openj9 icon indicating copy to clipboard operation
openj9 copied to clipboard

JDK24: VirtualThread: Crash in threadstate()

Open tajila opened this issue 6 months ago • 8 comments

[2025-06-04T01:14:54.972Z] variation: -Xdump:system:none -Xdump:heap:none -Xdump:system:events=gpf+abort+traceassert+corruptcache -XX:-JITServerTechPreviewMessage Mode150
[2025-06-04T01:14:54.972Z] JVM_OPTIONS:  -Xdump:system:none -Xdump:heap:none -Xdump:system:events=gpf+abort+traceassert+corruptcache -XX:-JITServerTechPreviewMessage -XX:+UseCompressedOops -Xverbosegclog 

[2025-06-04T01:48:48.821Z] TEST: java/lang/Thread/virtual/ThreadAPI.java#no-vmcontinuations

[2025-06-04T01:48:48.826Z] STARTED    ThreadAPI::testToString2 'testToString2()'
[2025-06-04T01:48:48.826Z] Unhandled exception
[2025-06-04T01:48:48.826Z] Type=Segmentation error vmState=0x00000000
[2025-06-04T01:48:48.826Z] J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000001
[2025-06-04T01:48:48.826Z] Handler1=000003FF9FD470F8 Handler2=000003FFA40B0978 InaccessibleAddress=0000000000000000
[2025-06-04T01:48:48.826Z] gpr0=000003FF00000019 gpr1=0000000000000020 gpr2=0000000000000020 gpr3=0000000000001020
[2025-06-04T01:48:48.826Z] gpr4=000003FF00000003 gpr5=000003FF9D983423 gpr6=00000000000007D1 gpr7=000003FF9FFD18E8
[2025-06-04T01:48:48.826Z] gpr8=000003FF9FFD4E2E gpr9=0000000001357900 gpr10=00000000000007D1 gpr11=0000000001357998
[2025-06-04T01:48:48.826Z] gpr12=000003FF8358F0B0 gpr13=000003FF9FFD1550 gpr14=000003FF9D94FF90 gpr15=000003FF9D9FE258
[2025-06-04T01:48:48.826Z] psw=000003FF9FDA3646 mask=0705000180000000 fpc=00080000 bea=000003FF9FDA35D2
[2025-06-04T01:48:48.826Z] fpr0=0000000000000001 (f: 1.000000, d: 4.940656e-324)
[2025-06-04T01:48:48.826Z] fpr1=484d42c000000000 (f: 0.000000, d: 1.991383e+40)
[2025-06-04T01:48:48.826Z] fpr2=000003ffa00fb384 (f: 2685383680.000000, d: 2.172128e-311)
[2025-06-04T01:48:48.826Z] fpr3=3f40000000000000 (f: 0.000000, d: 4.882812e-04)
[2025-06-04T01:48:48.826Z] fpr4=484d42c080000000 (f: 2147483648.000000, d: 1.991383e+40)
[2025-06-04T01:48:48.826Z] fpr5=8000000000000000 (f: 0.000000, d: -0.000000e+00)
[2025-06-04T01:48:48.826Z] fpr6=0000000000000000 (f: 0.000000, d: 0.000000e+00)
[2025-06-04T01:48:48.826Z] fpr7=4095540000000000 (f: 0.000000, d: 1.365000e+03)
[2025-06-04T01:48:48.826Z] fpr8=000003ff9d9bf000 (f: 2644242432.000000, d: 2.172108e-311)
[2025-06-04T01:48:48.826Z] fpr9=0000000000041000 (f: 266240.000000, d: 1.315400e-318)
[2025-06-04T01:48:48.826Z] fpr10=000003ff280124f0 (f: 671163648.000000, d: 2.171133e-311)
[2025-06-04T01:48:48.826Z] fpr11=000003ff7b77e2e8 (f: 2071454464.000000, d: 2.171825e-311)
[2025-06-04T01:48:48.826Z] fpr12=000003ff9d9ff900 (f: 2644506880.000000, d: 2.172108e-311)
[2025-06-04T01:48:48.826Z] fpr13=000003fef001bf28 (f: 4026646272.000000, d: 2.170669e-311)
[2025-06-04T01:48:48.826Z] fpr14=000003ff9d9bf000 (f: 2644242432.000000, d: 2.172108e-311)
[2025-06-04T01:48:48.826Z] fpr15=000003fef0027038 (f: 4026691584.000000, d: 2.170669e-311)
[2025-06-04T01:48:48.826Z] Module=/home/jenkins/workspace/Test_openjdk24_j9_sanity.openjdk_s390x_linux_testList_0/jdkbinary/j2sdk-image/lib/default/libj9vm29.so
[2025-06-04T01:48:48.826Z] Module_base_address=000003FF9FD00000
[2025-06-04T01:48:48.826Z] Target=2_90_20250604_75 (Linux 5.15.0-140-generic)
[2025-06-04T01:48:48.826Z] CPU=s390x (4 logical CPUs) (0x1f5bfe000 RAM)
[2025-06-04T01:48:48.826Z] ----------- Stack Backtrace -----------
[2025-06-04T01:48:48.826Z] haltThreadForInspection+0xae (0x000003FF9FDA3646 [libj9vm29.so+0xa3646])
[2025-06-04T01:48:48.826Z] Java_java_lang_Thread_getStateImpl+0x90 (0x000003FF9D94FF90 [libjclse29.so+0x4ff90])
[2025-06-04T01:48:48.826Z]  (0x000003FF8358EBA0 [<unknown>+0x0])
[2025-06-04T01:48:48.826Z] ---------------------------------------

