IJ37623: JAVA JIT, BAD FIELD REFERENCE FROM A TENURED OBJECT INTO THE NURSERY

APAR status

• Closed as program error.

Error description

• Error Message: The typical result of this issue would be a
  SIGSEGV but other symptoms might occur like incorrect behaviour.
  .
  Stack Trace: N/A
  .
  The issue affects all platforms and all releases since Java8 GA.
  The problem allows for a local GC cycle to move a nursery object
  without updating a tenured object referring to the nursery
  object. It can also allow a nursery object to be deleted even
  when a tenured object still has a reference to the nursery
  object.
  

Local fix

• The issue can be avoided by preventing the JIT optimizer from
  using the Field Privatizer optimization.
  -Xjit:disableFieldPrivatization
  This might have a small effect on the performance of the JIT
  generated code, but only a limited number of methods are
  compiled with an optimization level that would use the Field
  Privatizer optimization, so it's impact will be limited.
  

Problem summary

• The JIT needs to generate code to inform the GC when an object
  in the tenure heap space has a field referencing an object in
  the nursery heap space. The Field Privatizer optimization was
  generating code that would fail to inform the GC of such a
  situation leaving the possibility for a tenured object field to
  be left with a stale pointer after a GC cycle.
  

Problem conclusion

• The JIT was modified such that the proper code is generated to
  inform the GC when a tenured object field is set to contain a
  nursery object reference.
  .
  This APAR will be fixed in the following Java Releases:
   8 SR7 FP10 (8.0.7.10)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JIT

• Fixed component ID

  620700124

Applicable component levels