Bug ID: JDK-5050387 JVM crash when JOptionPane invoked in drop() method

JDK-5050387 : JVM crash when JOptionPane invoked in drop() method

Details

Type:	Bug	Submit Date:	2004-05-20
Status:	Closed	Updated Date:	2007-07-02
Project Name:	JDK	Resolved Date:	2007-07-02
Component:	client-libs	OS:	generic
Sub-Component:	java.awt	CPU:	generic
Priority:	P4
Resolution:	Won't Fix
Affected Versions:	5.0
Fixed Versions:

Related Reports

Relates:

JDK-4623377 - REGRESSION: JOptionPane hangs resulting in 100% of cpu usage(when DND)

Sub Tasks

Description

JVM crashes when JOptionPane is displayed from the drop() method. When the drop occurs, the JOptionPane is displayed, but the JVM crashes after that. This happens only when the JOptionPane is displayed before the dropComplete() method is called. Please see the bug 4623377. The testcase attached is the same one given in the description of that bug. Please see the log also attached.

The crash is not consistent. It occurs on Solaris and Linux only with MToolkit. I was able to reproduce the problem in both the OS in 2-3 drag & drops.

Steps to reproduce:
1. Run the attached code.
2. Drag a node from the tree and drop it on the tree itself.
3. Repeat it 2-3 times and it can be seen that the JVM crashes.

Comments

EVALUATION

As it is stated in the description section. The problem is an MToolkit specific issue.  We are going to remove MToolkit in 7.0, and so we will not fix this particular CR. Therefor I am closing the change request.

2007-07-02

EVALUATION

I have been able to reproduce the crash without 
the use of DGA, on both jdk5 and jdk6, only with MToolkit.
(Solaris 10, JDS3)

It crashes after a couple of drag/drops. It helps if instead
of clicking "ok" on the appearing dialog you just hit
Enter.

The stack for jdk6:
 3435   }
 3436
 3437   static void
 3438   dt_notify_drop_done(JNIEnv* env, XClientMessageEvent* xclient, jboolean success,
 3439                       jint action) {
 3440       if (xclient->message_type == XA_XdndDrop) {
 3441           Display* dpy = xclient->display;
 3442           XClientMessageEvent finished;
 3443           long* event_data = xclient->data.l;
 3444
 3445           /*
(dbx 9) w
current thread: t@19
  [1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xfc00, 0x0), at 0xff2c0f90
  [2] raise(0x6, 0x0, 0xff2a4a98, 0xffffffff, 0xff2e8284, 0x6), at 0xff25fd78
  [3] abort(0xd4d7dbc8, 0x1, 0xfe05e428, 0xa83f0, 0xff2eb298, 0x0), at 0xff23ff98
  [4] os::abort(0x1, 0xffd04200, 0xfef01f3c, 0xfeba7150, 0xfeee0c80, 0xfef01f3c), at 0xfe04fc90
  [5] VMError::report_and_die(0x76d32, 0x76c00, 0xfef01f3c, 0xfef19c82, 0x1, 0x1), at 0xfe3c5e38
  [6] report_assertion_failure(0xfeb2bc54, 0x97, 0xfeb2bc8f, 0x3d95b, 0xfeea2f50, 0x3d800), at 0xfd804c78
  [7] methodOopDesc::bci_from(0xd71216a0, 0x3dd7c, 0xd71216a0, 0xfeea2f50, 0xd71216d8, 0xfeb2bc8f), at 0xfdfba188
  [8] frame::interpreter_frame_bci(0x3dd7c, 0x47164, 0x753800, 0x47000, 0xfe05f6f4, 0x3dc00), at 0xfd89c4d0
  [9] frame::print_on_error(0xd4d7e268, 0xd4d7e268, 0xfef278d0, 0x7d0, 0xd4d7e1b0, 0xff8af390), at 0xfd89dc94
  [10] VMError::report(0xd4d7e268, 0x84980, 0xd4d7e358, 0x84800, 0x7d0, 0xfeea2f50), at 0xfe3c4944
  [11] VMError::report_and_die(0xd4d7e358, 0x76cc8, 0x76c00, 0x85800, 0x85920, 0x76d00), at 0xfe3c587c
  [12] JVM_handle_solaris_signal(0xb, 0xffd08dea, 0x2f7000, 0x787000, 0x787000, 0xd5800084), at 0xfe05c6e0
  [13] __sighndlr(0xb, 0xd4d7e7f0, 0xd4d7e538, 0xfe0571e0, 0x0, 0x1), at 0xff2bfec8
  ---- called from signal handler with signal 11 (SIGSEGV) ------
=>[14] dt_notify_drop_done(env = ???, xclient = ???, success = ???, action = ???) (optimized), at 0xd5800084 (line ~3440) in "awt_dnd_dt.c"
  [15] Java_sun_awt_motif_X11DropTargetContextPeer_dropDone(env = ???, this = ???, nativeCtxt = ???, success = ???, action = ???) (optimized), at 0xd5800730 (line ~3575) in "awt_dnd_dt.c"
  [16] 0xfb0170b0(0x20000000, 0xd4d7eaec, 0xd4d7ea68, 0xffffff80, 0x0, 0x0), at 0xfb0170b0
  [17] 0xfb016f70(0xf00f1128, 0x8, 0x0, 0x14, 0x0, 0xd4d7ea80), at 0xfb016f70