[2025-06-04T01:48:48.828Z] TEST RESULT: Failed. Unexpected exit from test [exit code: 255]
[2025-06-04T01:48:48.828Z] --------------------------------------------------
[2025-06-04T01:53:34.030Z] Test results: passed: 927; failed: 1

[2025-06-04T01:53:42.128Z] jdk_lang_0_FAILED

and sometimes

[2025-06-04T01:38:01.472Z] TEST: java/lang/Thread/virtual/ThreadAPI.java#default

[2025-06-04T01:38:01.478Z] Unhandled exception
[2025-06-04T01:38:01.478Z] Type=Segmentation error vmState=0x00000000
[2025-06-04T01:38:01.478Z] J9Generic_Signal_Number=00000018 Signal_Number=0000000b Error_Value=00000000 Signal_Code=00000002

[2025-06-04T01:38:01.478Z] Compiled_method=java/lang/Thread.threadState()Ljava/lang/Thread$State;
[2025-06-04T01:38:01.478Z] Target=2_90_20250604_75 (Linux 5.14.0-570.18.1.el9_6.s390x)
[2025-06-04T01:38:01.478Z] CPU=s390x (4 logical CPUs) (0x1e5a53000 RAM)
[2025-06-04T01:38:01.478Z] ----------- Stack Backtrace -----------
[2025-06-04T01:38:01.478Z]  (0x000003FEBC7E4B4C [<unknown>+0x0])
[2025-06-04T01:38:01.478Z] ---------------------------------------

[2025-06-04T01:38:04.495Z] TEST: java/lang/Thread/virtual/ThreadAPI.java#no-vmcontinuations

[2025-06-04T01:38:04.497Z] Unhandled exception
[2025-06-04T01:38:04.497Z] Type=Segmentation error vmState=0x00000000

[2025-06-04T01:38:04.497Z] Compiled_method=java/lang/Thread.threadState()Ljava/lang/Thread$State;
[2025-06-04T01:38:04.497Z] Target=2_90_20250604_75 (Linux 5.14.0-570.18.1.el9_6.s390x)
[2025-06-04T01:38:04.498Z] CPU=s390x (4 logical CPUs) (0x1e5a53000 RAM)
[2025-06-04T01:38:04.498Z] ----------- Stack Backtrace -----------
[2025-06-04T01:38:04.498Z]  (0x000003FEA07BA59C [<unknown>+0x0])
[2025-06-04T01:38:04.498Z] ---------------------------------------

