# HG changeset patch
# User kbarrett
# Date 1611314452 0
# Node ID bc32046eef898e8a83f9f5fb1bb77e5f10f467ea
# Parent  6f024d171932fc632e5a5a4b316b072675de23df
8259271: gc/parallel/TestDynShrinkHeap.java still fails "assert(covered_region.contains(new_memregion)) failed: new region is not in covered_region"
Summary: Use load_acquire to order reads of top and end.
Reviewed-by: tschatzl, iwalulya, eosterlund

diff -r 6f024d171932 -r bc32046eef89 src/share/vm/gc_implementation/shared/mutableSpace.cpp
--- a/src/share/vm/gc_implementation/shared/mutableSpace.cpp	Thu Dec 17 14:18:00 2020 +0000
+++ b/src/share/vm/gc_implementation/shared/mutableSpace.cpp	Fri Jan 22 11:20:52 2021 +0000
@@ -28,6 +28,7 @@
 #include "gc_implementation/shared/mutableSpace.hpp"
 #include "gc_implementation/shared/spaceDecorator.hpp"
 #include "oops/oop.inline.hpp"
+#include "runtime/orderAccess.hpp"
 #include "runtime/safepoint.hpp"
 #include "runtime/thread.hpp"
 #endif // INCLUDE_ALL_GCS
@@ -192,7 +193,11 @@
 // This version is lock-free.
 HeapWord* MutableSpace::cas_allocate(size_t size) {
   do {
-    HeapWord* obj = top();
+    // Read top before end, else the range check may pass when it shouldn't.
+    // If end is read first, other threads may advance end and top such that
+    // current top > old end and current top + size > current end.  Then
+    // pointer_delta underflows, allowing installation of top > current end.
+    HeapWord* obj = (HeapWord*)OrderAccess::load_ptr_acquire(top_addr());
     if (pointer_delta(end(), obj) >= size) {
       HeapWord* new_top = obj + size;
       HeapWord* result = (HeapWord*)Atomic::cmpxchg_ptr(new_top, top_addr(), obj);