Wed, 19 May 2010 10:37:05 -0700
6953483: Typo related to ReduceInitialCardMarks leaves concurrent collectors vulnerable to heap corruption
Summary: Corrected mis-spelling of COMPILER2 in #ifdef, which could cause heap corruption in CMS due to precleaning when +ReduceInitialCardMarks. Thanks to ChenGuang Sun <suncg03@gmail.com> for bringing this typo to our attention.
Reviewed-by: tonyp, jmasa, jcoomes, kvn
1 /*
2 * Copyright 2001-2009 Sun Microsystems, Inc. All Rights Reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
20 * CA 95054 USA or visit www.sun.com if you need additional information or
21 * have any questions.
22 *
23 */
25 # include "incls/_precompiled.incl"
26 # include "incls/_collectedHeap.cpp.incl"
29 #ifdef ASSERT
30 int CollectedHeap::_fire_out_of_memory_count = 0;
31 #endif
33 size_t CollectedHeap::_filler_array_max_size = 0;
35 // Memory state functions.
37 CollectedHeap::CollectedHeap()
38 {
39 const size_t max_len = size_t(arrayOopDesc::max_array_length(T_INT));
40 const size_t elements_per_word = HeapWordSize / sizeof(jint);
41 _filler_array_max_size = align_object_size(filler_array_hdr_size() +
42 max_len * elements_per_word);
44 _barrier_set = NULL;
45 _is_gc_active = false;
46 _total_collections = _total_full_collections = 0;
47 _gc_cause = _gc_lastcause = GCCause::_no_gc;
48 NOT_PRODUCT(_promotion_failure_alot_count = 0;)
49 NOT_PRODUCT(_promotion_failure_alot_gc_number = 0;)
51 if (UsePerfData) {
52 EXCEPTION_MARK;
54 // create the gc cause jvmstat counters
55 _perf_gc_cause = PerfDataManager::create_string_variable(SUN_GC, "cause",
56 80, GCCause::to_string(_gc_cause), CHECK);
58 _perf_gc_lastcause =
59 PerfDataManager::create_string_variable(SUN_GC, "lastCause",
60 80, GCCause::to_string(_gc_lastcause), CHECK);
61 }
62 _defer_initial_card_mark = false; // strengthened by subclass in pre_initialize() below.
63 }
65 void CollectedHeap::pre_initialize() {
66 // Used for ReduceInitialCardMarks (when COMPILER2 is used);
67 // otherwise remains unused.
68 #ifdef COMPILER2
69 _defer_initial_card_mark = ReduceInitialCardMarks && can_elide_tlab_store_barriers()
70 && (DeferInitialCardMark || card_mark_must_follow_store());
71 #else
72 assert(_defer_initial_card_mark == false, "Who would set it?");
73 #endif
74 }
76 #ifndef PRODUCT
77 void CollectedHeap::check_for_bad_heap_word_value(HeapWord* addr, size_t size) {
78 if (CheckMemoryInitialization && ZapUnusedHeapArea) {
79 for (size_t slot = 0; slot < size; slot += 1) {
80 assert((*(intptr_t*) (addr + slot)) != ((intptr_t) badHeapWordVal),
81 "Found badHeapWordValue in post-allocation check");
82 }
83 }
84 }
86 void CollectedHeap::check_for_non_bad_heap_word_value(HeapWord* addr, size_t size)
87 {
88 if (CheckMemoryInitialization && ZapUnusedHeapArea) {
89 for (size_t slot = 0; slot < size; slot += 1) {
90 assert((*(intptr_t*) (addr + slot)) == ((intptr_t) badHeapWordVal),
91 "Found non badHeapWordValue in pre-allocation check");
92 }
93 }
94 }
95 #endif // PRODUCT
97 #ifdef ASSERT
98 void CollectedHeap::check_for_valid_allocation_state() {
99 Thread *thread = Thread::current();
100 // How to choose between a pending exception and a potential
101 // OutOfMemoryError? Don't allow pending exceptions.
102 // This is a VM policy failure, so how do we exhaustively test it?
