Print this page
rev 6908 : 8058209: Race in G1 card scanning could allow scanning of memory covered by PLABs
Summary: Read _top before _gc_time_stamp in saved_mark_word() with LoadLoad order to ensure we get a consistent view
Reviewed-by: brutisso, dcubed, dholmes, stefank

Split Split Close
Expand all
Collapse all
          --- old/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
          +++ new/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
↓ open down ↓ 1007 lines elided ↑ open up ↑
1008 1008  
1009 1009  HeapWord* G1OffsetTableContigSpace::cross_threshold(HeapWord* start,
1010 1010                                                      HeapWord* end) {
1011 1011    _offsets.alloc_block(start, end);
1012 1012    return _offsets.threshold();
1013 1013  }
1014 1014  
1015 1015  HeapWord* G1OffsetTableContigSpace::saved_mark_word() const {
1016 1016    G1CollectedHeap* g1h = G1CollectedHeap::heap();
1017 1017    assert( _gc_time_stamp <= g1h->get_gc_time_stamp(), "invariant" );
1018      -  if (_gc_time_stamp < g1h->get_gc_time_stamp())
1019      -    return top();
1020      -  else
     1018 +  HeapWord* local_top = top();
     1019 +  OrderAccess::loadload();
     1020 +  if (_gc_time_stamp < g1h->get_gc_time_stamp()) {
     1021 +    return local_top;
     1022 +  } else {
1021 1023      return Space::saved_mark_word();
     1024 +  }
1022 1025  }
1023 1026  
1024 1027  void G1OffsetTableContigSpace::record_top_and_timestamp() {
1025 1028    G1CollectedHeap* g1h = G1CollectedHeap::heap();
1026 1029    unsigned curr_gc_time_stamp = g1h->get_gc_time_stamp();
1027 1030  
1028 1031    if (_gc_time_stamp < curr_gc_time_stamp) {
1029 1032      // The order of these is important, as another thread might be
1030 1033      // about to start scanning this region. If it does so after
1031 1034      // set_saved_mark and before _gc_time_stamp = ..., then the latter
↓ open down ↓ 51 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX