United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
JDK-5050387 : JVM crash when JOptionPane invoked in drop() method

Details
Type:
Bug
Submit Date:
2004-05-20
Status:
Closed
Updated Date:
2007-07-02
Project Name:
JDK
Resolved Date:
2007-07-02
Component:
client-libs
OS:
generic
Sub-Component:
java.awt
CPU:
generic
Priority:
P4
Resolution:
Won't Fix
Affected Versions:
5.0
Fixed Versions:

Related Reports
Relates:

Sub Tasks

Description
JVM crashes when JOptionPane is displayed from the drop() method. When the drop occurs, the JOptionPane is displayed, but the JVM crashes after that. This happens only when the JOptionPane is displayed before the dropComplete() method is called. Please see the bug 4623377. The testcase attached is the same one given in the description of that bug. Please see the log also attached.

The crash is not consistent. It occurs on Solaris and Linux only with MToolkit. I was able to reproduce the problem in both the OS in 2-3 drag & drops.

Steps to reproduce:
1. Run the attached code.
2. Drag a node from the tree and drop it on the tree itself.
3. Repeat it 2-3 times and it can be seen that the JVM crashes.

                                    

Comments
EVALUATION

As it is stated in the description section. The problem is an MToolkit specific issue.  We are going to remove MToolkit in 7.0, and so we will not fix this particular CR. Therefor I am closing the change request.
                                     
2007-07-02
EVALUATION

I have been able to reproduce the crash without 
the use of DGA, on both jdk5 and jdk6, only with MToolkit.
(Solaris 10, JDS3)

It crashes after a couple of drag/drops. It helps if instead
of clicking "ok" on the appearing dialog you just hit
Enter.

The stack for jdk6:
 3435   }
 3436
 3437   static void
 3438   dt_notify_drop_done(JNIEnv* env, XClientMessageEvent* xclient, jboolean success,
 3439                       jint action) {
 3440       if (xclient->message_type == XA_XdndDrop) {
 3441           Display* dpy = xclient->display;
 3442           XClientMessageEvent finished;
 3443           long* event_data = xclient->data.l;
 3444
 3445           /*
(dbx 9) w
current thread: t@19
  [1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xfc00, 0x0), at 0xff2c0f90
  [2] raise(0x6, 0x0, 0xff2a4a98, 0xffffffff, 0xff2e8284, 0x6), at 0xff25fd78
  [3] abort(0xd4d7dbc8, 0x1, 0xfe05e428, 0xa83f0, 0xff2eb298, 0x0), at 0xff23ff98
  [4] os::abort(0x1, 0xffd04200, 0xfef01f3c, 0xfeba7150, 0xfeee0c80, 0xfef01f3c), at 0xfe04fc90
  [5] VMError::report_and_die(0x76d32, 0x76c00, 0xfef01f3c, 0xfef19c82, 0x1, 0x1), at 0xfe3c5e38
  [6] report_assertion_failure(0xfeb2bc54, 0x97, 0xfeb2bc8f, 0x3d95b, 0xfeea2f50, 0x3d800), at 0xfd804c78
  [7] methodOopDesc::bci_from(0xd71216a0, 0x3dd7c, 0xd71216a0, 0xfeea2f50, 0xd71216d8, 0xfeb2bc8f), at 0xfdfba188
  [8] frame::interpreter_frame_bci(0x3dd7c, 0x47164, 0x753800, 0x47000, 0xfe05f6f4, 0x3dc00), at 0xfd89c4d0
  [9] frame::print_on_error(0xd4d7e268, 0xd4d7e268, 0xfef278d0, 0x7d0, 0xd4d7e1b0, 0xff8af390), at 0xfd89dc94
  [10] VMError::report(0xd4d7e268, 0x84980, 0xd4d7e358, 0x84800, 0x7d0, 0xfeea2f50), at 0xfe3c4944
  [11] VMError::report_and_die(0xd4d7e358, 0x76cc8, 0x76c00, 0x85800, 0x85920, 0x76d00), at 0xfe3c587c
  [12] JVM_handle_solaris_signal(0xb, 0xffd08dea, 0x2f7000, 0x787000, 0x787000, 0xd5800084), at 0xfe05c6e0
  [13] __sighndlr(0xb, 0xd4d7e7f0, 0xd4d7e538, 0xfe0571e0, 0x0, 0x1), at 0xff2bfec8
  ---- called from signal handler with signal 11 (SIGSEGV) ------
=>[14] dt_notify_drop_done(env = ???, xclient = ???, success = ???, action = ???) (optimized), at 0xd5800084 (line ~3440) in "awt_dnd_dt.c"
  [15] Java_sun_awt_motif_X11DropTargetContextPeer_dropDone(env = ???, this = ???, nativeCtxt = ???, success = ???, action = ???) (optimized), at 0xd5800730 (line ~3575) in "awt_dnd_dt.c"
  [16] 0xfb0170b0(0x20000000, 0xd4d7eaec, 0xd4d7ea68, 0xffffff80, 0x0, 0x0), at 0xfb0170b0
  [17] 0xfb016f70(0xf00f1128, 0x8, 0x0, 0x14, 0x0, 0xd4d7ea80), at 0xfb016f70

for jdk5 the trace is a bit different:
(dbx 4) w
current thread: t@15
=>[1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xfc00, 0x0), at 0xff340f90
  [2] raise(0x6, 0x0, 0xff324a98, 0xffffffff, 0xff368284, 0x6), at 0xff2dfd78
  [3] abort(0x6800, 0x1, 0x7000, 0xa83f0, 0xff36b298, 0x0), at 0xff2bff98
  [4] os::abort(0x1, 0x0, 0xfefb8cf4, 0xfef86000, 0x6f5c, 0x6c00), at 0xfee42d64
  [5] VMError::report_and_die(0x0, 0xfefdec80, 0xfefd8974, 0x1, 0xfee466f4, 0xfefd8974), at 0xfeebdeb8
  [6] JVM_handle_solaris_signal(0xb, 0xd297f3c0, 0xd297f108, 0x7400, 0x85e0, 0x322c78), at 0xfea6e1d0
  [7] __sighndlr(0xb, 0xd297f3c0, 0xd297f108, 0xfea6d6b4, 0x0, 0x1), at 0xff33fec8
  ---- called from signal handler with signal 11 (SIGSEGV) ------
  [8] 0x0(0x28ef98, 0x0, 0x0, 0x8568f0, 0x856900, 0x4c), at 0x0
  [9] XtPhase2Destroy(0x28ef98, 0x24, 0x0, 0x4dab08, 0x0, 0x212820), at 0xfa8b3f78
  [10] _XtDoPhase2Destroy(0x2d18f8, 0x1, 0xffffffff, 0x7d38b0, 0x7d38c0, 0x1), at 0xfa8b3c7c
  [11] XtDispatchEvent(0x1, 0x154, 0x0, 0x2d18f8, 0xfa8e4000, 0x1), at 0xfa8ae414
  [12] XtAppProcessEvent(0x2d18f8, 0x0, 0xf4240, 0x1, 0x0, 0xd297f69c), at 0xfa8b1d84
  [13] 0xfb49803c(0x1, 0x59010, 0x1a, 0x68, 0xfb4f0ae8, 0xfb4f4a5c), at 0xfb49803c
  [14] 0xfb497874(0x322d30, 0x212820, 0x0, 0x5, 0xfb4f0ae8, 0xfb4f5910), at 0xfb497874
  [15] Java_sun_awt_motif_MToolkit_run(0x322d30, 0xfe9fe5d8, 0x5946c, 0xfea7e414, 0xfb4f0ae8, 0xfefcff80), at 0xfb4976b4
  [16] 0xf880c280(0x322c78, 0xd297fb0c, 0xd297fa98, 0xffffff80, 0x80000000, 0xb1c), at 0xf880c280

Since none of these have any 2D code involved, reassigning to AWT.
                                     
2006-12-27
EVALUATION

Name: agR10216			Date: 06/03/2004


Committing to tiger-rc.

###@###.###  2004-06-03


======================================================================

The hotstop error log shows dga_win_grab_common. I am able to reproduce this problem, and I always get the same stack. I wonder - what is wrong so that dga can not execute the call? Transfering to 2D for further evaluation.
###@###.### 2004-06-18

I wonder if there are two separate problems here. One is
related to dga (which I can reproduce on my sparc system with ffb2
with the latest ffb patches installed), 
another is something else, since we don't use dga on linux, and the 
description mentions that the original bug is reproducible on linux as well.

So far it appears that the crash on solaris is reproducible only with
MToolkit. I think that the cause may be a race condition: the drawable
may have been deleted by the time we attempt to grab it.

It could be caused by some code which uses X not being synched on AWT_LOCK -
I recall seeing a couple of places in awt code which do that.

Here's the output of java_g with NOISY_AWT set:
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 6310
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e0006e, ser# 6344
Major opcode 42 (X_SetInputFocus)
Starting drag
Drop
Xerror BadWindow (invalid Window parameter), XID 0, ser# 7320
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 7325
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e00072, ser# 7357
Major opcode 42 (X_SetInputFocus)
Starting drag
Drop
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8090
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8095
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e00076, ser# 8127
Major opcode 42 (X_SetInputFocus)
Starting drag
Drop
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8902
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
Xerror BadWindow (invalid Window parameter), XID 0, ser# 8909
Major opcode 20 (X_GetProperty)
X11SD_InitWindow: widget is unrealized
X11SD_InitWindow: widget is unrealized
Xerror BadMatch (invalid parameter attributes), XID e0007a, ser# 8943
Major opcode 42 (X_SetInputFocus)
## nof_mallocs = 3484, nof_frees = 1558
## memory stomp: byte at 1e82a8 in front of object 1e82c0
### previous object (not sure if correct): 1e77d4 (-1414812757 bytes)
### next object (not sure if correct): 1e8390 (0 bytes)
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/os.cpp:340]
#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
#  Internal Error (/BUILD_AREA/jdk1.5.0/hotspot/src/share/vm/runtime/os.cpp, 340 [ Patched ]), pid=25477, tid=19
#
# Java VM: Java HotSpot(TM) Server VM (1.5.0-beta3-b56-debug mixed mode)
#
# Error: memory stomping error
# An error report file with more information is saved as hs_err_pid25477.log
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#
Current thread is 19
Dumping core ...

Note that the crash is different from the one with optimized java. The stack trace:
Current thread (0x00154258):  JavaThread "AWT-EventQueue-0" [_thread_in_Java, id=19]

Stack: [0xd2200000,0xd2280000),  sp=0xd227d3a0,  free space=500k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm_g.so+0xe61f24]
V  [libjvm_g.so+0x562bd0]
V  [libjvm_g.so+0xb54ed8]
V  [libjvm_g.so+0xb54f9c]
V  [libjvm_g.so+0xb556ac]
V  [libjvm_g.so+0x586f2c]
V  [libjvm_g.so+0x57b8dc]
V  [libjvm_g.so+0x57cf38]
v  blob 0xf7cac060
j  java.awt.KeyboardFocusManager.getMostRecentFocusOwner(Ljava/awt/Window;)Ljava/awt/Component;+9
j  java.awt.KeyboardFocusManager.clearMostRecentFocusOwner(Ljava/awt/Component;)V+60
j  java.awt.Component.removeNotify()V+1
j  java.awt.Container.removeNotify()V+67
j  javax.swing.JComponent.removeNotify()V+1
j  javax.swing.JButton.removeNotify()V+23
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  java.awt.Container.removeNotify()V+38
j  javax.swing.JComponent.removeNotify()V+1
j  javax.swing.JRootPane.removeNotify()V+5
j  java.awt.Container.removeNotify()V+38
j  java.awt.Window$1DisposeAction.run()V+105
j  java.awt.Window.doDispose()V+16
j  java.awt.Dialog.doDispose()V+1
j  java.awt.Window.dispose()V+1
j  javax.swing.JOptionPane.showOptionDialog(...)I+75

###@###.### 2004-06-21
                                     
2004-06-21



Hardware and Software, Engineered to Work Together