JDK-6225432 : MSVCRT Access Violation in sun.awt.....WDataTransferer.getClipboardFormatName()
  • Type: Bug
  • Component: client-libs
  • Sub-Component: java.awt
  • Affected Version: 5.0
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: windows_2000,windows_xp
  • CPU: x86
  • Submitted: 2005-02-04
  • Updated: 2006-08-17
  • Resolved: 2005-11-12
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other JDK 6
5.0u7Fixed 6 b61Fixed
Related Reports
Relates :  
JDK-6218351 - Crash of JVM after taking several screenshots.
Description
FULL PRODUCT VERSION :
Java VM: Java HotSpot(TM) Client VM (1.5.0-b64 mixed mode, sharing)

java version "1.5.0_01"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_01-b08)
Java HotSpot(TM) Client VM (build 1.5.0_01-b08, mixed mode, sharing)


FULL OS VERSION :
Microsoft Windows XP Professional SP 1
Microsoft Windows XP [Version 5.1.2600]


A DESCRIPTION OF THE PROBLEM :
After resizing a frame, pasting in Image data from the system clipboard, a native error (MSVCRT access violation) occurs.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Create a frame with a JPanel - pnlImage.  Add a button with the following event code:

    try {
      Image i = (Image)this.getToolkit().getSystemClipboard().getContents(this).getTransferData(DataFlavor.imageFlavor);
      pnlImage.getGraphics().drawImage(i,0,0,this);
    } catch (Exception e) {
      e.printStackTrace();
    }

Copy image data to the system clipboard (Alt-Printscreen), click the button, use the handles to resize the frame, click again - after (it seems consistent) about three tries, an ACCESS VIOLATION occurs.

EXPECTED VERSUS ACTUAL BEHAVIOR :
Expected behavior is that the image data is displayed on the JPanel.  Actual behavior is a crash with error detail.
ERROR MESSAGES/STACK TRACES THAT OCCUR :
#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x77c43ec0, pid=3528, tid=2644
#
# Java VM: Java HotSpot(TM) Client VM (1.5.0-b64 mixed mode, sharing)
# Problematic frame:
# C  [MSVCRT.dll+0x33ec0]
#
# An error report file with more information is saved as hs_err_pid3528.log
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#


#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x77c43ec0, pid=2424, tid=3896
#
# Java VM: Java HotSpot(TM) Client VM (1.5.0-b64 mixed mode, sharing)
# Problematic frame:
# C  [MSVCRT.dll+0x33ec0]
#

---------------  T H R E A D  ---------------

Current thread (0x00acb118):  JavaThread "AWT-EventQueue-0" [_thread_in_native, id=3896]

siginfo: ExceptionCode=0xc0000005, reading address 0x154f8000

Registers:
EAX=0x154f8000, EBX=0x2b5bb658, ECX=0x15482b35, EDX=0x7ffe0304
ESP=0x1548f5c0, EBP=0x1548f5e8, ESI=0x154f79d0, EDI=0x00acb118
EIP=0x77c43ec0, EFLAGS=0x00010206

  Top of Stack: (sp=0x1548f5c0)
0x1548f5c0:   6d0ca706 154f79d0 00acb118 2ac8c9b8
0x1548f5d0:   2b5bb658 00acbd00 1548f5c8 1548fd64
0x1548f5e0:   6d0f3088 00000000 1548f61c 00ad826f
0x1548f5f0:   00acb1d4 1548f624 00000011 00000000
0x1548f600:   1548f600 00000000 1548f630 2b5bbaa8
0x1548f610:   00000000 2b5bb658 1548f62c 1548f650
0x1548f620:   00ad29fa 2b5bba50 00ad6453 00000011
0x1548f630:   00000000 1548f634 2ac8c90c 1548f660

Instructions: (pc=0x77c43ec0)
0x77c43eb0:   75 dd 2b 44 24 10 5f 5e d1 f8 5b c3 8b 44 24 04
0x77c43ec0:   66 8b 08 40 40 66 85 c9 75 f6 2b 44 24 04 d1 f8


Stack: [0x15450000,0x15490000),  sp=0x1548f5c0,  free space=253k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [MSVCRT.dll+0x33ec0]
j  sun.awt.windows.WDataTransferer.getClipboardFormatName(J)Ljava/lang/String;+0
j  sun.awt.windows.WDataTransferer.getNativeForFormat(J)Ljava/lang/String;+20
j  sun.awt.datatransfer.DataTransferer.getFlavorsForFormats([JLjava/awt/datatransfer/FlavorTable;)Ljava/util/Map;+51
j  sun.awt.datatransfer.ClipboardTransferable.<init>(Lsun/awt/datatransfer/SunClipboard;)V+55
j  sun.awt.datatransfer.SunClipboard.getContents(Ljava/lang/Object;)Ljava/awt/datatransfer/Transferable;+17
j  imagecopy.ImageWin.jButton1ActionPerformed(Ljava/awt/event/ActionEvent;)V+8
j  imagecopy.ImageWin.access$000(Limagecopy/ImageWin;Ljava/awt/event/ActionEvent;)V+2
j  imagecopy.ImageWin$1.actionPerformed(Ljava/awt/event/ActionEvent;)V+5
j  javax.swing.AbstractButton.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+84
j  javax.swing.AbstractButton$Handler.actionPerformed(Ljava/awt/event/ActionEvent;)V+5
j  javax.swing.DefaultButtonModel.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+35
j  javax.swing.DefaultButtonModel.setPressed(Z)V+117
j  javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Ljava/awt/event/MouseEvent;)V+35
j  java.awt.Component.processMouseEvent(Ljava/awt/event/MouseEvent;)V+64
j  javax.swing.JComponent.processMouseEvent(Ljava/awt/event/MouseEvent;)V+23
j  java.awt.Component.processEvent(Ljava/awt/AWTEvent;)V+81
j  java.awt.Container.processEvent(Ljava/awt/AWTEvent;)V+18
j  java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V+477
j  java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V+42
j  java.awt.Component.dispatchEvent(Ljava/awt/AWTEvent;)V+2
j  java.awt.LightweightDispatcher.retargetMouseEvent(Ljava/awt/Component;ILjava/awt/event/MouseEvent;)V+304
j  java.awt.LightweightDispatcher.processMouseEvent(Ljava/awt/event/MouseEvent;)Z+139
j  java.awt.LightweightDispatcher.dispatchEvent(Ljava/awt/AWTEvent;)Z+50
j  java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V+12
j  java.awt.Window.dispatchEventImpl(Ljava/awt/AWTEvent;)V+19
j  java.awt.Component.dispatchEvent(Ljava/awt/AWTEvent;)V+2
j  java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V+46
j  java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z+200
j  java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V+26
j  java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
j  java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
j  java.awt.EventDispatchThread.run()V+9
v  ~StubRoutines::call_stub
V  [jvm.dll+0x8168d]
V  [jvm.dll+0xd4179]
V  [jvm.dll+0x8155e]
V  [jvm.dll+0x812bb]
V  [jvm.dll+0x9bbe9]
V  [jvm.dll+0xfe77f]
V  [jvm.dll+0xfe74d]
C  [MSVCRT.dll+0x27fb8]
C  [kernel32.dll+0x1d33b]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  sun.awt.windows.WDataTransferer.getClipboardFormatName(J)Ljava/lang/String;+0
j  sun.awt.windows.WDataTransferer.getNativeForFormat(J)Ljava/lang/String;+20
j  sun.awt.datatransfer.DataTransferer.getFlavorsForFormats([JLjava/awt/datatransfer/FlavorTable;)Ljava/util/Map;+51
j  sun.awt.datatransfer.ClipboardTransferable.<init>(Lsun/awt/datatransfer/SunClipboard;)V+55
j  sun.awt.datatransfer.SunClipboard.getContents(Ljava/lang/Object;)Ljava/awt/datatransfer/Transferable;+17
j  imagecopy.ImageWin.jButton1ActionPerformed(Ljava/awt/event/ActionEvent;)V+8
j  imagecopy.ImageWin.access$000(Limagecopy/ImageWin;Ljava/awt/event/ActionEvent;)V+2
j  imagecopy.ImageWin$1.actionPerformed(Ljava/awt/event/ActionEvent;)V+5
j  javax.swing.AbstractButton.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+84
j  javax.swing.AbstractButton$Handler.actionPerformed(Ljava/awt/event/ActionEvent;)V+5
j  javax.swing.DefaultButtonModel.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+35
j  javax.swing.DefaultButtonModel.setPressed(Z)V+117
j  javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Ljava/awt/event/MouseEvent;)V+35
j  java.awt.Component.processMouseEvent(Ljava/awt/event/MouseEvent;)V+64
j  javax.swing.JComponent.processMouseEvent(Ljava/awt/event/MouseEvent;)V+23
j  java.awt.Component.processEvent(Ljava/awt/AWTEvent;)V+81
j  java.awt.Container.processEvent(Ljava/awt/AWTEvent;)V+18
j  java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V+477
j  java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V+42
j  java.awt.Component.dispatchEvent(Ljava/awt/AWTEvent;)V+2
j  java.awt.LightweightDispatcher.retargetMouseEvent(Ljava/awt/Component;ILjava/awt/event/MouseEvent;)V+304
j  java.awt.LightweightDispatcher.processMouseEvent(Ljava/awt/event/MouseEvent;)Z+139
j  java.awt.LightweightDispatcher.dispatchEvent(Ljava/awt/AWTEvent;)Z+50
j  java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V+12
j  java.awt.Window.dispatchEventImpl(Ljava/awt/AWTEvent;)V+19
j  java.awt.Component.dispatchEvent(Ljava/awt/AWTEvent;)V+2
j  java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V+46
j  java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z+200
j  java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V+26
j  java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
j  java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
j  java.awt.EventDispatchThread.run()V+9
v  ~StubRoutines::call_stub

---------------  P R O C E S S  ---------------

Java Threads: ( => current thread )
  0x00035e78 JavaThread "DestroyJavaVM" [_thread_blocked, id=2900]
  0x00acd3f0 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=412]
=>0x00acb118 JavaThread "AWT-EventQueue-0" [_thread_in_native, id=3896]
  0x00ac9cf0 JavaThread "AWT-Windows" daemon [_thread_in_native, id=2128]
  0x00ac97e8 JavaThread "AWT-Shutdown" [_thread_blocked, id=3184]
  0x00a6bc80 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=3088]
  0x00a6a858 JavaThread "CompilerThread0" daemon [_thread_blocked, id=2124]
  0x00a69b78 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=3536]
  0x00a45ea0 JavaThread "Finalizer" daemon [_thread_blocked, id=3044]
  0x0003fa00 JavaThread "Reference Handler" daemon [_thread_blocked, id=3076]

Other Threads:
  0x00a67130 VMThread [id=2696]
  0x00a6cec8 WatcherThread [id=2136]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
 def new generation   total 1152K, used 52K [0x22a60000, 0x22b90000, 0x22f40000)
  eden space 1088K,   4% used [0x22a60000, 0x22a6d1f8, 0x22b70000)
  from space 64K,   0% used [0x22b70000, 0x22b70000, 0x22b80000)
  to   space 64K,   0% used [0x22b80000, 0x22b80000, 0x22b90000)
 tenured generation   total 14044K, used 10376K [0x22f40000, 0x23cf7000, 0x26a60000)
   the space 14044K,  73% used [0x22f40000, 0x23962380, 0x23962400, 0x23cf7000)
 compacting perm gen  total 8192K, used 106K [0x26a60000, 0x27260000, 0x2aa60000)
   the space 8192K,   1% used [0x26a60000, 0x26a7a8b0, 0x26a7aa00, 0x27260000)
    ro space 8192K,  66% used [0x2aa60000, 0x2afb7960, 0x2afb7a00, 0x2b260000)
    rw space 12288K,  46% used [0x2b260000, 0x2b7f43a8, 0x2b7f4400, 0x2be60000)