for jdk5 the trace is a bit different:
(dbx 4) w
current thread: t@15
=>[1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xfc00, 0x0), at 0xff340f90
  [2] raise(0x6, 0x0, 0xff324a98, 0xffffffff, 0xff368284, 0x6), at 0xff2dfd78
  [3] abort(0x6800, 0x1, 0x7000, 0xa83f0, 0xff36b298, 0x0), at 0xff2bff98
  [4] os::abort(0x1, 0x0, 0xfefb8cf4, 0xfef86000, 0x6f5c, 0x6c00), at 0xfee42d64
  [5] VMError::report_and_die(0x0, 0xfefdec80, 0xfefd8974, 0x1, 0xfee466f4, 0xfefd8974), at 0xfeebdeb8
  [6] JVM_handle_solaris_signal(0xb, 0xd297f3c0, 0xd297f108, 0x7400, 0x85e0, 0x322c78), at 0xfea6e1d0
  [7] __sighndlr(0xb, 0xd297f3c0, 0xd297f108, 0xfea6d6b4, 0x0, 0x1), at 0xff33fec8
  ---- called from signal handler with signal 11 (SIGSEGV) ------
  [8] 0x0(0x28ef98, 0x0, 0x0, 0x8568f0, 0x856900, 0x4c), at 0x0
  [9] XtPhase2Destroy(0x28ef98, 0x24, 0x0, 0x4dab08, 0x0, 0x212820), at 0xfa8b3f78
  [10] _XtDoPhase2Destroy(0x2d18f8, 0x1, 0xffffffff, 0x7d38b0, 0x7d38c0, 0x1), at 0xfa8b3c7c
  [11] XtDispatchEvent(0x1, 0x154, 0x0, 0x2d18f8, 0xfa8e4000, 0x1), at 0xfa8ae414
  [12] XtAppProcessEvent(0x2d18f8, 0x0, 0xf4240, 0x1, 0x0, 0xd297f69c), at 0xfa8b1d84
  [13] 0xfb49803c(0x1, 0x59010, 0x1a, 0x68, 0xfb4f0ae8, 0xfb4f4a5c), at 0xfb49803c
  [14] 0xfb497874(0x322d30, 0x212820, 0x0, 0x5, 0xfb4f0ae8, 0xfb4f5910), at 0xfb497874
  [15] Java_sun_awt_motif_MToolkit_run(0x322d30, 0xfe9fe5d8, 0x5946c, 0xfea7e414, 0xfb4f0ae8, 0xfefcff80), at 0xfb4976b4
  [16] 0xf880c280(0x322c78, 0xd297fb0c, 0xd297fa98, 0xffffff80, 0x80000000, 0xb1c), at 0xf880c280

Since none of these have any 2D code involved, reassigning to AWT.

2006-12-27

EVALUATION

Name: agR10216			Date: 06/03/2004


Committing to tiger-rc.

###@###.###  2004-06-03


======================================================================

The hotstop error log shows dga_win_grab_common. I am able to reproduce this problem, and I always get the same stack. I wonder - what is wrong so that dga can not execute the call? Transfering to 2D for further evaluation.
###@###.### 2004-06-18

I wonder if there are two separate problems here. One is
related to dga (which I can reproduce on my sparc system with ffb2
with the latest ffb patches installed), 
another is something else, since we don't use dga on linux, and the 
description mentions that the original bug is reproducible on linux as well.

