Affected versions(only Openjdk)
Output from java -version.
// JDK8
java version "1.8.0_501"
Java(TM) SE Runtime Environment (build 1.8.0_501-b08)
Java HotSpot(TM) 64-Bit Server VM (build 25.501-b08, mixed mode)
// JDK17
java version "17.0.20" 2026-07-21 LTS
Java(TM) SE Runtime Environment (build 17.0.20+7-LTS-191)
Java HotSpot(TM) 64-Bit Server VM (build 17.0.20+7-LTS-191, mixed mode, sharing)
// JDK21
java version "21.0.12" 2026-07-21 LTS
Java(TM) SE Runtime Environment (build 21.0.12+7-LTS-205)
Java HotSpot(TM) 64-Bit Server VM (build 21.0.12+7-LTS-205, mixed mode, sharing)
Summary of problem
A fatal VM crash was found in OpenJ9 when handling an implicit NullPointerException thrown from a JIT-compiled method. The JIT compiler appears to omit or incorrectly generate the stack map (OOMap / Exception metaData) for a specific PC where a hardware SIGSEGV (implicit null check) occurs.
When the exception is raised, the runtime stack walker attempts to locate the catch block but fails to find the stack map metadata for the faulting PC, hitting a fatal assertion in jswalk.c.
Expected Result:
exits silently
Actual Result:
Aborts the VM with JVMCDRT000E and an assertion failure.
JVMCDRT000E Unable to locate JIT stack map - aborting VM
JVMCDRT001E Method: C.m()V (00007F79986C35E0)
JVMCDRT002E Failing PC: 00007F7910CEA29F (offset 000000000000001F), metaData = 00007F7969A55C78
13:43:06.755 0x14e900j9codertvm(j9ji.110 * ** ASSERTION FAILED ** at /home/jenkins/workspace/build-scripts/jobs/jdk21u/jdk21u-linux-x64-openj9/workspace/build/src/openj9/runtime/codert_vm/jswalk.c:548: ((0 ))
JVMDUMP039I Processing dump event "traceassert", detail "" at 2026/08/18 21:43:06 - please wait.
JVMDUMP032I JVM requested System dump using '/share/mutTools/04TypeFuzz/TypeFuzz-findBug3/core.20260818.214306.1511909.0001.dmp' in response to an event
JVMPORT030W /proc/sys/kernel/core_pattern setting "|/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -F%F -- %E" specifies that the core dump is to be piped to an external program. Attempting to rename either core or core.1512080. Review the manual for the external program to find where the core dump is written and ensure the program does not truncate it.
JVMPORT049I The core file created by child process with pid = 1512080 was not found. Review the documentation for the /proc/sys/kernel/core_pattern program "|/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -F%F -- %E" to find where the core file is written and ensure that program does not truncate it.
JVMDUMP012E Error in System dump: /share/mutTools/04TypeFuzz/TypeFuzz-findBug3/core.20260818.214306.1511909.0001.dmp
JVMDUMP032I JVM requested Java dump using '/share/mutTools/04TypeFuzz/TypeFuzz-findBug3/javacore.20260818.214306.1511909.0002.txt' in response to an event
JVMDUMP012E Error in Java dump: /share/mutTools/04TypeFuzz/TypeFuzz-findBug3/javacore.20260818.214306.1511909.0002.txt
JVMDUMP032I JVM requested Snap dump using '/share/mutTools/04TypeFuzz/TypeFuzz-findBug3/Snap.20260818.214306.1511909.0003.trc' in response to an event
JVMDUMP010I Snap dump written to /share/mutTools/04TypeFuzz/TypeFuzz-findBug3/Snap.20260818.214306.1511909.0003.trc
JVMDUMP056I Processed dump event "traceassert", detail "" at 2026/08/18 21:43:13 (6.520 seconds).
Source Code
public class Test {
static volatile boolean _Fuzz_Poly_Flag = true;
private int idx = ((Integer) (1));
private double[] arr;
public void m() {
for (int i = 0; i < 1; ++i) {
double x = arr[idx];// should throw NullPointerException
}
}
public static void main(String[] args) {
Test c; if (_Fuzz_Poly_Flag) { c = new _Poly_Sub_Test(); } else { c = new Test(); };
for (int i = ((Integer) (0)); ((float) (i)) < 10000; ++i) {
try {
c.m();
} catch (NullPointerException ignored) {
}
}
}
private static class _Poly_Sub_Test extends Test {
public _Poly_Sub_Test() {
super();
}
@Override
public void m() {
if (this == null && this != null) { return; } super.m();
}
}
}
Steps to reproduce
- Compile the Test.java.
- Run with -Xcomp.
Affected versions(only Openjdk)
Output from
java -version.Summary of problem
A fatal VM crash was found in OpenJ9 when handling an implicit NullPointerException thrown from a JIT-compiled method. The JIT compiler appears to omit or incorrectly generate the stack map (OOMap / Exception metaData) for a specific PC where a hardware SIGSEGV (implicit null check) occurs.
When the exception is raised, the runtime stack walker attempts to locate the catch block but fails to find the stack map metadata for the faulting PC, hitting a fatal assertion in jswalk.c.
Expected Result:
exits silently
Actual Result:
Aborts the VM with JVMCDRT000E and an assertion failure.
Source Code
Steps to reproduce