Review request (S): 7021322: assert(object_end <= top()) failed: Object crosses promotion LAB boundary

Stefan Karlsson stefan.karlsson at
Mon Sep 12 20:49:34 UTC 2011

There's a bug in parallel scavenge when array chunking is used. After a 
thread has succeeded in forwarding the pointer to a newly copied array, 
it might change the length of the old object. This is done as a part of 
the load balancing.
If another thread races with the forwarding thread, it might read the 
incorrect array length and copy just a part of the array. When it later 
sees that the object has already been forwarded and calls 
unallocate_object, it uses the original length of the array to determine 
the size to unallocate.

The fix is to pass the actual amount of memory that was allocated, to 

Tested with the failing test.


More information about the hotspot-gc-dev mailing list