On Wed, 11 Nov 2026 12:08:05 GMT, Serguei Spitsyn <[email protected]> wrote:
> JVMTI can mistake a flattened value for its `ClassLoader` holder.
> The function `VM_HeapWalkOperation::visit()` checks the holder object’s type
> instead of the value being visited. During reference walking, a flattened
> field inside a `ClassLoader` subclass therefore enters the class-loader path,
> triggering an assertion in debug builds and potentially reporting incorrect
> references in release builds. The check should use the visited object’s
> represented class.
>
> The problem is in `src/hotspot/share/prims/jvmtiTagMap.cpp:3405`:
>
>
> } else if (java_lang_ClassLoader::is_instance(o.obj())) {
> return iterate_over_class_loader(o);
> }
>
> together with:
>
>
> oop _obj; // for flattened value object this is holder object
>
>
> The fix is in this simple diff:
>
>
> @@ -3402,7 +3402,7 @@ bool VM_HeapWalkOperation::visit(const
> JvmtiHeapwalkObject& o) {
> // a java.lang.Class
> return iterate_over_class(o);
> }
> - } else if (java_lang_ClassLoader::is_instance(o.obj())) {
> + } else if (java_lang_ClassLoader::is_subclass(klass)) {
> return iterate_over_class_loader(o);
> } else {
> // we report stack references only when initial object is not specified
>
>
> Additionally, this update hardened the uses of the `obj()` by adding an
> assert and also replacing it with the `holder()` in relevant places:
>
>
> +++ b/src/hotspot/share/prims/jvmtiTagMapTable.hpp
> @@ -58,7 +58,11 @@ class JvmtiHeapwalkObject {
> inline bool is_value() const { return _value_klass != nullptr; }
> inline bool is_flat() const { return _offset != 0; }
>
> - inline oop obj() const { return _obj; }
> + inline oop holder() const { return _obj; }
> + inline oop obj() const {
> + assert(!is_flat(), "flattened value does not have oop");
> + return _obj;
> + }
>
>
> Also, the following test was updated to add a necessary test coverage:
> - `serviceability/jvmti/valhalla/Heapwalking/ValueHeapwalkingTest.java`
>
> Testing:
> - tested with the update test
> `serviceability/jvmti/valhalla/Heapwalking/ValueHeapwalkingTest.java`
> - ran mach5 tiers 1-6 (all are GREEN)
>
> ---------
> - [x] I confirm that I make this contribution in accordance with the [OpenJDK
> Interim AI Policy](https://openjdk.org/legal/ai).
Stefan, thank you for review!
-------------
PR Comment: https://git.openjdk.org/jdk/pull/33843#issuecomment-6850914719