See https://github.com/eclipse-openj9/openj9/issues/21861#issuecomment-2940081080 for more details

tajila avatar Jun 05 '25 12:06 tajila

The crash occurs because a corrupt value for eetop is passed into Java_java_lang_Thread_getStateImpl

#0  0x000003fffd77d30e in haltThreadForInspection (currentThread=0x542b00, vmThread=0x82c1320882c134e0) at /home/jenkins/tobi/openj9-openjdk-jdk24/openj9/runtime/vm/VMAccess.cpp:1309
#1  0x000003fff63fba80 in Java_java_lang_Thread_getStateImpl (env=0x542b00, recv=0x54a670, threadRef=-9024877166138936096) at /home/jenkins/tobi/openj9-openjdk-jdk24/openj9/runtime/jcl/common/thread.cpp:96
#2  0x000003ffda1098ec in ?? ()
#3  0x000003fffd6a25ac in runJavaThread (currentThread=<error reading variable: Cannot access memory at address 0xa0>) at /home/jenkins/tobi/openj9-openjdk-jdk24/openj9/runtime/vm/callin.cpp:682

Looking at the java stack

<542b00> *** BEGIN STACK WALK, flags = 00400001 walkThread = 5,516,032 ***
<542b00> 	ITERATE_O_SLOTS
<542b00> 	RECORD_BYTECODE_PC_OFFSET
<542b00> Initial values: walkSP = 0x000000000054A5B0, PC = 0x0000000000000006, literals = 0x0000000000000000, A0 = 0x000000000054A5D0, j2iFrame = 0x000000000054A7E8, decomp = 0x0000000000000000
<542b00> JIT JNI call-out frame: bp = 0x000000000054A5D0, sp = 0x000000000054A5B0, pc = 0x0000000000000006, cp = 0x00000000000DE6F0, arg0EA = 0x000000000054A5D0, flags = 0x0000000020000000
<542b00> 	Method: java/lang/Thread.getStateImpl(J)I !j9method 0x00000000000DE608
<542b00> JIT frame: bp = 0x000000000054A668, pc = 0x000003FFDA1098EC, unwindSP = 0x000000000054A5D8, cp = 0x00000000000DE6F0, arg0EA = 0x000000000054A670, jitInfo = 0x000003FFBB8769C8
<542b00> 	Method: java/lang/Thread.threadState()Ljava/lang/Thread$State; !j9method 0x00000000000DE308
<542b00> 	Bytecode index = 43, inlineDepth = 0, PC offset = 0x0000000000000242
<542b00> 	stackMap=0x000003FFBB876BD1, slots=I16(0x0001) parmBaseOffset=I16(0x0008), parmSlots=U16(0x0001), localBaseOffset=I16(0xFFD0)
<542b00> 	Described JIT args starting at 0x000000000054A670 for U16(0x0001) slots
<542b00> 		O-Slot: : a0[0x000000000054A670] = 0x00000000FFBB33E8 //<-- carrier thread object
<542b00> 	Described JIT temps starting at 0x000000000054A638 for IDATA(0x0000000000000006) slots
<542b00> 		I-Slot: : t5[0x000000000054A638] = 0x00000000FFEEC540
<542b00> 		O-Slot: : t4[0x000000000054A640] = 0x00000000FFBB4258
<542b00> 		O-Slot: : t3[0x000000000054A648] = 0x00000000FFBB4258
<542b00> 		I-Slot: : t2[0x000000000054A650] = 0x000000000054A6A8
<542b00> 		O-Slot: : t1[0x000000000054A658] = 0x00000000FFBB4258
<542b00> 		O-Slot: : t0[0x000000000054A660] = 0x00000000FFEEC598
