8263107: PSPromotionManager::copy_and_push_safe_barrier needs acquire memory barrier

Reviewed-by: iwalulya, tschatzl, mdoerr

src/hotspot/share/gc/parallel/psClosure.inline.hpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -90,13 +90,8 @@ public:
     if (PSScavenge::should_scavenge(p)) {
       assert(PSScavenge::should_scavenge(p, true), "revisiting object?");
 
-      oop o = *p;
-      oop new_obj;
-      if (o->is_forwarded()) {
-        new_obj = o->forwardee();
-      } else {
-        new_obj = _pm->copy_to_survivor_space</*promote_immediately=*/false>(o);
-      }
+      oop o = RawAccess<IS_NOT_NULL>::oop_load(p);
+      oop new_obj = _pm->copy_to_survivor_space</*promote_immediately=*/false>(o);
       RawAccess<IS_NOT_NULL>::oop_store(p, new_obj);
 
       if (PSScavenge::is_obj_in_young(new_obj)) {

src/hotspot/share/gc/parallel/psPromotionManager.hpp

@@ -110,6 +110,9 @@ class PSPromotionManager {
 
   static PSScannerTasksQueueSet* stack_array_depth() { return _stack_array_depth; }
 
+  template<bool promote_immediately>
+  oop copy_unmarked_to_survivor_space(oop o, markWord m);
+
  public:
   // Static
   static void initialize();

src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp

@@ -38,6 +38,7 @@
 #include "memory/iterator.inline.hpp"
 #include "oops/access.inline.hpp"
 #include "oops/oop.inline.hpp"
+#include "runtime/orderAccess.hpp"
 #include "runtime/prefetch.inline.hpp"
 
 inline PSPromotionManager* PSPromotionManager::manager_array(uint index) {
@@ -126,24 +127,38 @@ inline void PSPromotionManager::push_contents(oop obj) {
     obj->oop_iterate_backwards(&pcc);
   }
 }
+
+template<bool promote_immediately>
+inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
+  assert(should_scavenge(&o), "Sanity");
+
+  // NOTE! We must be very careful with any methods that access the mark
+  // in o. There may be multiple threads racing on it, and it may be forwarded
+  // at any time.
+  markWord m = o->mark();
+  if (!m.is_marked()) {
+    return copy_unmarked_to_survivor_space<promote_immediately>(o, m);
+  } else {
+    // Ensure any loads from the forwardee follow all changes that precede
+    // the release-cmpxchg that performed the forwarding, possibly in some
+    // other thread.
+    OrderAccess::acquire();
+    // Return the already installed forwardee.
+    return cast_to_oop(m.decode_pointer());
+  }
+}
+
 //
 // This method is pretty bulky. It would be nice to split it up
 // into smaller submethods, but we need to be careful not to hurt
 // performance.
 //
 template<bool promote_immediately>
-inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
+inline oop PSPromotionManager::copy_unmarked_to_survivor_space(oop o,
+                                                               markWord test_mark) {
   assert(should_scavenge(&o), "Sanity");
 
   oop new_obj = NULL;
-
-  // NOTE! We must be very careful with any methods that access the mark
-  // in o. There may be multiple threads racing on it, and it may be forwarded
-  // at any time. Do not use oop methods for accessing the mark!
-  markWord test_mark = o->mark();
-
-  // The same test as "o->is_forwarded()"
-  if (!test_mark.is_marked()) {
   bool new_obj_is_tenured = false;
   size_t new_obj_size = o->size();
 
@@ -238,7 +253,8 @@ inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
 
   // Now we have to CAS in the header.
   // Make copy visible to threads reading the forwardee.
-    if (o->cas_forward_to(new_obj, test_mark, memory_order_release)) {
+  oop forwardee = o->forward_to_atomic(new_obj, test_mark, memory_order_release);
+  if (forwardee == NULL) {  // forwardee is NULL when forwarding is successful
     // We won any races, we "own" this object.
     assert(new_obj == o->forwardee(), "Sanity");
 
@@ -250,6 +266,11 @@ inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
       assert(young_space()->contains(new_obj), "Attempt to push non-promoted obj");
     }
 
