Bug ID: JDK-7032904 XRender: Java2Demo : Infinite loop in Java_sun_java2d_loops_MaskBlit

JDK-7032904 : XRender: Java2Demo : Infinite loop in Java_sun_java2d_loops_MaskBlit_MaskBlit on OEL 5.6 x64

Type: Bug
Component: client-libs
Sub-Component: 2d
Affected Version: 7

Priority: P3
Status: Closed
Resolution: Fixed
OS: generic
CPU: generic

Submitted: 2011-03-31
Updated: 2016-02-02
Resolved: 2011-06-17

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 7
7 b145Fixed

Description

On exactly the same line of code fixed under
6985593: Crash in Java_sun_java2d_loops_MaskBlit_MaskBlit on oel5.5-x64

with that fix in place, I am now seeing a hang with Java2Demo 64 bit JDK
on Linux when running with -Dsun.java2d.xrender=True.

Java2Demo was running on OEL 5.6 (same system on which the executing JDK was built)

"AWT-EventQueue-0" prio=10 tid=0x00000000012f6800 nid=0x89c runnable [0x0000000041788000]
   java.lang.Thread.State: RUNNABLE
        at sun.java2d.loops.Blit.Blit(Native Method)
        at sun.java2d.xr.XRPMBlitLoops.cacheToTmpSurface(XRPMBlitLoops.java:146)        at sun.java2d.xr.XrSwToPMBlit.Blit(XRPMBlitLoops.java:348)


It was left running and the hang was there when I came back. Multiple
stack traces show the same place and the app was using 99.4% CPU and
its still on screen but not repainting at all.
Looks like the call to Blit never returns.

Full stack dump :

Full thread dump Java HotSpot(TM) 64-Bit Server VM (21.0-b05 mixed mode):

"TextureAnim Demo" prio=10 tid=0x00007f252c243000 nid=0x4018 runnable [0x0000000041155000]
   java.lang.Thread.State: RUNNABLE
        at java.lang.Thread.sleep(Native Method)
        at java2d.AnimatingSurface.run(AnimatingSurface.java:89)
        at java.lang.Thread.run(Thread.java:722)

"GradAnim Demo" prio=10 tid=0x00007f252c13e000 nid=0x4017 runnable [0x0000000040ea0000]
   java.lang.Thread.State: RUNNABLE
        at java.lang.Thread.sleep(Native Method)
        at java2d.AnimatingSurface.run(AnimatingSurface.java:89)
        at java.lang.Thread.run(Thread.java:722)

"PerformanceMonitor" prio=10 tid=0x00007f252c133000 nid=0x4007 waiting on condition [0x0000000040d9f000]
   java.lang.Thread.State: TIMED_WAITING (sleeping)
        at java.lang.Thread.sleep(Native Method)
        at java2d.PerformanceMonitor$Surface.run(PerformanceMonitor.java:187)
        at java.lang.Thread.run(Thread.java:722)

"MemoryMonitor" prio=10 tid=0x00007f252c2a7000 nid=0x4006 waiting on condition [0x0000000041256000]
   java.lang.Thread.State: TIMED_WAITING (sleeping)
        at java.lang.Thread.sleep(Native Method)
        at java2d.MemoryMonitor$Surface.run(MemoryMonitor.java:302)
        at java.lang.Thread.run(Thread.java:722)

"Image Animator 0" daemon prio=10 tid=0x00007f252c13a800 nid=0x930 waiting on condition [0x000000004197a000]
   java.lang.Thread.State: TIMED_WAITING (sleeping)
        at java.lang.Thread.sleep(Native Method)
        at sun.awt.image.GifFrame.dispose(GifImageDecoder.java:670)
        at sun.awt.image.GifImageDecoder.readImage(GifImageDecoder.java:458)
        at sun.awt.image.GifImageDecoder.produceImage(GifImageDecoder.java:212)
        at sun.awt.image.InputStreamImageSource.doFetch(InputStreamImageSource.java:269)
        at sun.awt.image.ImageFetcher.fetchloop(ImageFetcher.java:205)
        at sun.awt.image.ImageFetcher.run(ImageFetcher.java:169)

"TimerQueue" daemon prio=10 tid=0x00007f252c137000 nid=0x8a2 waiting on condition [0x0000000041ea6000]
   java.lang.Thread.State: WAITING (parking)
        at sun.misc.Unsafe.park(Native Method)
        - parking to wait for  <0x00000000d16767a8> (a java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject)
        at java.util.concurrent.locks.LockSupport.park(LockSupport.java:186)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2043)
        at java.util.concurrent.DelayQueue.take(DelayQueue.java:209)
        at javax.swing.TimerQueue.run(TimerQueue.java:171)
        at java.lang.Thread.run(Thread.java:722)

"DestroyJavaVM" prio=10 tid=0x00007f252c134800 nid=0x890 waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"AWT-EventQueue-0" prio=10 tid=0x00000000012f6800 nid=0x89c runnable [0x0000000041788000]
   java.lang.Thread.State: RUNNABLE
        at sun.java2d.loops.Blit.Blit(Native Method)
        at sun.java2d.xr.XRPMBlitLoops.cacheToTmpSurface(XRPMBlitLoops.java:146)
        at sun.java2d.xr.XrSwToPMBlit.Blit(XRPMBlitLoops.java:348)
        at sun.java2d.pipe.DrawImage.blitSurfaceData(DrawImage.java:953)
        at sun.java2d.pipe.DrawImage.renderImageCopy(DrawImage.java:575)
        at sun.java2d.pipe.DrawImage.copyImage(DrawImage.java:71)
        at sun.java2d.pipe.DrawImage.copyImage(DrawImage.java:1008)
        at sun.java2d.pipe.ValidatePipe.copyImage(ValidatePipe.java:186)
        at sun.java2d.SunGraphics2D.drawImage(SunGraphics2D.java:3062)
        at sun.java2d.SunGraphics2D.drawImage(SunGraphics2D.java:3047)
        at java2d.PerformanceMonitor$Surface.paint(PerformanceMonitor.java:102)
        at javax.swing.JComponent.paintToOffscreen(JComponent.java:5221)
        at javax.swing.BufferStrategyPaintManager.paint(BufferStrategyPaintManager.java:295)
        at javax.swing.RepaintManager.paint(RepaintManager.java:1206)
        at javax.swing.JComponent._paintImmediately(JComponent.java:5169)
        at javax.swing.JComponent.paintImmediately(JComponent.java:4980)
        at javax.swing.RepaintManager.paintDirtyRegions(RepaintManager.java:770)
        at javax.swing.RepaintManager.paintDirtyRegions(RepaintManager.java:728)
        at javax.swing.RepaintManager.prePaintDirtyRegions(RepaintManager.java:677)
        at javax.swing.RepaintManager.access$700(RepaintManager.java:59)
        at javax.swing.RepaintManager$ProcessingRunnable.run(RepaintManager.java:1621)
        at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:251)
        at java.awt.EventQueue.dispatchEvent(EventQueue.java:660)
        at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:211)
        at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:128)
        at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:117)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:113)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:105)
        at java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

"AWT-Shutdown" prio=10 tid=0x0000000001202000 nid=0x89b in Object.wait() [0x0000000040c57000]
   java.lang.Thread.State: WAITING (on object monitor)
        at java.lang.Object.wait(Native Method)
        - waiting on <0x00000000d1702200> (a java.lang.Object)
        at java.lang.Object.wait(Object.java:504)
        at sun.awt.AWTAutoShutdown.run(AWTAutoShutdown.java:287)
        - locked <0x00000000d1702200> (a java.lang.Object)
        at java.lang.Thread.run(Thread.java:722)

"AWT-XAWT" daemon prio=10 tid=0x00000000010a9800 nid=0x89a waiting on condition [0x0000000041553000]
   java.lang.Thread.State: WAITING (parking)
        at sun.misc.Unsafe.park(Native Method)
        - parking to wait for  <0x00000000d1765c90> (a java.util.concurrent.locks.ReentrantLock$NonfairSync)
        at java.util.concurrent.locks.LockSupport.park(LockSupport.java:186)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(AbstractQueuedSynchronizer.java:834)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireQueued(AbstractQueuedSynchronizer.java:867)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(AbstractQueuedSynchronizer.java:1197)
        at java.util.concurrent.locks.ReentrantLock$NonfairSync.lock(ReentrantLock.java:214)
        at java.util.concurrent.locks.ReentrantLock.lock(ReentrantLock.java:290)
        at sun.awt.SunToolkit.awtLock(SunToolkit.java:244)
        at sun.awt.X11.XToolkit.waitForEvents(Native Method)
        at sun.awt.X11.XToolkit.run(XToolkit.java:625)
        at sun.awt.X11.XToolkit.run(XToolkit.java:589)
        at java.lang.Thread.run(Thread.java:722)
"Java2D Disposer" daemon prio=10 tid=0x000000000107f800 nid=0x899 in Object.wait() [0x0000000041054000]
   java.lang.Thread.State: WAITING (on object monitor)
        at java.lang.Object.wait(Native Method)
        - waiting on <0x00000000d1702388> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:135)
        - locked <0x00000000d1702388> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:151)
        at sun.java2d.Disposer.run(Disposer.java:145)
        at java.lang.Thread.run(Thread.java:722)

"Service Thread" daemon prio=10 tid=0x0000000000efd800 nid=0x897 runnable [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"C2 CompilerThread1" daemon prio=10 tid=0x0000000000efb000 nid=0x896 waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"C2 CompilerThread0" daemon prio=10 tid=0x0000000000ef0000 nid=0x895 waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"Signal Dispatcher" daemon prio=10 tid=0x0000000000eed800 nid=0x894 waiting on condition [0x0000000000000000]
   java.lang.Thread.State: RUNNABLE

"Finalizer" daemon prio=10 tid=0x0000000000e9f800 nid=0x893 in Object.wait() [0x0000000041687000]
   java.lang.Thread.State: WAITING (on object monitor)
        at java.lang.Object.wait(Native Method)
        - waiting on <0x00000000d17025d0> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:135)
        - locked <0x00000000d17025d0> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:151)
        at java.lang.ref.Finalizer$FinalizerThread.run(Finalizer.java:177)

"Reference Handler" daemon prio=10 tid=0x0000000000e98000 nid=0x892 in Object.wait() [0x0000000040679000]
   java.lang.Thread.State: WAITING (on object monitor)
        at java.lang.Object.wait(Native Method)
        - waiting on <0x00000000d1702668> (a java.lang.ref.Reference$Lock)
        at java.lang.Object.wait(Object.java:504)
        at java.lang.ref.Reference$ReferenceHandler.run(Reference.java:133)
        - locked <0x00000000d1702668> (a java.lang.ref.Reference$Lock)

"VM Thread" prio=10 tid=0x0000000000e90800 nid=0x891 runnable

"VM Periodic Task Thread" prio=10 tid=0x0000000000f08800 nid=0x898 waiting on condition

JNI global references: 7362

Heap
 def new generation   total 19328K, used 9384K [0x00000000bc400000, 0x00000000bd8f0000, 0x00000000d1200000)
  eden space 17216K,  54% used [0x00000000bc400000, 0x00000000bcd29f80, 0x00000000bd4d0000)
  from space 2112K,   0% used [0x00000000bd6e0000, 0x00000000bd6e0118, 0x00000000bd8f0000)
  to   space 2112K,   0% used [0x00000000bd4d0000, 0x00000000bd4d0000, 0x00000000bd6e0000)
 tenured generation   total 42752K, used 11109K [0x00000000d1200000, 0x00000000d3bc0000, 0x00000000fae00000)
   the space 42752K,  25% used [0x00000000d1200000, 0x00000000d1cd9410, 0x00000000d1cd9600, 0x00000000d3bc0000)
 compacting perm gen  total 21248K, used 18800K [0x00000000fae00000, 0x00000000fc2c0000, 0x0000000100000000)
   the space 21248K,  88% used [0x00000000fae00000, 0x00000000fc05c2e0, 0x00000000fc05c400, 0x00000000fc2c0000)
No shared spaces configured.