<542b00> 	JIT-RegisterMap = UDATA(0x0000000000000000)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A5F0] = UDATA(0x0000000000000000) (jit_r6)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A5F8] = UDATA(0x00000000829127C8) (jit_r7)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A600] = UDATA(0x0000000000608300) (jit_r8)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A608] = UDATA(0x000003FFDA346DF0) (jit_r9)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A610] = UDATA(0x000000000011F600) (jit_r10)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A618] = UDATA(0x0000000000000000) (jit_r11)
<542b00> 	JIT-Frame-RegisterMap[0x000000000054A620] = UDATA(0x000003FFDA360F48) (jit_r12)
<542b00> I2J values: PC = 0x000003FFA14EF435, A0 = 0x000000000054A6A8, walkSP = 0x000000000054A678, literals = 0x00000000000FACF0, JIT PC = 0x000003FFF79A5808, pcAddress = 0x000003FFBB6FE910, decomp = 0x0000000000000000
<542b00> Bytecode frame: bp = 0x000000000054A688, sp = 0x000000000054A678, pc = 0x000003FFA14EF435, cp = 0x00000000000F94E0, arg0EA = 0x000000000054A6A8, flags = 0x0000000000000000
<542b00> 	Method: java/lang/VirtualThread.appendCarrierInfo(Ljava/lang/StringBuilder;)Z !j9method 0x00000000000FACF0
<542b00> 	Bytecode index = 41
<542b00> 	Using local mapper
<542b00> 	Locals starting at 0x000000000054A6A8 for 0x0000000000000004 slots
<542b00> 		I-Slot: a0[0x000000000054A6A8] = 0x00000000FFEDE250
<542b00> 		O-Slot: a1[0x000000000054A6A0] = 0x00000000FFEEC540
<542b00> 		O-Slot: t2[0x000000000054A698] = 0x00000000FFBB33E8
<542b00> 		I-Slot: t3[0x000000000054A690] = 0x00000000FFEEC558
<542b00> Bytecode frame: bp = 0x000000000054A6C0, sp = 0x000000000054A6B0, pc = 0x000003FFA14EF307, cp = 0x00000000000F94E0, arg0EA = 0x000000000054A6F8, flags = 0x0000000000000000
<542b00> 	Method: java/lang/VirtualThread.toString()Ljava/lang/String; !j9method 0x00000000000FACD0
<542b00> 	Bytecode index = 63
<542b00> 	Using local mapper
<542b00> 	Locals starting at 0x000000000054A6F8 for 0x0000000000000007 slots
<542b00> 		O-Slot: a0[0x000000000054A6F8] = 0x00000000FFEDE250
<542b00> 		O-Slot: t1[0x000000000054A6F0] = 0x00000000FFEEC540
<542b00> 		I-Slot: t2[0x000000000054A6E8] = 0x0000000082C6D298
<542b00> 		I-Slot: t3[0x000000000054A6E0] = 0x000000000054A718
<542b00> 		I-Slot: t4[0x000000000054A6D8] = 0x000003FFFD62C694
<542b00> 		I-Slot: t5[0x000000000054A6D0] = 0x00000000002C5238
<542b00> 		I-Slot: t6[0x000000000054A6C8] = 0x0000000100608300
<542b00> Bytecode frame: bp = 0x000000000054A710, sp = 0x000000000054A700, pc = 0x000003FFFD62C698, cp = 0x00000000002C16B0, arg0EA = 0x000000000054A718, flags = 0x0000000000000000
<542b00> 	Method: ThreadAPI.lambda$testToString2$0()V !j9method 0x00000000002C5238
<542b00> 	Bytecode index = 12
<542b00> 	Using local mapper
<542b00> 	Locals starting at 0x000000000054A718 for 0x0000000000000001 slots
<542b00> 		I-Slot: t0[0x000000000054A718] = 0x00000000FFEDE250

We find a valid reference to the carrier thread object 0x00000000FFBB33E8 when dumping that reference we see:

!J9Object 0x00000000FFBB33E8 {
	struct J9Class* clazz = !j9class 0x53E900 // jdk/internal/misc/CarrierThread
	Object flags = 0x0000003A;
	I lockword = 0x00000000 (offset = 0) (java/lang/Object) <hidden>
	J eetop = 0x0000000000542B00 (offset = 4) (java/lang/Thread) //<correct eetop
	J tid = 0x000000000000001E (offset = 12) (java/lang/Thread)
	Ljava/lang/String; name = !fj9object 0xffbb4200 (offset = 44) (java/lang/Thread)
	Z interrupted = 0x00000000 (offset = 96) (java/lang/Thread)
	Ljava/lang/ClassLoader; contextClassLoader = !fj9object 0x829560d8 (offset = 48) (java/lang/Thread)
	Ljava/lang/Thread$FieldHolder; holder = !fj9object 0xffbb4218 (offset = 52) (java/lang/Thread)
	Ljava/lang/ThreadLocal$ThreadLocalMap; threadLocals = !fj9object 0xffbb4240 (offset = 56) (java/lang/Thread)
	Ljava/lang/ThreadLocal$ThreadLocalMap; inheritableThreadLocals = !fj9object 0x0 (offset = 60) (java/lang/Thread)
	Ljava/lang/Object; scopedValueBindings = !fj9object 0x829127c8 (offset = 64) (java/lang/Thread)
	Ljava/lang/Object; interruptLock = !fj9object 0xffbb4258 (offset = 68) (java/lang/Thread)
	Ljava/lang/Object; parkBlocker = !fj9object 0x0 (offset = 72) (java/lang/Thread)
	Lsun/nio/ch/Interruptible; nioBlocker = !fj9object 0x0 (offset = 76) (java/lang/Thread)
	Ljdk/internal/vm/Continuation; cont = !fj9object 0xffede318 (offset = 80) (java/lang/Thread)
	Ljava/lang/Thread$UncaughtExceptionHandler; uncaughtExceptionHandler = !fj9object 0x82c1c418 (offset = 84) (java/lang/Thread)
	J threadLocalRandomSeed = 0x128A2D6829147B4E (offset = 20) (java/lang/Thread)
	I threadLocalRandomProbe = 0x3C6EF372 (offset = 100) (java/lang/Thread)
	I threadLocalRandomSecondarySeed = 0x00000000 (offset = 104) (java/lang/Thread)
	Ljdk/internal/vm/ThreadContainer; container = !fj9object 0x82c1c428 (offset = 88) (java/lang/Thread)
	Ljdk/internal/vm/StackableScope; headStackableScopes = !fj9object 0x0 (offset = 92) (java/lang/Thread)
	Z started = 0x00000001 (offset = 108) (java/lang/Thread)
	J tls = 0x0000000000000000 (offset = 36) (java/lang/Thread) <hidden>
	J internalSuspendState = 0x0000000000000000 (offset = 28) (java/lang/Thread) <hidden>
	Ljava/util/concurrent/ForkJoinPool; pool = !fj9object 0x82c1af30 (offset = 112) (java/util/concurrent/ForkJoinWorkerThread)
	Ljava/util/concurrent/ForkJoinPool$WorkQueue; workQueue = !fj9object 0xffbad018 (offset = 116) (java/util/concurrent/ForkJoinWorkerThread)
	I compensating = 0x00000000 (offset = 120) (jdk/internal/misc/CarrierThread)
	J compensateValue = 0x0000000000000000 (offset = 124) (jdk/internal/misc/CarrierThread)
}
>

However, threadRef=-9024877166138936096 is passed into the native instead. So my guess is something went wrong in compiled method java/lang/Thread.threadState()Ljava/lang/Thread$State;

tajila avatar Jun 05 '25 13:06 tajila

@hzongaro Please take a look

tajila avatar Jun 05 '25 13:06 tajila

@r30shah FYI

vij-singh avatar Jun 05 '25 14:06 vij-singh

Taking a look.