Dynamic libraries:
0x00400000 - 0x0040c000 	C:\apps\java\jdk1.5.0\jre\bin\java.exe
0x77f50000 - 0x77ff7000 	C:\WINNT\System32\ntdll.dll
0x77e60000 - 0x77f46000 	C:\WINNT\system32\kernel32.dll
0x77dd0000 - 0x77e5d000 	C:\WINNT\system32\ADVAPI32.dll
0x78000000 - 0x78087000 	C:\WINNT\system32\RPCRT4.dll
0x77c10000 - 0x77c63000 	C:\WINNT\system32\MSVCRT.dll
0x6d640000 - 0x6d7c5000 	C:\apps\java\jdk1.5.0\jre\bin\client\jvm.dll
0x77d40000 - 0x77dcc000 	C:\WINNT\system32\USER32.dll
0x7e090000 - 0x7e0d1000 	C:\WINNT\system32\GDI32.dll
0x76b40000 - 0x76b6c000 	C:\WINNT\system32\WINMM.dll
0x76390000 - 0x763ac000 	C:\WINNT\System32\IMM32.DLL
0x629c0000 - 0x629c8000 	C:\WINNT\System32\LPK.DLL
0x72fa0000 - 0x72ffa000 	C:\WINNT\System32\USP10.dll
0x6d280000 - 0x6d288000 	C:\apps\java\jdk1.5.0\jre\bin\hpi.dll
0x76bf0000 - 0x76bfb000 	C:\WINNT\System32\PSAPI.DLL
0x6d610000 - 0x6d61c000 	C:\apps\java\jdk1.5.0\jre\bin\verify.dll
0x6d300000 - 0x6d31d000 	C:\apps\java\jdk1.5.0\jre\bin\java.dll
0x6d630000 - 0x6d63f000 	C:\apps\java\jdk1.5.0\jre\bin\zip.dll
0x6d000000 - 0x6d166000 	C:\apps\java\jdk1.5.0\jre\bin\awt.dll
0x73000000 - 0x73023000 	C:\WINNT\System32\WINSPOOL.DRV
0x771b0000 - 0x772d4000 	C:\WINNT\system32\ole32.dll
0x5ad70000 - 0x5ada4000 	C:\WINNT\System32\uxtheme.dll
0x51000000 - 0x5104d000 	C:\WINNT\System32\ddraw.dll
0x73bc0000 - 0x73bc6000 	C:\WINNT\System32\DCIMAN32.dll
0x5c000000 - 0x5c0c8000 	C:\WINNT\System32\D3DIM700.DLL
0x14e70000 - 0x14e79000 	C:\WINNT\system32\PGPhk.dll
0x74720000 - 0x74764000 	C:\WINNT\System32\MSCTF.dll
0x63000000 - 0x63014000 	C:\WINNT\System32\SynTPFcs.dll
0x77c00000 - 0x77c07000 	C:\WINNT\system32\VERSION.dll
0x15410000 - 0x1543b000 	C:\WINNT\System32\msctfime.ime
0x6d240000 - 0x6d27d000 	C:\apps\java\jdk1.5.0\jre\bin\fontmanager.dll
0x773d0000 - 0x77bc2000 	C:\WINNT\system32\shell32.dll
0x70a70000 - 0x70ad5000 	C:\WINNT\system32\SHLWAPI.dll
0x71950000 - 0x71a34000 	C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
0x77340000 - 0x773cb000 	C:\WINNT\system32\comctl32.dll
0x6d4c0000 - 0x6d4d3000 	C:\apps\java\jdk1.5.0\jre\bin\net.dll
0x71ab0000 - 0x71ac5000 	C:\WINNT\system32\WS2_32.dll
0x71aa0000 - 0x71aa8000 	C:\WINNT\system32\WS2HELP.dll
0x6d4e0000 - 0x6d4e9000 	C:\apps\java\jdk1.5.0\jre\bin\nio.dll
0x746f0000 - 0x74716000 	C:\WINNT\System32\Msimtf.dll

VM Arguments:
java_command: imagecopy.ImageWin

Environment Variables:
JAVA_HOME=c:\apps\java\jdk1.5.0
PATH=C:\PROGRAM FILES\THINKPAD\UTILITIES;C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;c:\apps\bin;c:\apps\java\jdk1.5.0\bin;c:\apps\apache-ant\bin;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\UltraEdit
USERNAME=NBTE7Y7
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel


---------------  S Y S T E M  ---------------

OS: Windows XP Build 2600 Service Pack 1

CPU:total 1 family 6, cmov, cx8, fxsr, mmx, sse, sse2

Memory: 4k page, physical 1309616k(587588k free), swap 1673432k(1195364k free)

vm_info: Java HotSpot(TM) Client VM (1.5.0-b64) for windows-x86, built on Sep 15 2004 03:00:31 by "java_re" with MS VC++ 6.0


REPRODUCIBILITY :
This bug can be reproduced often.

