Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8275809

crash in [CommonComponentAccessibility getCAccessible:withEnv:]

    XMLWordPrintable

    Details

      Backports

        Description

        In the method:

        +[CommonComponentAccessibility getCAccessible:withEnv:]

        the code can crash:

        if ((*env)->IsInstanceOf(env, jaccessible, sjc_CAccessible)) {

        because jaccessible is a weak ref and i is not checked for validity here.

        Below I'm listing a dump that we get from the JetBrains OpenJDK fork (where it has been fixed). The problem is reproduced rarely however it is quite clear from the code:

        Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
        0 libsystem_kernel.dylib 0x00007fff202f3462 __pthread_kill + 10
        1 libsystem_pthread.dylib 0x00007fff20321610 pthread_kill + 263
        2 libsystem_c.dylib 0x00007fff20274720 abort + 120
        3 libjvm.dylib 0x0000000113646920 os::abort(bool, void*, void const*) + 22 (os_bsd.cpp:1094)
        4 libjvm.dylib 0x000000011378a042 VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long) + 2896 (vmError.cpp:1613)
        5 libjvm.dylib 0x00000001137894ce VMError::report_and_die(Thread*, unsigned int, unsigned char*, void*, void*, char const*, ...) + 148 (vmError.cpp:1274)
        6 libjvm.dylib 0x000000011378a117 VMError::report_and_die(Thread*, unsigned int, unsigned char*, void*, void*) + 33 (vmError.cpp:1280)
        7 libjvm.dylib 0x000000011364a730 JVM_handle_bsd_signal + 543 (os_bsd_x86.cpp:803)
        8 libjvm.dylib 0x00000001136483c8 signalHandler(int, __siginfo*, void*) + 45 (os_bsd.cpp:2854)
        9 libsystem_platform.dylib 0x00007fff20365d7d _sigtramp + 29
        10 ??? 0x00000001b6dd1858 0 + 7362910296
        11 libawt_lwawt.dylib 0x000000013dcf0019 +[JavaComponentAccessibility getCAccessible:withEnv:] + 849 (JavaComponentAccessibility.m:269)
        12 libawt_lwawt.dylib 0x000000013dcf1348 +[JavaComponentAccessibility createWithParent:accessible:role:index:withEnv:withView:isWrapped:] + 608 (JavaComponentAccessibility.m:385)
        13 libawt_lwawt.dylib 0x000000013dcedd38 -[JavaCellAccessibility accessibilityChildren] + 185 (JavaCellAccessibility.m:18)
        14 com.apple.AppKit 0x00007fff22cd865a -[NSAccessibilityAttributeAccessorInfo getAttributeValue:forObject:] + 58
        15 com.apple.AppKit 0x00007fff2327807a ___NSAccessibilityEntryPointValueForAttribute_block_invoke.811 + 1691
        16 com.apple.AppKit 0x00007fff23273ce3 NSAccessibilityPerformEntryPointObject + 16
        17 com.apple.AppKit 0x00007fff22f33a26 _NSAccessibilityEntryPointValueForAttribute + 168
        18 com.apple.AppKit 0x00007fff23069ab2 _NSAccessibilityChildrenInNavigationOrderAttributeValue + 40
        19 com.apple.AppKit 0x00007fff22cd958a NSAccessibilityGetObjectValueForAttribute + 2724
        20 com.apple.AppKit 0x00007fff22cd865a -[NSAccessibilityAttributeAccessorInfo getAttributeValue:forObject:] + 58
        21 com.apple.AppKit 0x00007fff2327807a ___NSAccessibilityEntryPointValueForAttribute_block_invoke.811 + 1691
        22 com.apple.AppKit 0x00007fff23273ce3 NSAccessibilityPerformEntryPointObject + 16
        23 com.apple.AppKit 0x00007fff22f33a26 _NSAccessibilityEntryPointValueForAttribute + 168
        24 com.apple.AppKit 0x00007fff2306bf05 -[NSObject(NSAccessibilityInternal) _accessibilityValueForAttribute:clientError:] + 341
        25 com.apple.AppKit 0x00007fff23070eb6 CopyAppKitUIElementAttributeValueNoCatch + 98
        26 com.apple.AppKit 0x00007fff2306de6b CopyAttributeValue + 142
        27 com.apple.HIServices 0x00007fff256ada2b _AXXMIGCopyAttributeValue + 409
        28 com.apple.HIServices 0x00007fff256cf82b _XCopyAttributeValue + 443
        29 com.apple.HIServices 0x00007fff2568e704 mshMIGPerform + 174
        30 com.apple.CoreFoundation 0x00007fff2041a188 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41
        31 com.apple.CoreFoundation 0x00007fff2041a065 __CFRunLoopDoSource1 + 595
        32 com.apple.CoreFoundation 0x00007fff20418709 __CFRunLoopRun + 2402
        33 com.apple.CoreFoundation 0x00007fff204176ce CFRunLoopRunSpecific + 563
        34 com.apple.HIToolbox 0x00007fff2869c6d0 RunCurrentEventLoopInMode + 292
        35 com.apple.HIToolbox 0x00007fff2869c4cc ReceiveNextEventCommon + 709
        36 com.apple.HIToolbox 0x00007fff2869c1ef _BlockUntilNextEventMatchingListInModeWithFilter + 64
        37 com.apple.AppKit 0x00007fff22c34de9 _DPSNextEvent + 883
        38 com.apple.AppKit 0x00007fff22c335af -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1366
        39 libosxapp.dylib 0x000000013e14e1ea -[NSApplicationAWT nextEventMatchingMask:untilDate:inMode:dequeue:] + 121 (NSApplicationAWT.m:385)
        40 com.apple.AppKit 0x00007fff22c25b0a -[NSApplication run] + 586
        41 libosxapp.dylib 0x000000013e14dfcf +[NSApplicationAWT runAWTLoopWithApp:] + 165 (NSApplicationAWT.m:343)
        42 libawt_lwawt.dylib 0x000000013dd024c2 +[AWTStarter starter:headless:] + 496
        43 libosxapp.dylib 0x000000013e14fd6c +[ThreadUtilities invokeBlockCopy:] + 15 (ThreadUtilities.m:98)
        44 com.apple.Foundation 0x00007fff211c54d9 __NSThreadPerformPerform + 204
        45 com.apple.CoreFoundation 0x00007fff20419a0c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
        46 com.apple.CoreFoundation 0x00007fff20419974 __CFRunLoopDoSource0 + 180
        47 com.apple.CoreFoundation 0x00007fff204196ef __CFRunLoopDoSources0 + 248
        48 com.apple.CoreFoundation 0x00007fff20418121 __CFRunLoopRun + 890
        49 com.apple.CoreFoundation 0x00007fff204176ce CFRunLoopRunSpecific + 563
        50 libjli.dylib 0x000000010a42e8a4 ParkEventLoop + 98 (java_md_macosx.c:323) [inlined]
        51 libjli.dylib 0x000000010a42e8a4 MacOSXStartup + 178 (java_md_macosx.c:356) [inlined]
        52 libjli.dylib 0x000000010a42e8a4 CreateExecutionEnvironment + 381 (java_md_macosx.c:403)
        53 libjli.dylib 0x000000010a42acab JLI_Launch + 1287 (java.c:276)
        54 java 0x000000010a419f64 main + 372 (main.c:206)
        55 libdyld.dylib 0x00007fff2033c621 start + 1

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                ant Anton Tarasov
                Reporter:
                ant Anton Tarasov
                Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved: