IV34534: MEMORY CORRUPTION DETECTED DURING J9SEM_DESTROY()

APAR status

• Closed as program error.

Error description

• Error Message: An error message "free(): invalid next size" is
  displayed before JVM crash.
  .
  Stack Trace: *** glibc detected ***
  /j9vm/ascii/builds/bld_127208/sdk/xz6460_26/jre/bin/java:
  free(): invalid next size (fast): 0x00000000800d2a30 ***
  ======= Backtrace: =========
  /lib64/libc.so.6<OSB>0x200000ea456<CSB>
  /lib64/libc.so.6(__libc_free+0x82)<OSB>0x200000eb9e6<CSB>
  /j9vm/ascii/builds/bld_127208/sdk/xz6460_26/jre/lib/s390x/defaul
  t/libj9thr26.so(j9sem_destroy+0x38)<OSB>0x200001d57f0<CSB>
  /j9vm/ascii/builds/bld_127208/sdk/xz6460_26/jre/lib/s390x/defaul
  t/libj9gc26.so<OSB>0x200018b64a4<CSB>
  .
  

Local fix

Problem summary

• malloc header was corrupted because of the off-by-one error when
  assigning free list the the last element of heap free list
  collection.
  

Problem conclusion

• This defect will be fixed in:
  6.0.1 SR5
  7.0.0 SR4
  .
  The JVM has been updated to prevent malloc header corruption
  from occurring by fixing the heap free list iterator.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  J9 COMMON CODE

• Fixed component ID

  620700127

Applicable component levels

• R600 PSY

     UP

• R260 PSY

     UP