Comments

EVALUATION This problem is caused by a bug in libXrender.so: https://bugs.freedesktop.org/show_bug.cgi?id=9526 This bug was resolved in 2007, and any system that uses library sources version 0.9.3 and later is immune to the problem. In particular, OEL6 contains libXrender.so built from sources of version 0.9.5, and therefore is not vulnerable to the problem, whereas OEL5 and OEL5.5 use version 0.9.1, and are vulnerable. There is no workaround to this bug on jdk side. The only way to avoid the problem is to prevent a usage of xrender pipeline on vulnerable systems, so we need to now a version of sources for libXrender.so Unfortunately, there is no a general way to get sources version for this library. On a part of systems it can be obtained from package configuration file (typically it is /usr/lib/pkgconfig/xrender.pc, but location of this file may vary depends on system settings), but it is no guarantee that this file exists. For example, Solaris systems seem do not contain such file at all.

12-05-2011

EVALUATION It looks like this problem can triggered by either XRenderCreateRadialGradient or XRenderCreateLinearGradient routines. Using awt error handler (-Dsun.awt.noisyerrorhandler=True) we can see that first error is always related to these routines: Xerror BadLength (poly request too large or internal Xlib length error), XID 5d, ser# 14995 Major opcode 155 (Unknown) Minor opcode 35 where minor opcode 35 corresponds to the radial gradient creation, and minor opcode 34 corresponds to liner gradient creation. Note also that the problem is gone if gradients in the simplified test are replaced with any other paint (solid color or a texture). There is another manifestation of the problem except the hand in Xlib calls. Sometimes the error mentioned above is followed by a number of various errors (see attached log file) and results in a termination of X connection form the server side. So it looks like that under certain circumstances these two routines may corrupt a internal state of Xlib. However, at the moment a particular scenario of this corruption is not clear. Note also that this problem was reproduced only on OEL (5.4, 5.5) and RHEL 5 (probably RHEL 3 and RHEL 4 are vulnerable to the problem too, but I failed to launch jdk7 builds on these systems due to glibc version mismatch). On following systems this problem can not be reproduced: * Ubuntu 10.04 (sst-28.russia.sun.com) * Ubuntu 9.04 (parovoz.russia.sun.com) * SLES 10 (stt36.russia.sun.com) * SLES 11 64-bit (aikido.russia.sun.com) * SLED 11 (stt-33.russia.sun.com)

27-04-2011

EVALUATION Reproduced the problem on judo.russia.sun.com. The native part of the hang stack is as following: (gdb) thread 10 [Switching to thread 10 (Thread 0x40696940 (LWP 10776))]#0 0x0000003762acaf36 in poll () from /lib64/libc.so.6 (gdb) where #0 0x0000003762acaf36 in poll () from /lib64/libc.so.6 #1 0x000000376464a9f0 in ?? () from /usr/lib64/libX11.so.6 #2 0x000000376464ae19 in _XRead () from /usr/lib64/libX11.so.6 #3 0x000000376464b811 in _XReply () from /usr/lib64/libX11.so.6 #4 0x00000037646434ea in XSync () from /usr/lib64/libX11.so.6 #5 0x00002aaab24c6d84 in X11SD_GetSharedImage () from /net/bigbean/export3/2d/bae/bugs/7032904/linux-amd64/lib/amd64/xawt/libmawt.so #6 0x00002aaab24c82e4 in X11SD_GetImage () from /net/bigbean/export3/2d/bae/bugs/7032904/linux-amd64/lib/amd64/xawt/libmawt.so #7 0x00002aaab24c8a7a in X11SD_GetRasInfo () from /net/bigbean/export3/2d/bae/bugs/7032904/linux-amd64/lib/amd64/xawt/libmawt.so #8 0x00002aaab220e221 in Java_sun_java2d_loops_Blit_Blit () from /net/bigbean/export3/2d/bae/bugs/7032904/linux-amd64/lib/amd64/libawt.so #9 0x00002aaaab63e6ad in ?? () #10 0x0000000000000000 in ?? () So, the hang happens inside XSync() call, what likely can be caused by concurrent acess to awt_display. We need to check whether XRender implementation of surface data correcly uses AWT_LOCK/AWT_UNLOCK calls.

06-04-2011