+    log_develop_trace(gc, scavenge)("{%s %s " PTR_FORMAT " -> " PTR_FORMAT " (%d)}",
+                                    new_obj_is_tenured ? "copying" : "tenuring",
+                                    new_obj->klass()->internal_name(),
+                                    p2i((void *)o), p2i((void *)new_obj), new_obj->size());
+
     // Do the size comparison first with new_obj_size, which we
     // already have. Hopefully, only a few objects are larger than
     // _min_array_size_for_chunking, and most of them will be arrays.
@@ -264,9 +285,15 @@ inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
       // we'll just push its contents
       push_contents(new_obj);
     }
+    return new_obj;
   } else {
-      // We lost, someone else "owns" this object
-      guarantee(o->is_forwarded(), "Object must be forwarded if the cas failed.");
+    // We lost, someone else "owns" this object.
+    // Ensure loads from the forwardee follow all changes that preceeded the
+    // release-cmpxchg that performed the forwarding in another thread.
+    OrderAccess::acquire();
+
+    assert(o->is_forwarded(), "Object must be forwarded if the cas failed.");
+    assert(o->forwardee() == forwardee, "invariant");
 
     // Try to deallocate the space.  If it was directly allocated we cannot
     // deallocate it, so we have to test.  If the deallocation fails,
@@ -278,23 +305,8 @@ inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
     } else if (!_young_lab.unallocate_object(cast_from_oop<HeapWord*>(new_obj), new_obj_size)) {
       CollectedHeap::fill_with_object(cast_from_oop<HeapWord*>(new_obj), new_obj_size);
     }
-
-      // don't update this before the unallocation!
-      // Using acquire though consume would be accurate for accessing new_obj.
-      new_obj = o->forwardee_acquire();
+    return forwardee;
   }
-  } else {
-    assert(o->is_forwarded(), "Sanity");
-    new_obj = o->forwardee_acquire();
-  }
-
-  // This code must come after the CAS test, or it will print incorrect
-  // information.
-  log_develop_trace(gc, scavenge)("{%s %s " PTR_FORMAT " -> " PTR_FORMAT " (%d)}",
-                                  should_scavenge(&new_obj) ? "copying" : "tenuring",
-                                  new_obj->klass()->internal_name(), p2i((void *)o), p2i((void *)new_obj), new_obj->size());
-
-  return new_obj;
 }
 
 // Attempt to "claim" oop at p via CAS, push the new obj if successful
@@ -305,18 +317,7 @@ inline void PSPromotionManager::copy_and_push_safe_barrier(T* p) {
   assert(should_scavenge(p, true), "revisiting object?");
 
   oop o = RawAccess<IS_NOT_NULL>::oop_load(p);
-  oop new_obj = o->is_forwarded()
-        ? o->forwardee()
-        : copy_to_survivor_space<promote_immediately>(o);
-
-  // This code must come after the CAS test, or it will print incorrect
-  // information.
-  if (log_develop_is_enabled(Trace, gc, scavenge) && o->is_forwarded()) {
-    log_develop_trace(gc, scavenge)("{%s %s " PTR_FORMAT " -> " PTR_FORMAT " (%d)}",
-                      "forwarding",
-                      new_obj->klass()->internal_name(), p2i((void *)o), p2i((void *)new_obj), new_obj->size());
-  }
-
+  oop new_obj = copy_to_survivor_space<promote_immediately>(o);
   RawAccess<IS_NOT_NULL>::oop_store(p, new_obj);
 
   // We cannot mark without test, as some code passes us pointers

src/hotspot/share/gc/parallel/psScavenge.hpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2021, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -133,8 +133,6 @@ class PSScavenge: AllStatic {
   template <class T> static inline bool should_scavenge(T* p, MutableSpace* to_space);
   template <class T> static inline bool should_scavenge(T* p, bool check_to_space);
 
-  static void copy_and_push_safe_barrier_from_klass(PSPromotionManager* pm, oop* p);
-
   // Is an object in the young generation
   // This assumes that the 'o' is in the heap,
   // so it only checks one side of the complete predicate.

src/hotspot/share/oops/oop.hpp

@@ -257,7 +257,6 @@ class oopDesc {
   inline oop forward_to_atomic(oop p, markWord compare, atomic_memory_order order = memory_order_conservative);
 
   inline oop forwardee() const;
-  inline oop forwardee_acquire() const;
 
   // Age of object during scavenge
   inline uint age() const;

src/hotspot/share/oops/oop.inline.hpp

@@ -305,13 +305,6 @@ oop oopDesc::forwardee() const {
   return cast_to_oop(mark().decode_pointer());
 }
 
-// Note that the forwardee is not the same thing as the displaced_mark.
-// The forwardee is used when copying during scavenge and mark-sweep.
-// It does need to clear the low two locking- and GC-related bits.
-oop oopDesc::forwardee_acquire() const {
-  return cast_to_oop(Atomic::load_acquire(&_mark).decode_pointer());
-}
-
 // The following method needs to be MT safe.
 uint oopDesc::age() const {
   assert(!is_forwarded(), "Attempt to read age from forwarded mark");