IJ40424: CRASH DUE TO WILD JUMP FROM JIT COMPILED METHOD

APAR status

• Closed as program error.

Error description

• Error Message: JVM crashes; the exact appearance of the crash
  can vary and may include GPF, SIGILL, SIGBUS.
  
  This problem can only affect x86 platforms.
  .
  Stack Trace: No specific stack trace is predictable, but
  corefile analysis will show that the problem stems from a call
  or jmp instruction using PC relative addressing where the target
  address makes no sense in the context of the code.
  .
  

Local fix

• The only guaranteed work-around is to disable the JIT, but since
  this will likely have a significant performance impact it is
  worth excluding just the method that contains the bad call/jmp
  instruction in the initial instance.
  
  To exclude a single method, for example
  a.b.ExampleClass.exampleMethod
  
  -Xjit:exclude={a/b/ExampleClass.exampleMethod(*}
  
  To disable the JIT entirely:
  -Xnojit
  

Problem summary

• This is a rare problem affecting x86 platforms only. The offset
  used in computing the PC-relative displacement for a call used
  in the interface dispatch sequence was off by four bytes. The
  problem can be hit only if a jmp or call instruction is
  generated in one of the specific addresses where the offset is
  very close to overflowing the maximum signed 32 bit value.
  
  When the problem occurs the PC relative address calculation
  overflows causing the call/jmp to target an address 4GBytes away
  from the intended target. In the one reported case to date the
  incorrect offset pointed to unmapped memory and so caused an
  immediate GPF.
  
  Notes for service engineers:
  PC relative addresses are signed 32 bit values, so they overflow
  from positive to negative at 0x80000000. In disassembly you see
  the call (0xe8) or jmp (0xe9) followed by the wrapped offset in
  reversed order. The disassembler will calculate the resulting
  absolute address from the PC plus the offset and show that in
  the mnemonic, e.g.
  
  e803000080           call      0x7f75570dc6b0 // target address
  unreadable or inappropriate
  

Problem conclusion

• The test for whether a call/jmp target is reachable with a pc
  relative offset has been corrected so that it returns the
  correct answer for all addresses.
  
  For more details see the OpenJ9 pull request:
  https://github.com/eclipse-openj9/openj9/pull/15024
  .
  This APAR will be fixed in the following Releases:
  .
  IBM SDK, Java Technology Edition
     8    SR7 FP15  (8.0.7.15)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  maintenance can be found at:
             https://www.ibm.com/support/pages/java-sdk
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JIT

• Fixed component ID

  620700124

Applicable component levels