Possible bug in PoolThreadCache

Expected behavior

no jvm crash

Actual behavior

jvm crash

Steps to reproduce

no reproducer

Netty version

4.1.51

JVM version (e.g. java -version)

Zulu11.43+22-SA (11.0.9+11) (build 11.0.9+11-LTS)

OS version (e.g. uname -a)

OS:CentOS Linux release 7.8.2003 (Core) uname:Linux 3.10.0-1127.18.2.el7.x86_64 #1 SMP Sun Jul 26 15:27:06 UTC 2020 x86_64

I was working on a JVM crash and I suspect it’s a netty bug

jvm crashes when G1GC processes an object and this object has bad “next” value

inspect 0x7fc1800ebf60 instance of Oop for java/lang/ref/WeakReference @ 0x00007fc1800ebf60 @ 0x00007fc1800ebf60 (size = 48) <<Reverse pointers>>: _mark: 140464753441755 _metadata._klass: InstanceKlass for java/lang/ref/WeakReference referent: Oop for java/lang/Thread @ 0x00007fc18006f248 Oop for java/lang/Thread @ 0x00007fc18006f248 queue: Oop for java/lang/ref/ReferenceQueue$Null @ 0x00007fbca100f7c8 Oop for java/lang/ref/ReferenceQueue$Null @ 0x00007fbca100f7c8 next: ** BAD OOP 7fb85457a40000 ** discovered: null null

the value for “next” is left shifted ( by 8 bits) address of JavaThread 0x00007fb85457a400 JavaThread “data-server-tcp-socket-worker-1301” daemon [_thread_in_native, id=214144, stack(0x00007fb2b9ac0000,0x00007fb2b9bc1000)]

the object 0x7fc1800ebf60 (java.lang.ref.WeakReference<Thread>) was created by netty Here is path to roots for this object (NOTE: visualvm shows null instead of bad OOP values)

I suspect the netty might have some issues when working with j.l.r.WeakReference<Thread> in Recycler.java

[VladimirKempik]

I will try, I don’t possess the reproducer tho.

[franz1981]

I can confirm what @normanmaurer and @hyperxpro said here: on JCTools Jdk 11 just work with sun misc Unsafe OOTB