Tomcat 7.0.59因StringCache.findClosest触发SIGSEGV崩溃求助

我之前碰到过一模一样的问题，这个崩溃是Java 8u51版本的C2 JIT编译器和Tomcat的StringCache组件交互的已知bug，在高并发场景下很容易触发。下面给你几个可行的解决办法：

解决方案选项 #

• 升级Java版本（推荐）：Java 8u60及后续版本已经修复了这个C2编译器的bug，直接升级到Java 8u60或更高的维护版本（比如8u301、8u391这类官方支持的版本），就能彻底解决这个问题，同时还能获得其他安全和性能修复。
• 临时禁用C2编译器：如果暂时没法升级Java，可以在Tomcat的JVM启动参数里添加 -XX:-TieredCompilation 或者 -XX:TieredStopAtLevel=1，关闭C2的优化编译，避免触发崩溃。这个方案会有轻微的性能下降，但能快速恢复服务稳定性。
• 关闭Tomcat的StringCache：添加JVM启动参数 -Dorg.apache.tomcat.util.buf.StringCache.disable=true，直接禁用Tomcat的这个字符串缓存组件，从根源上避免调用出问题的findClosest方法。

你提供的崩溃日志 #

# # A fatal error has been detected by the Java Runtime Environment:
# # SIGSEGV (0xb) at pc=0x00002aaaadfe68b5, pid=3318, tid=1376909632
# #
# JRE version: Java(TM) SE Runtime Environment (8.0_51-b16) (build 1.8.0_51-b16)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.51-b03 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# J 15283 C2 org.apache.tomcat.util.buf.StringCache.findClosest(Lorg/apache/tomcat/util/buf/ByteChunk;[Lorg/apache/tomcat/util/buf/StringCache$ByteEntry;I)I (119 bytes) @ 0x00002aaaadfe68b5 [0x00002aaaadfe65e0+0x2d5]
# # Core dump written. Default location: /home/xxx/core or core.3318
# # If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
# --------------- T H R E A D ---------------
Current thread (0x00002aaadc530800): JavaThread "zs-exec-65" daemon [_thread_in_Java, id=3903, stack(0x000000005201f000,0x0000000052120000)]

siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x00000000000001e8

Registers:
RAX=0x00000006d517ad08, RBX=0x0000000000004000, RCX=0x0000000000000076, RDX=0x0000000000000065
RSP=0x000000005211e350, RBP=0x0000000000000074, RSI=0x0000000000000011, RDI=0x0000000000000000
R8 =0x000000000000000d, R9 =0x000000000000000c, R10=0x0000000000000000, R11=0x00000000000000ed
R12=0x0000000000000000, R13=0x00000006db952db0, R14=0x0000000000000075, R15=0x00002aaadc530800
RIP=0x00002aaaadfe68b5, EFLAGS=0x0000000000010293, CSGSFS=0x0000000000000033, ERR=0x0000000000000004
TRAPNO=0x000000000000000e

Top of Stack: (sp=0x000000005211e350)
0x000000005211e350:   0000000d000000c8 00000078fffffd28
0x000000005211e360:   00000006db9de448 000002d8000002d8
0x000000005211e370:   00000007c04e0f40 00002aaaafdc03b4
0x000000005211e380:   0000000743a0dda8 00000006d38a4868
0x000000005211e390:   0000000000000009 0000000000000001
0x000000005211e3a0:   00000006db957700 00002aaaaeba6a28
0x000000005211e3b0:   00000083000000c8 00000062ffffffe7
0x000000005211e3c0:   00000006d398c060 00000006c358efe0
0x000000005211e3d0:   0000000000000000 00000006db6f1de8
0x000000005211e3e0:   0000000000000082 00002aaaac5bbba8
0x000000005211e3f0:   00000006db959740 00002aaaad15f12c
0x000000005211e400:   7f2396bcc3d08790 00000006d398c060
0x000000005211e410:   00000006c358efe0 000000010000003c
0x000000005211e420:   00000006db959640 00002aaaaeee3ef0
0x000000005211e430:   00000006db959610 0000000743a0e168
0x000000005211e440:   00000006db6f1de8 0000000600000082
0x000000005211e450:   00000000db72aeda 00002aaaae0ed654
0x000000005211e460:   00000006db9576d0 0000000f0000000f
0x000000005211e470:   00000006d398b130 00000006c358efe0
0x000000005211e480:   0000000700000001 00002aaab9012000
0x000000005211e490:   0000000700000083 00002ada74141003
0x000000005211e4a0:   000000005ac72374 00000000000498ea
0x000000005211e4b0:   00000006d75e23a8 00002aaab03a6a20
0x000000005211e4c0:   00000006d75e23a8 00002aaab9012000
0x000000005211e4d0:   00000006c353d408 00000006db95bb38
0x000000005211e4e0:   00000006db95be70 00000006db9cbc98
0x000000005211e4f0:   0000000000000000 0000000743a0e2b8
0x000000005211e500:   00000000da72fb81 00002aaaad861d28
0x000000005211e510:   00000006db9586b0 00000006c351ba78
0x000000005211e520:   0000000000000001 00002aaab02adc80
0x000000005211e530:   0000000743a0d798 0000000200000009
0x000000005211e540:   0000000743a0d780 0000000100000001

Instructions: (pc=0x00002aaaadfe68b5)
0x00002aaaadfe6895:   01 fd 44 8b d9 44 03 5c 24 0c 44 8b f1 41 8b cb
0x00002aaaadfe68a5:   d1 e9 3b 0c 24 0f 83 ad 05 00 00 66 49 0f 7e ca
0x00002aaaadfe68b5:   45 8b 54 8a 10 47 8b 54 d4 0c 43 8b 74 d4 0c 44
0x00002aaaadfe68c5:   8b 5c 24 04 44 3b de 7d 05 45 8b c3 eb 03 44 8b

Register to memory mapping:

RAX=0x00000006d517ad08 is an oop
[B - klass: {type array byte} - length: 17
RBX=0x0000000000004000 is an unknown value
RCX=0x0000000000000076 is an unknown value
RDX=0x0000000000000065 is an unknown value
RSP=0x000000005211e350 is pointing into the stack for thread: 0x00002aaadc530800
RBP=0x0000000000000074 is an unknown value
RSI=0x0000000000000011 is an unknown value
RDI=0x0000000000000000 is an unknown value
R8 =0x000000000000000d is an unknown value
R9 =0x000000000000000c is an unknown value
R10=0x0000000000000000 is an unknown value
R11=0x00000000000000ed is an unknown value
R12=0x0000000000000000 is an unknown value
R13=0x00000006db952db0 is an oop
[B - klass: {type array byte} - length: 16384
R14=0x0000000000000075 is an unknown value
R15=0x00002aaadc530800 is a thread

Stack: [0x000000005201f000,0x0000000052120000], sp=0x000000005211e350, free space=1020k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
J 15283 C2 org.apache.tomcat.util.buf.StringCache.findClosest(Lorg/apache/tomcat/util/buf/ByteChunk;[Lorg/apache/tomcat/util/buf/StringCache$ByteEntry;I)I (119 bytes) @ 0x00002aaaadfe68b5 [0x00002aaaadfe65e0+0x2d5]
......

内容的提问来源于stack exchange，提问作者sadey