Review request (S): 7021322: assert(object_end <= top()) failed: Object crosses promotion LAB boundary
stefan.karlsson at oracle.com
Mon Sep 12 20:49:34 UTC 2011
There's a bug in parallel scavenge when array chunking is used. After a
thread has succeeded in forwarding the pointer to a newly copied array,
it might change the length of the old object. This is done as a part of
the load balancing.
If another thread races with the forwarding thread, it might read the
incorrect array length and copy just a part of the array. When it later
sees that the object has already been forwarded and calls
unallocate_object, it uses the original length of the array to determine
the size to unallocate.
The fix is to pass the actual amount of memory that was allocated, to
Tested with the failing test.
More information about the hotspot-gc-dev