103 assert(!thread->has_pending_exception(),
104 "shouldn't be allocating with pending exception");
105 if (StrictSafepointChecks) {
106 assert(thread->allow_allocation(),
107 "Allocation done by thread for which allocation is blocked "
108 "by No_Allocation_Verifier!");
109 // Allocation of an oop can always invoke a safepoint,
110 // hence, the true argument
111 thread->check_for_valid_safepoint_state(true);
112 }
113 }
114 #endif
116 HeapWord* CollectedHeap::allocate_from_tlab_slow(Thread* thread, size_t size) {
118 // Retain tlab and allocate object in shared space if
119 // the amount free in the tlab is too large to discard.
120 if (thread->tlab().free() > thread->tlab().refill_waste_limit()) {
121 thread->tlab().record_slow_allocation(size);
122 return NULL;
123 }
125 // Discard tlab and allocate a new one.
126 // To minimize fragmentation, the last TLAB may be smaller than the rest.
127 size_t new_tlab_size = thread->tlab().compute_size(size);
129 thread->tlab().clear_before_allocation();
131 if (new_tlab_size == 0) {
132 return NULL;
133 }
135 // Allocate a new TLAB...
136 HeapWord* obj = Universe::heap()->allocate_new_tlab(new_tlab_size);
137 if (obj == NULL) {
138 return NULL;
139 }
140 if (ZeroTLAB) {
141 // ..and clear it.
142 Copy::zero_to_words(obj, new_tlab_size);
143 } else {
144 // ...and clear just the allocated object.
145 Copy::zero_to_words(obj, size);
146 }
147 thread->tlab().fill(obj, obj + size, new_tlab_size);
148 return obj;
149 }
151 void CollectedHeap::flush_deferred_store_barrier(JavaThread* thread) {
152 MemRegion deferred = thread->deferred_card_mark();
153 if (!deferred.is_empty()) {
154 assert(_defer_initial_card_mark, "Otherwise should be empty");
155 {
156 // Verify that the storage points to a parsable object in heap
157 DEBUG_ONLY(oop old_obj = oop(deferred.start());)
158 assert(is_in(old_obj), "Not in allocated heap");
159 assert(!can_elide_initializing_store_barrier(old_obj),
160 "Else should have been filtered in new_store_pre_barrier()");
161 assert(!is_in_permanent(old_obj), "Sanity: not expected");
162 assert(old_obj->is_oop(true), "Not an oop");
163 assert(old_obj->is_parsable(), "Will not be concurrently parsable");
164 assert(deferred.word_size() == (size_t)(old_obj->size()),
165 "Mismatch: multiple objects?");
166 }
167 BarrierSet* bs = barrier_set();
168 assert(bs->has_write_region_opt(), "No write_region() on BarrierSet");
169 bs->write_region(deferred);
170 // "Clear" the deferred_card_mark field
171 thread->set_deferred_card_mark(MemRegion());
172 }
173 assert(thread->deferred_card_mark().is_empty(), "invariant");
174 }
176 // Helper for ReduceInitialCardMarks. For performance,
177 // compiled code may elide card-marks for initializing stores
178 // to a newly allocated object along the fast-path. We
179 // compensate for such elided card-marks as follows:
180 // (a) Generational, non-concurrent collectors, such as
181 // GenCollectedHeap(ParNew,DefNew,Tenured) and
182 // ParallelScavengeHeap(ParallelGC, ParallelOldGC)
183 // need the card-mark if and only if the region is
184 // in the old gen, and do not care if the card-mark
185 // succeeds or precedes the initializing stores themselves,
186 // so long as the card-mark is completed before the next
187 // scavenge. For all these cases, we can do a card mark
188 // at the point at which we do a slow path allocation
189 // in the old gen, i.e. in this call.
190 // (b) GenCollectedHeap(ConcurrentMarkSweepGeneration) requires
191 // in addition that the card-mark for an old gen allocated
192 // object strictly follow any associated initializing stores.
193 // In these cases, the memRegion remembered below is
194 // used to card-mark the entire region either just before the next
195 // slow-path allocation by this thread or just before the next scavenge or
196 // CMS-associated safepoint, whichever of these events happens first.
197 // (The implicit assumption is that the object has been fully
198 // initialized by this point, a fact that we assert when doing the
199 // card-mark.)
200 // (c) G1CollectedHeap(G1) uses two kinds of write barriers. When a
201 // G1 concurrent marking is in progress an SATB (pre-write-)barrier is
202 // is used to remember the pre-value of any store. Initializing
203 // stores will not need this barrier, so we need not worry about
204 // compensating for the missing pre-barrier here. Turning now
205 // to the post-barrier, we note that G1 needs a RS update barrier
206 // which simply enqueues a (sequence of) dirty cards which may
207 // optionally be refined by the concurrent update threads. Note
208 // that this barrier need only be applied to a non-young write,
209 // but, like in CMS, because of the presence of concurrent refinement
210 // (much like CMS' precleaning), must strictly follow the oop-store.