So far it appears that the crash on solaris is reproducible only with
MToolkit. I think that the cause may be a race condition: the drawable
may have been deleted by the time we attempt to grab it.

It could be caused by some code which uses X not being synched on AWT_LOCK -
I recall seeing a couple of places in awt code which do that.

Here's the output of java_g with NOISY_AWT set:
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 6310
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e0006e, ser# 6344
Major opcode 42 (X_SetInputFocus)
Starting drag
Drop
Xerror BadWindow (invalid Window parameter), XID 0, ser# 7320
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 7325
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e00072, ser# 7357
Major opcode 42 (X_SetInputFocus)
Starting drag
Drop
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8090
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8095
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e00076, ser# 8127
Major opcode 42 (X_SetInputFocus)
Starting drag
Drop
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8902
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8909
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e0007a, ser# 8943
Major opcode 42 (X_SetInputFocus)
## nof_mallocs = 3484, nof_frees = 1558
## memory stomp: byte at 1e82a8 in front of object 1e82c0
### previous object (not sure if correct): 1e77d4 (-1414812757 bytes)
### next object (not sure if correct): 1e8390 (0 bytes)
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/os.cpp:340]
#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
#  Internal Error (/BUILD_AREA/jdk1.5.0/hotspot/src/share/vm/runtime/os.cpp, 340 [ Patched ]), pid=25477, tid=19
#
# Java VM: Java HotSpot(TM) Server VM (1.5.0-beta3-b56-debug mixed mode)
#
# Error: memory stomping error
# An error report file with more information is saved as hs_err_pid25477.log
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#
Current thread is 19
Dumping core ...

Note that the crash is different from the one with optimized java. The stack trace:
Current thread (0x00154258):  JavaThread "AWT-EventQueue-0" [_thread_in_Java, id=19]

Stack: [0xd2200000,0xd2280000),  sp=0xd227d3a0,  free space=500k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm_g.so+0xe61f24]
V  [libjvm_g.so+0x562bd0]
V  [libjvm_g.so+0xb54ed8]
V  [libjvm_g.so+0xb54f9c]
V  [libjvm_g.so+0xb556ac]
V  [libjvm_g.so+0x586f2c]
V  [libjvm_g.so+0x57b8dc]
V  [libjvm_g.so+0x57cf38]
v  blob 0xf7cac060
j  java.awt.KeyboardFocusManager.getMostRecentFocusOwner(Ljava/awt/Window;)Ljava/awt/Component;+9
j  java.awt.KeyboardFocusManager.clearMostRecentFocusOwner(Ljava/awt/Component;)V+60
j  java.awt.Component.removeNotify()V+1
j  java.awt.Container.removeNotify()V+67
j  javax.swing.JComponent.removeNotify()V+1
j  javax.swing.JButton.removeNotify()V+23
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  javax.swing.JRootPane.removeNotify()V+5
j  java.awt.Container.removeNotify()V+38
j  java.awt.Window$1DisposeAction.run()V+105
j  java.awt.Window.doDispose()V+16
j  java.awt.Dialog.doDispose()V+1
j  java.awt.Window.dispose()V+1
j  javax.swing.JOptionPane.showOptionDialog(...)I+75

###@###.### 2004-06-21

2004-06-21

SELECT A COUNTRY/REGION
Africa Operation Argentina Australia Austria Bahrain Bangladesh Belgium & Luxembourg Belize Bhutan Bolivia Bosnia & Herzegovina Brasil Brunei Bulgaria Cambodia Canada - English Canada - French Chile China Colombia	Costa Rica Croatia Cyprus Czech Republic Denmark Ecuador Egypt Estonia Finland France Germany Greece Guatemala Honduras Hong Kong Hungary India Indonesia Iraq Ireland	Israel Italy Japan Jordan Kazakhstan Korea Kuwait Laos Latvia Lebanon Lithuania Malaysia Maldives Malta Mexico Moldova Nepal Netherlands New Zealand Nicaragua	Norway Oman Pakistan Panama Paraguay Peru Philippines Poland Portugal Puerto Rico Qatar Romania Russia Saudi Arabia Serbia & Montenegro Singapore Slovakia Slovenia South Africa Spain	Sri Lanka Sweden Switzerland -- French Switzerland -- German Taiwan Thailand Turkey Ukraine United Arab Emirates United Kingdom United States Uruguay Venezuela Vietnam Yemen

Hardware and Software, Engineered to Work Together