---------- BEGIN SOURCE ----------
package imagecopy;

import java.awt.Image;
import java.awt.datatransfer.DataFlavor;

public class ImageWin extends javax.swing.JFrame {
  
  public ImageWin() {
    initComponents();
  }
  
  private void initComponents() {
    pnlButtons = new javax.swing.JPanel();
    jButton1 = new javax.swing.JButton();
    jScrollPane1 = new javax.swing.JScrollPane();
    pnlImage = new javax.swing.JPanel();

    setDefaultCloseOperation(javax.swing.WindowConstants.EXIT_ON_CLOSE);
    jButton1.setText("Paste");
    jButton1.addActionListener(new java.awt.event.ActionListener() {
      public void actionPerformed(java.awt.event.ActionEvent evt) {
        jButton1ActionPerformed(evt);
      }
    });

    pnlButtons.add(jButton1);

    getContentPane().add(pnlButtons, java.awt.BorderLayout.SOUTH);

    jScrollPane1.setViewportView(pnlImage);

    getContentPane().add(jScrollPane1, java.awt.BorderLayout.CENTER);

    pack();
  }

  private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) {
    try {
      Image i = (Image)this.getToolkit().getSystemClipboard().getContents(this).getTransferData(DataFlavor.imageFlavor);
      pnlImage.getGraphics().drawImage(i,0,0,this);
    } catch (Exception e) {
      e.printStackTrace();
    }
  }
  
  public static void main(String args[]) {
    java.awt.EventQueue.invokeLater(new Runnable() {
      public void run() {
        new ImageWin().setVisible(true);
      }
    });
  }
  
  private javax.swing.JButton jButton1;
  private javax.swing.JScrollPane jScrollPane1;
  private javax.swing.JPanel pnlButtons;
  private javax.swing.JPanel pnlImage;
}

---------- END SOURCE ----------
###@###.### 2005-2-04 01:38:09 GMT
Comments
EVALUATION The bug was fixed in JDK 6 and 5.0u7(bug ID 2130350).
17-08-2006
EVALUATION A fix is ready and will be available in JDK 6 and an update of JDK 5 soon.
27-10-2005
EVALUATION This bug is in 'Top 25 Bugs'! I could reproduce the crash. When the predefined clipboard format CF_DIBV5=17 is passed to the function GetClipboardFormatName(), the function fails and leaves garbage in the buffer for the format name. Next usage of the buffer causes crashes sometimes. Must add the format to a list of predefined clipboard formats so that not to call the function in such cases.
26-09-2005
SUGGESTED FIX --- WDataTransferer.java Mon Sep 26 19:36:42 2005 *************** *** 81,92 **** "UNICODE TEXT", "ENHMETAFILE", "HDROP", ! "LOCALE" }; private static final Map predefinedClipboardNameMap; static { ! Map tempMap = new HashMap(16, 1.0f); for (int i = 1; i < predefinedClipboardNames.length; i++) { tempMap.put(predefinedClipboardNames[i], Long.valueOf(i)); } --- 81,93 ---- "UNICODE TEXT", "ENHMETAFILE", "HDROP", ! "LOCALE", ! "DIBV5" }; private static final Map predefinedClipboardNameMap; static { ! Map tempMap = new HashMap(predefinedClipboardNames.length, 1.0f); for (int i = 1; i < predefinedClipboardNames.length; i++) { tempMap.put(predefinedClipboardNames[i], Long.valueOf(i)); }
26-09-2005
EVALUATION I couldn't reproduce the bug on my WinXP machine with the builds 5.0-b63, 5.0_01-b03, 6.0-b21. ###@###.### 2005-2-07 11:20:47 GMT Also tried the build 5.0_01-b08 and could not reproduce the bug on 3 machines. ###@###.### 2005-2-08 10:04:33 GMT Could the submitter run the test with several builds (say, 5.0-b63, 6.0-b21, 5.0_01-b08) on several machines and inform me about his results? Is the bug reproducible on different machines or only on one machine? How often can you reproduce the bug? ###@###.### 2005-03-09 15:18:51 GMT
07-02-2005