start_thread ()     from /lib/libpthread.so.0
  clone ()     from /lib/libc.so.6
  .
  
  -- OR --
  
                 hashTableStartDo+0x56 (hashtable.c:1001,
  0x7F4C1C66 [j9gc26+0xe1c66])
                 GC_HashTableIterator::nextSlot+0x17
  (hashtableiterator.cpp:54, 0x7F4C5137 [j9gc26+0xe5137])
                 GC_JVMTIObjectTagTableIterator::nextSlot+0x8
  (jvmtiobjecttagtableiterator.cpp:38, 0x7F4C5368
  [j9gc26+0xe5368])
                 MM_RootScanner::scanJVMTIObjectTagTables+0xc0
  (rootscanner.cpp:906, 0x7F3F3540 [j9gc26+0x13540])
                 MM_RootScanner::scanClearable+0xf7
  (rootscanner.cpp:1223, 0x7F3F3787 [j9gc26+0x13787])
  
  MM_ParallelScavenger::workThreadGarbageCollect+0x8d
  (parallelscavenger.cpp:2634, 0x7F41A57D [j9gc26+0x3a57d])
                 MM_ParallelDispatcher::slaveEntryPoint+0x77
  (paralleldispatcher.cpp:167, 0x7F4C81A7 [j9gc26+0xe81a7])
                 dispatcher_thread_proc2+0x10d
  (paralleldispatcher.cpp:94, 0x7F4C803D [j9gc26+0xe803d])
                 j9sig_protect+0x44 (j9signal.c:150, 0x7EE0F0E4
  [J9PRT26+0xf0e4])
                 dispatcher_thread_proc+0x2a
  (paralleldispatcher.cpp:128, 0x7F4C811A [j9gc26+0xe811a])
                 thread_wrapper+0xda (j9thread.c:1234, 0x7ED8464A
  [J9THR26+0x464a])
                 _endthread+0x48 (0x78AFC55C [msvcr100+0x5c55c])
                 _endthread+0xe8 (0x78AFC5FC [msvcr100+0x5c5fc])
                 GetModuleFileNameA+0x1ba (0x7C80B729
  [kernel32+0xb729])
  NULL
  
  ------------
  
  OTHER:
  
  The crashing stack contains references to the JVMTI library or
  JVMTI methods
  

Local fix

Problem summary

• A disposed JVMTI environment was accessed after the memory was
  freed, causing a segmentation error.
  

Problem conclusion

• This defect will be fixed in:
  6.0.0 SR13
  6.0.1 SR5
  7.0.0 SR4
  .
  JVMTI has been modified to avoid accessing freed memory.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  J9 COMMON CODE

• Fixed component ID

  620700127

Applicable component levels

• R600 PSY

     UP

• R260 PSY

     UP