211 // Thus, using the same protocol for maintaining the intended
212 // invariants turns out, serendepitously, to be the same for both
213 // G1 and CMS.
214 //
215 // For any future collector, this code should be reexamined with
216 // that specific collector in mind, and the documentation above suitably
217 // extended and updated.
218 oop CollectedHeap::new_store_pre_barrier(JavaThread* thread, oop new_obj) {
219 // If a previous card-mark was deferred, flush it now.
220 flush_deferred_store_barrier(thread);
221 if (can_elide_initializing_store_barrier(new_obj)) {
222 // The deferred_card_mark region should be empty
223 // following the flush above.
224 assert(thread->deferred_card_mark().is_empty(), "Error");
225 } else {
226 MemRegion mr((HeapWord*)new_obj, new_obj->size());
227 assert(!mr.is_empty(), "Error");
228 if (_defer_initial_card_mark) {
229 // Defer the card mark
230 thread->set_deferred_card_mark(mr);
231 } else {
232 // Do the card mark
233 BarrierSet* bs = barrier_set();
234 assert(bs->has_write_region_opt(), "No write_region() on BarrierSet");
235 bs->write_region(mr);
236 }
237 }
238 return new_obj;
239 }
241 size_t CollectedHeap::filler_array_hdr_size() {
242 return size_t(arrayOopDesc::header_size(T_INT));
243 }
245 size_t CollectedHeap::filler_array_min_size() {
246 return align_object_size(filler_array_hdr_size());
247 }
249 size_t CollectedHeap::filler_array_max_size() {
250 return _filler_array_max_size;
251 }
253 #ifdef ASSERT
254 void CollectedHeap::fill_args_check(HeapWord* start, size_t words)
255 {
256 assert(words >= min_fill_size(), "too small to fill");
257 assert(words % MinObjAlignment == 0, "unaligned size");
258 assert(Universe::heap()->is_in_reserved(start), "not in heap");
259 assert(Universe::heap()->is_in_reserved(start + words - 1), "not in heap");
260 }
262 void CollectedHeap::zap_filler_array(HeapWord* start, size_t words, bool zap)
263 {
264 if (ZapFillerObjects && zap) {
265 Copy::fill_to_words(start + filler_array_hdr_size(),
266 words - filler_array_hdr_size(), 0XDEAFBABE);
267 }
268 }
269 #endif // ASSERT
271 void
272 CollectedHeap::fill_with_array(HeapWord* start, size_t words, bool zap)
273 {
274 assert(words >= filler_array_min_size(), "too small for an array");
275 assert(words <= filler_array_max_size(), "too big for a single object");
277 const size_t payload_size = words - filler_array_hdr_size();
278 const size_t len = payload_size * HeapWordSize / sizeof(jint);
280 // Set the length first for concurrent GC.
281 ((arrayOop)start)->set_length((int)len);
282 post_allocation_setup_common(Universe::intArrayKlassObj(), start, words);
283 DEBUG_ONLY(zap_filler_array(start, words, zap);)
284 }
286 void
287 CollectedHeap::fill_with_object_impl(HeapWord* start, size_t words, bool zap)
288 {
289 assert(words <= filler_array_max_size(), "too big for a single object");
291 if (words >= filler_array_min_size()) {
292 fill_with_array(start, words, zap);
293 } else if (words > 0) {
294 assert(words == min_fill_size(), "unaligned size");
295 post_allocation_setup_common(SystemDictionary::Object_klass(), start,
296 words);
297 }
298 }
300 void CollectedHeap::fill_with_object(HeapWord* start, size_t words, bool zap)
301 {
302 DEBUG_ONLY(fill_args_check(start, words);)
303 HandleMark hm; // Free handles before leaving.
304 fill_with_object_impl(start, words, zap);
305 }
307 void CollectedHeap::fill_with_objects(HeapWord* start, size_t words, bool zap)
308 {
309 DEBUG_ONLY(fill_args_check(start, words);)
310 HandleMark hm; // Free handles before leaving.
312 #ifdef LP64
313 // A single array can fill ~8G, so multiple objects are needed only in 64-bit.
