The mark phase stops each lightweight thread by raising {@code threadBlockedByGC} and + * spinning on {@code threadActive}, and the translator emits no safepoint polls in + * generated code -- not on method entry, not on loop back-edges. Every safepoint lives + * inside a runtime function, so a Java loop that allocates nothing and enters no contended + * monitor reaches none of them and that spin never ends. The reporter's debugger caught it + * at {@code totalwait = 609491500} microseconds -- ten minutes with the whole VM stopped + * behind one compute loop, because every other thread parks at its next allocation waiting + * for a cycle that can never start.
+ * + *{@code cn1_globals.m} now bounds that spin at {@code CN1_GC_SAFEPOINT_WAIT_MAX_US} and + * then freezes the thread with the same SIGUSR2 stop the collector already uses for genuine + * native threads. This gate asserts the outcome and the mechanism, and then rebuilds the + * same translated project with the escalation compiled out ({@code -DCN1_GC_NO_FORCE_STOP}) + * and requires both to fail -- a gate that has never been watched failing proves + * nothing.
+ * + *Every threshold is a RATIO of the workload's own two measurements rather than a + * wall-clock constant, because the failure is "a mutator was stalled for as long as the + * spinner ran" and that duration is whatever the machine makes it. See + * {@code GcUncooperativeThreadApp} for how the two are produced.
+ */ +@Tag("benchmark") +class GcUncooperativeThreadIntegrationTest { + + /** + * Share of the spin a mutator may be stalled for when the escalation works. The stall + * it should actually see is one safepoint bound (CN1_GC_SAFEPOINT_WAIT_MAX_US, 250ms) + * plus a mark, repeated per cycle -- so this is loose on purpose. The two regimes are + * "a fraction of a second" and "the entire spin", and a threshold tight enough to + * flake would be measuring the machine rather than the bug. + * + *Measured on this arm: 0.06 alone, 0.13 with the whole benchmark suite running in + * parallel on the same host. The ablation arm measures 0.98-1.00 in both, so the two + * are separated by roughly an order of magnitude and the margin here is deliberate + * headroom for a loaded runner rather than a number tuned against one.
+ */ + private static final double MAX_STALL_SHARE_FIXED = 0.25; + + /** + * Share of the spin the ABLATION arm must exceed. A wedged VM stalls the allocator + * from whenever the first cycle starts until the spinner ends, so the only thing that + * keeps this below 1.0 is how long the workload takes to get going -- measured 0.98 + * and 1.00. Set at half that, because this half of the gate only has to establish + * that the wedge still reproduces, not to measure it. + */ + private static final double MIN_STALL_SHARE_FAULTED = 0.5; + + /** + * Floor on the spin itself. Below this the ratios above stop separating anything: a + * spin shorter than a collection cycle cannot express a stall that lasts one. The + * fixture calibrates for 6s, so this only catches a machine or a build on which the + * calibration collapsed. + */ + private static final long MIN_SPIN_MS = 2000; + + /** + * Ceiling on one translated run. The ablation arm's spinner is bounded by an iteration + * count, so even a fully wedged VM finishes -- but reading the child to EOF on this + * thread would still hang the fork if that ever stopped being true. + */ + private static final long VM_RUN_TIMEOUT_SECONDS = 600; + + /** What the collector prints when it has to shoot a mutator. */ + private static final String FORCE_STOP_MARKER = "force-stopped thread"; + + @Test + void aComputeOnlyThreadDoesNotStallEverybodyElse() throws Exception { + Parser.cleanup(); + ListParparVM's mark phase stops each lightweight thread cooperatively -- it raises + * {@code threadBlockedByGC} and then spins on {@code threadActive} until the thread parks + * itself -- and the translator emits no safepoint polls in generated code, neither on + * method entry nor on loop back-edges. Every safepoint lives inside a runtime function: + * the allocator handshakes, contended {@code monitorEnter}, {@code Thread.sleep}, and the + * native-call bracket. A Java loop that allocates nothing and enters no contended monitor + * therefore reaches no safepoint at all, and the collector's spin never ends -- taking + * every other thread with it, because they park at their next allocation waiting for a + * cycle that can never start. The reporter's debugger caught the collector ten minutes + * into that spin while a game-tree search ran a compute-only evaluation loop.
+ * + *The shape here is that reduced to its two essential threads:
+ * + *Both figures are printed, and the gate compares them against each other rather than + * against a wall-clock constant: {@code MAXSTALL} is a small fraction of {@code SPINMS} + * when the collector can force the spinner to stop, and essentially all of it when it + * cannot. Self-calibrating, so one pair of thresholds holds on a fast developer machine + * and a slow CI runner alike.
+ * + *The spin length is calibrated at runtime for the same reason -- a fixed iteration + * count is seconds on one machine and milliseconds on another, and a spin shorter than a + * collection cycle cannot express the failure. Calibration runs BEFORE the allocator + * starts, so it measures the machine rather than the contention.
+ * + *Note that the allocator cannot escape the wedge by finishing early: once the + * collector is stuck on the spinner, the allocator blocks at its next page acquisition and + * stays there until the spinner ends. Its chunk count therefore only has to be enough to + * still be running when the spin begins.
+ * + *Declares no natives and uses no Codename One API, so a stock JVM runs it unchanged + * and {@code RESULT} can be compared across the two. {@code RESULT} deliberately excludes + * everything derived from the calibration, which is wall-clock dependent and so differs + * between any two runs. On a stock JVM the spinner is stoppable by construction (HotSpot + * polls at loop back-edges), which is the behaviour this gate asks ParparVM to + * approximate.
+ */ +public class GcUncooperativeThreadApp { + + /** How long the uninterruptible spin should last. Comfortably longer than a collection + * cycle on any runner, so a wedge is unmistakable next to a legitimate GC pause. */ + private static final long TARGET_SPIN_MS = 6000; + + /** Iterations used to measure the machine before sizing the real spin. Large enough to + * take milliseconds rather than to be swallowed by clock granularity. */ + private static final long CALIBRATE_ITERS = 20000000L; + + /** Floor on the calibrated spin, in case the calibration lands inside one clock tick. */ + private static final long MIN_SPIN_ITERS = 200000000L; + + /** Objects per timed chunk on the allocator. A chunk has to cross several BiBOP page + * acquisitions -- the page acquire is where the allocator's own safepoint lives, so a + * chunk that fitted inside one page would never park and would time nothing. */ + private static final int CHUNK_OBJECTS = 20000; + + /** Timed chunks. The measurement is a MAXIMUM, so this only has to keep the allocator + * running into the spin; see the class comment on why it cannot finish during one. */ + private static final int CHUNKS = 1500; + + /** Retained set, so the collector has something real to trace and cycles cost time. */ + private static final int LIVE_SET = 4000; + + /** A small reference-carrying object: reaches the mark worklist, unlike a leaf. */ + private static final class Node { + Node next; + long a; + long b; + + Node(Node next, long a) { + this.next = next; + this.a = a; + this.b = a * 31; + } + } + + /** Iterations for the spin, published before the spinner starts. */ + private static long spinIterations; + + /** Written by the spinner, read only after join. */ + private static volatile long spinResult; + private static volatile long spinMillis; + + /** Held so the retained set cannot be optimized into nothing. */ + private static Node[] liveSet; + + /** + * The unstoppable loop. Pure long arithmetic on locals: no allocation (so no allocator + * handshake), no monitor, no native call, and on ParparVM no back-edge poll either. + * Deliberately NOT split into chunks with a check between them -- a chunk boundary that + * touches the runtime is a safepoint, and the point of this method is to have none. + */ + private static long burn(long iterations) { + long a = 1; + for (long i = 0; i < iterations; i++) { + a = a * 31 + i; + a ^= (a >>> 7); + } + return a; + } + + private static final class Spinner implements Runnable { + public void run() { + long t0 = System.currentTimeMillis(); + long r = burn(spinIterations); + spinMillis = System.currentTimeMillis() - t0; + spinResult = r; + } + } + + public static void main(String[] args) throws Exception { + // Retained set first: a collection that finds nothing to do finishes instantly and + // would not hold the allocator long enough for the comparison to mean anything. + liveSet = new Node[LIVE_SET]; + for (int i = 0; i < LIVE_SET; i++) { + liveSet[i] = new Node(i > 0 ? liveSet[i - 1] : null, i); + } + + // Size the spin against THIS machine, before any contention exists. + long calStart = System.currentTimeMillis(); + long calAcc = burn(CALIBRATE_ITERS); + long calMs = System.currentTimeMillis() - calStart; + long iters = calMs <= 0 ? MIN_SPIN_ITERS : (CALIBRATE_ITERS * TARGET_SPIN_MS) / calMs; + if (iters < MIN_SPIN_ITERS) { + iters = MIN_SPIN_ITERS; + } + spinIterations = iters; + + Thread spinner = new Thread(new Spinner()); + spinner.start(); + + // The allocator. Every chunk is timed; the maximum is the report. + long maxStallMs = 0; + long checksum = 0; + for (int chunk = 0; chunk < CHUNKS; chunk++) { + long t0 = System.currentTimeMillis(); + Node head = null; + for (int i = 0; i < CHUNK_OBJECTS; i++) { + head = new Node(head, chunk * 31L + i); + } + checksum += head.b; + // Keep the retained set churning so marking has real work every cycle. + liveSet[chunk % LIVE_SET] = new Node(null, chunk); + long dt = System.currentTimeMillis() - t0; + if (dt > maxStallMs) { + maxStallMs = dt; + } + } + + spinner.join(); + + System.out.println("SPINMS=" + spinMillis); + System.out.println("MAXSTALL=" + maxStallMs); + System.out.println("SPINACC=" + spinResult); + System.out.println("RESULT=" + (checksum ^ calAcc ^ liveSet[0].b)); + System.out.println("GC_UNCOOPERATIVE_DONE"); + } +}