r30shah avatar Jun 05 '25 15:06 r30shah

Picking up one the core-dump from the failure where we fail with segmentation fault in the compiled method,

 Compiled_method=java/lang/Thread.threadState()Ljava/lang/Thread$State;

I see that we try to dereference this object CarrierThread object in Thread.threadState which seems like is corrupted,

$r1   = 0x000003ff00005088 Unknown  <= this object 

Looking at the method prologue and the java stack, we do enter the method with correct this object

obj 0x000003ff6f2058c8
 Object class type: {jdk/internal/misc/CarrierThread} J9Class 0x000003fe3c4a2c00
     Hidden Fields: 1

But it gets corrupted. Right before we fail, there is a call to monitor enter helper call where we preserve this object in non volatile register, upon returning it gets restored with wrong value, checking the code in the helper assembly to figure out how object got corrupted.

r30shah avatar Jun 05 '25 21:06 r30shah

Right before we fail, there is a call to monitor enter helper call where we preserve this object in non volatile register

FYI, monitor enter is a GC point, so even if the value is correctly preserved upon return it can still be corrupt if the object is not in the GC maps.

tajila avatar Jun 06 '25 15:06 tajila

Yes, something odd I am seeing in the core-dump. We fail with segmentation fault in JIT compiled code for java/lang/Thread.threadState. Segmentation fault occurs at the offset +114

Disassembling {java/lang/Thread.threadState} +0
0x3febc7e4ada +0                e31050000004 lg        %r1, 0(%r5)
0x3febc7e4ae0 +6                e3e05ff8ff24 stg       %r14, -8(%r5)
0x3febc7e4ae6 +12               e3505f70ff71 lay       %r5, -0x90(%r5)
0x3febc7e4aec +18               e350d0500021 clg       %r5, 0x50(%r13)  J9VMThread.stackOverflowMark
0x3febc7e4af2 +24               a744039f     jl        0x3febc7e5230 C>> +1878
0x3febc7e4af6 +28               eb6c50180024 stmg      %r6, %r12, 0x18(%r5)  <<< ^+1896
0x3febc7e4afc +34               e31050900024 stg       %r1, 0x90(%r5)
0x3febc7e4b02 +40               c428000003b3 lgrl      %r2, 0x3febc7e5268 MemBlk - /home/jenkins/workspace/build-scripts/jobs/jdk24/jdk24-linux-s390x-openj9/ +208
0x3febc7e4b08 +46               e55d20000000 clfhsi    0(%r2), 0
0x3febc7e4b0e +52               a7640189     jlh       0x3febc7e4e20 C>> +838
0x3febc7e4b12 +56               e37010680004 lg        %r7, 0x68(%r1)  <<< ^+864 ^+918
0x3febc7e4b18 +62               e37050700024 stg       %r7, 0x70(%r5)
0x3febc7e4b1e +68  -1:6         e3607000002a lzrg      %r6, 0(%r7) // monitorenter
0x3febc7e4b24 +74               e39060d80002 ltg       %r9, 0xd8(%r6)
0x3febc7e4b2a +80               a7c402c1     jle       0x3febc7e50ac C>> +1490
0x3febc7e4b2e +84               41997000     la        %r9, 0(%r9, %r7)
0x3febc7e4b32 +88               b9820088     xgr       %r8, %r8
0x3febc7e4b36 +92               eb8d90000030 csg       %r8, %r13, 0(%r9)
0x3febc7e4b3c +98               a74402aa     jl        0x3febc7e5090 C>> +1462
0x3febc7e4b40 +102               eb01dba8007a agsi      0xba8(%r13), 1
0x3febc7e4b46 +108               e37050680024 stg       %r7, 0x68(%r5)  <<< ^+1486 ^+1566
0x3febc7e4b4c +114               e36010100004 lg        %r6, 0x10(%r1) <= Fails

R1 = 0x000003ff80100300 which is some garbage address. Looking at the register context, last taken branch pointed by BEA is return from OOL code for monitor enter call.