314 // First fill with arrays, ensuring that any remaining space is big enough to
315 // fill. The remainder is filled with a single object.
316 const size_t min = min_fill_size();
317 const size_t max = filler_array_max_size();
318 while (words > max) {
319 const size_t cur = words - max >= min ? max : max - min;
320 fill_with_array(start, cur, zap);
321 start += cur;
322 words -= cur;
323 }
324 #endif
326 fill_with_object_impl(start, words, zap);
327 }
329 HeapWord* CollectedHeap::allocate_new_tlab(size_t size) {
330 guarantee(false, "thread-local allocation buffers not supported");
331 return NULL;
332 }
334 void CollectedHeap::ensure_parsability(bool retire_tlabs) {
335 // The second disjunct in the assertion below makes a concession
336 // for the start-up verification done while the VM is being
337 // created. Callers be careful that you know that mutators
338 // aren't going to interfere -- for instance, this is permissible
339 // if we are still single-threaded and have either not yet
340 // started allocating (nothing much to verify) or we have
341 // started allocating but are now a full-fledged JavaThread
342 // (and have thus made our TLAB's) available for filling.
343 assert(SafepointSynchronize::is_at_safepoint() ||
344 !is_init_completed(),
345 "Should only be called at a safepoint or at start-up"
346 " otherwise concurrent mutator activity may make heap "
347 " unparsable again");
348 const bool use_tlab = UseTLAB;
349 const bool deferred = _defer_initial_card_mark;
350 // The main thread starts allocating via a TLAB even before it
351 // has added itself to the threads list at vm boot-up.
352 assert(!use_tlab || Threads::first() != NULL,
353 "Attempt to fill tlabs before main thread has been added"
354 " to threads list is doomed to failure!");
355 for (JavaThread *thread = Threads::first(); thread; thread = thread->next()) {
356 if (use_tlab) thread->tlab().make_parsable(retire_tlabs);
357 #ifdef COMPILER2
358 // The deferred store barriers must all have been flushed to the
359 // card-table (or other remembered set structure) before GC starts
360 // processing the card-table (or other remembered set).
361 if (deferred) flush_deferred_store_barrier(thread);
362 #else
363 assert(!deferred, "Should be false");
364 assert(thread->deferred_card_mark().is_empty(), "Should be empty");
365 #endif
366 }
367 }
369 void CollectedHeap::accumulate_statistics_all_tlabs() {
370 if (UseTLAB) {
371 assert(SafepointSynchronize::is_at_safepoint() ||
372 !is_init_completed(),
373 "should only accumulate statistics on tlabs at safepoint");
375 ThreadLocalAllocBuffer::accumulate_statistics_before_gc();
376 }
377 }
379 void CollectedHeap::resize_all_tlabs() {
380 if (UseTLAB) {
381 assert(SafepointSynchronize::is_at_safepoint() ||
382 !is_init_completed(),
383 "should only resize tlabs at safepoint");
385 ThreadLocalAllocBuffer::resize_all_tlabs();
386 }
387 }
389 void CollectedHeap::pre_full_gc_dump() {
390 if (HeapDumpBeforeFullGC) {
391 TraceTime tt("Heap Dump: ", PrintGCDetails, false, gclog_or_tty);
392 // We are doing a "major" collection and a heap dump before
393 // major collection has been requested.
394 HeapDumper::dump_heap();
395 }
396 if (PrintClassHistogramBeforeFullGC) {
397 TraceTime tt("Class Histogram: ", PrintGCDetails, true, gclog_or_tty);
398 VM_GC_HeapInspection inspector(gclog_or_tty, false /* ! full gc */, false /* ! prologue */);
399 inspector.doit();
400 }
401 }
403 void CollectedHeap::post_full_gc_dump() {
404 if (HeapDumpAfterFullGC) {
405 TraceTime tt("Heap Dump", PrintGCDetails, false, gclog_or_tty);
406 HeapDumper::dump_heap();
407 }
408 if (PrintClassHistogramAfterFullGC) {
409 TraceTime tt("Class Histogram", PrintGCDetails, true, gclog_or_tty);
410 VM_GC_HeapInspection inspector(gclog_or_tty, false /* ! full gc */, false /* ! prologue */);
411 inspector.doit();
412 }
413 }