EVALUATION
http://hg.openjdk.java.net/lambda/lambda/hotspot/rev/fd8114661503
|
|
|
EVALUATION
http://hg.openjdk.java.net/hsx/hotspot-gc/hotspot/rev/fd8114661503
|
|
|
EVALUATION
http://hg.openjdk.java.net/hsx/hotspot-comp/hotspot/rev/fd8114661503
|
|
|
EVALUATION
Saving RBP register on nmethod's entry broke nmethod's verified entry patching when it become non-entrant. There is big comment in MachPrologNode::emit() about first instruction which should be at lest 5 bytes long. And push(rbp) is one byte instruction. VerifyFPU code also broken (first instruction is pushf). The same with C1 generated code with VerifyFPU and C1Breakpoint.
The only reason we did not noticed this until now is stack bang instruction is usually generated first and it is big (store to stack with big offset). But C2 does not generated it if compiled stack frame is small and no calls in compiled method.
For C2 moved saving EBP after ESP adjustment. And other cleanup in prolog code.
For C1 generated stack bang with small offset (-256) first if needed.
|
|
|
EVALUATION
The above code corresponds to verified entry point:
[Entry Point]
0x00007f41f9d72400: mov 0x8(%rsi),%r10d
0x00007f41f9d72404: shl $0x3,%r10
0x00007f41f9d72408: cmp %r10,%rax
0x00007f41f9d7240b: jne 0x00007f41f9acdb60 ; {runtime_call}
0x00007f41f9d72411: nop
...
[Verified Entry Point]
;; B1: # N32 <- BLOCK HEAD IS JUNK Freq: 1
0x00007f41f9d72420: push %rbp
0x00007f41f9d72421: sub $0x10,%rsp
0x00007f41f9d72425: nop ;*synchronization entry
; - nsk.share.test.ThreadLocalRandom::next@-1 (line 131)
0x00007f41f9d72426: mov $0x30,%ecx
0x00007f41f9d7242b: sub %edx,%ecx
0x00007f41f9d7242d: mov $0xffffffffffff,%r10
But instead of push+sub instructions:
0x00007f41f9d72420: 55 48 83 ec 10 90
it has jmpq instruction which seems patch instruction when method was changed to zombee.
|
|
|
EVALUATION
patch_verified_entry() is not MT safe since it patched 2 instructions instead of one. First instruction (push rbp) could be already executed by a thread when it is patched over by one jmpq instruction.
|
|
|
EVALUATION
Instruction 'jmpq' starts in byte before ( 0x7fceabbd3360) but for some reason code executed from next byte:
Instructions: (pc=0x00007fceabbd3361)
0x00007fceabbd3341: 8b 56 08 49 c1 e2 03 49 3b c2 0f 85 cf 65 d6 ff
0x00007fceabbd3351: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e9
0x00007fceabbd3361: 3b dc c9 ff 90 b9 30 00 00 00 2b ca 49 ba ff ff
0x00007fceabbd3371: ff ff ff ff 00 00 49 bb 6d e6 ec de 05 00 00 00
;; 00007fceabbd3340 44 8b 56 08 mov 0x8(%rsi),%r10
;; 00007fceabbd3344 49 c1 e2 03 shl $0x3,%r10
;; 00007fceabbd3348 49 3b c2 cmp %r10,%rax
;; 00007fceabbd334b 0f 85 cf 65 d6 ff jne 0x00007fceab939930
;; 00007fceabbd3351 90 nop
...
;; 00007fceabbd335f 90 nop
;; ---------------
;; 00007fceabbd3360 e9 3b dc c9 ff jmpq 0x00007fceab870fa2
;; 00007fceabbd3365 90 nop
;; 00007fceabbd3366 b9 30 00 00 00 mov $0x30,%ecx
;; 00007fceabbd336b 2b ca sub %edx,%ecx
|
|
|
Java