0x3febc7e5090 +1462               b9040091     lgr       %r9, %r1 <<< +98
0x3febc7e5094 +1466               b904002d     lgr       %r2, %r13
0x3febc7e5098 +1470               b9040037     lgr       %r3, %r7
0x3febc7e509c +1474  -1:6         1800         lr        %r0, %r0 // monitorenter
0x3febc7e509e +1476               c0e57f03ded1 brasl     %r14, 0x3ffba860e40
0x3febc7e50a4 +1482               b9040019     lgr       %r1, %r9
0x3febc7e50a8 +1486               a7f4fd4f     j         0x3febc7e4b46 U>> ^+108

R1 which contains this object is preserved to non-volatile register R9 before we take BRASL to call assembly helper glue for monitor enter.

In the monitor helper glue - if we get success with monitorEnterNonBlocking (Which is fastpath version that does not have GC point), we will not store-restore non volatile registers.

If monitorEnterNonBlocking fails, we will preserve all the non volatile register to system stack - upon inspecting, I can see the valid CareerThread object in the system stack

 (0x000003febc0fc3b0+0x210)/10
0x3febc0fc5c0: 0x000003ffb42e5500 J9Class - {java/lang/Object} // R6
0x3febc0fc5c8: 0x000003ff889058c0 Obj - {java/lang/Object} // R7
0x3febc0fc5d0: 0x000003ffb4540700 J9VMThread // R8
0x3febc0fc5d8: 0x000003ff889053e8 Obj - {jdk/internal/misc/CarrierThread} // R9 <= Valid CareerThread object 
0x3febc0fc5e0: 0x00000000ffffffff Unknown! // R10
0x3febc0fc5e8: 0x0000000000000000 Unknown! // R11
0x3febc0fc5f0: 0x000003febc7e6928 {java/lang/Thread.runWith} +506 // R12
0x3febc0fc5f8: 0x000003fe581e2a00 J9VMThread // R13
0x3febc0fc600: 0x000003febc7e50a4 {java/lang/Thread.threadState} +1482 // R14
0x3febc0fc608: 0x009331e67a4880d7 Unknown! // R15

Not sure where it got corrupted - Looking at the other core-dumps to see if those makes more sense.

r30shah avatar Jun 06 '25 17:06 r30shah

Trying to reproduce the error to get other core-dump to look at and also log file (https://openj9-jenkins.osuosl.org/job/Grinder/4400) - Seems like I am hitting https://github.com/eclipse-openj9/openj9/issues/22070

I am able to run the test manually on our dev system and in 100x I am unable to reproduce the failure - I will launch some more grinder to get the failure.

r30shah avatar Jun 13 '25 20:06 r30shah

I have been trying to reproduce the crash in the ThreadAPI test with the latest JDK24 build - Seems like I am consistently hitting the issue here test hits the timeout in various sub-tests (https://hyc-runtimes-jenkins.swg-devops.com/view/Test_grinder/job/Grinder/51700). I will retry older build to see if I can get the crash again.

r30shah avatar Jun 17 '25 16:06 r30shah

Through number of grinders I tried to reproduce the error to get some more data - I am consistently hitting the issue with the timeout which I am hitting with -Xint as well. I am going to look into the core-dump and log file from https://github.com/eclipse-openj9/openj9/issues/21717 as it seemed similar.

r30shah avatar Jun 18 '25 01:06 r30shah

Segmentation error in the JIT compiled code for shared in https://github.com/eclipse-openj9/openj9/issues/22047#issuecomment-2949980835 is caused by the issue summarized in https://github.com/eclipse-openj9/openj9/issues/21717#issuecomment-2992741165

r30shah avatar Jun 20 '25 20:06 r30shah

#22128 has now been merged

vij-singh avatar Jul 03 '25 14:07 vij-singh