JDK-5065001 : awt TextArea crashes HotSpot on winXP when frame is closed
  • Type: Bug
  • Component: client-libs
  • Sub-Component: java.awt
  • Affected Version: 1.4.2_06,5.0,5.0u4,6
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • OS: windows_2000,windows_xp
  • CPU: x86
  • Submitted: 2004-06-17
  • Updated: 2005-06-07
  • Resolved: 2004-12-06
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6
6 b15Fixed
Related Reports
Duplicate :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Description
Name: rmT116609			Date: 06/17/2004


FULL PRODUCT VERSION :
java version "1.5.0-beta2"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0-beta2-b51)
Java HotSpot(TM) Client VM (build 1.5.0-beta2-b51, mixed mode, sharing)

FULL OS VERSION :
Microsoft Windows XP [Version 5.1.2600]

A DESCRIPTION OF THE PROBLEM :
I have awt TextArea inside a frame.  A thread is writing text to the text area when the frame is closed. The VM then crashes (due to native TextArea code).
I have observed this  behaviour on XP Home 2002 SP1 and XP Pro SP1 (haven't tried any others). This happens both with the Client and Server VM.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Compile and run the code provided.
You may have to use "alt+tab" to give window with the textArea the focus.
The program uses the Robot class to repeatedly close and open the Frame.  It makes a maximum of 180 attempts (or less if VM crashes).
You may have to run this program more than once.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Frame with textArea has the 'X' button clicked 180 times by the robot, without a crash.
ACTUAL -
After several windowClosings, HotSpot crashes.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x6d0e1e5d, pid=448, tid=1160
#
# Java VM: Java HotSpot(TM) Client VM (1.5.0-beta2-b51 mixed mode, sharing)
# Problematic frame:
# C  [awt.dll+0xe1e5d]
#

---------------  T H R E A D  ---------------

Current thread (0x00a5d0e0):  JavaThread "Thread-2" [_thread_in_native, id=1160]

siginfo: ExceptionCode=0xc0000005, reading address 0x000001bc

Registers:
EAX=0x00000000, EBX=0x03981210, ECX=0x00a59530, EDX=0x00350608
ESP=0x037af9e0, EBP=0x037afa0c, ESI=0x00a5d19c, EDI=0x00a59530
EIP=0x6d0e1e5d, EFLAGS=0x00010202

  Top of Stack: (sp=0x037af9e0)
0x037af9e0:   03981210 000019d5 00a5d0e0 26a71de8
0x037af9f0:   26a71de8 6d6fe665 00000000 037af9e8
0x037afa00:   037afbe4 6d0f3acc 00000000 037afa38
0x037afa10:   00a6826f 000019d5 037afa48 037afa1c
0x037afa20:   00000000 037afa48 26a72ef8 00000000
0x037afa30:   26a71de8 037afa48 037afa74 00a62d00
0x037afa40:   00000000 00a66453 22f7d120 22f6c218
0x037afa50:   00000000 22f6c218 037afa50 26a66b66

Instructions: (pc=0x6d0e1e5d)
0x6d0e1e4d:   e8 bc c6 00 00 59 8b d8 ff 75 08 8b 07 8b cf 53
0x6d0e1e5d:   ff 90 bc 01 00 00 53 8b cf e8 d5 fa ff ff 53 ff


Stack: [0x036b0000,0x037b0000),  sp=0x037af9e0,  free space=1022k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [awt.dll+0xe1e5d]
j  sun.awt.windows.WTextComponentPeer.getText()Ljava/lang/String;+0
j  java.awt.TextComponent.getText()Ljava/lang/String;+14
J  java.awt.TextArea.appendText(Ljava/lang/String;)V
J  java.awt.TextArea.append(Ljava/lang/String;)V
v  ~RuntimeStub::alignment_frame_return Runtime1 stub
j  CrashTest$3.run()V+5
v  ~StubRoutines::call_stub
V  [jvm.dll+0x81663]
V  [jvm.dll+0xd3b5d]
V  [jvm.dll+0x81534]
V  [jvm.dll+0x81291]
V  [jvm.dll+0x9bd30]
V  [jvm.dll+0xfdeb2]
V  [jvm.dll+0xfde80]
C  [MSVCRT.dll+0x27fb8]
C  [kernel32.dll+0x1d33b]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  sun.awt.windows.WTextComponentPeer.getText()Ljava/lang/String;+0
j  java.awt.TextComponent.getText()Ljava/lang/String;+14
J  java.awt.TextArea.appendText(Ljava/lang/String;)V
J  java.awt.TextArea.append(Ljava/lang/String;)V
v  ~RuntimeStub::alignment_frame_return Runtime1 stub
j  CrashTest$3.run()V+5
v  ~StubRoutines::call_stub

---------------  P R O C E S S  ---------------

Java Threads: ( => current thread )
  0x00355e50 JavaThread "DestroyJavaVM" [_thread_blocked, id=112]
  0x00a5c238 JavaThread "Thread-3" [_thread_blocked, id=1472]
=>0x00a5d0e0 JavaThread "Thread-2" [_thread_in_native, id=1160]
  0x00a56af0 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=1168]
  0x00a51888 JavaThread "AWT-Windows" daemon [_thread_in_native, id=1156]
  0x00a51460 JavaThread "AWT-Shutdown" [_thread_blocked, id=1164]
  0x00a503c0 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=1176]
  0x009fb2b8 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=1128]
  0x009f9fc8 JavaThread "CompilerThread0" daemon [_thread_blocked, id=1060]
  0x009f9150 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=1020]
  0x009d64a8 JavaThread "Finalizer" daemon [_thread_blocked, id=988]
  0x009d5008 JavaThread "Reference Handler" daemon [_thread_blocked, id=624]

Other Threads:
  0x009f6718 VMThread [id=608]
  0x009fc5f0 WatcherThread [id=1172]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
 def new generation   total 576K, used 250K [0x22a60000, 0x22b00000, 0x22f40000)
  eden space 512K,  46% used [0x22a60000, 0x22a9b8a0, 0x22ae0000)
  from space 64K,  19% used [0x22ae0000, 0x22ae3180, 0x22af0000)
  to   space 64K,   0% used [0x22af0000, 0x22af0000, 0x22b00000)
 tenured generation   total 1888K, used 1522K [0x22f40000, 0x23118000, 0x26a60000)
   the space 1888K,  80% used [0x22f40000, 0x230bc800, 0x230bca00, 0x23118000)
 compacting perm gen  total 8192K, used 100K [0x26a60000, 0x27260000, 0x2aa60000)
   the space 8192K,   1% used [0x26a60000, 0x26a793a0, 0x26a79400, 0x27260000)
    ro space 8192K,  66% used [0x2aa60000, 0x2afb0a70, 0x2afb0c00, 0x2b260000)
    rw space 12288K,  46% used [0x2b260000, 0x2b7f3ce0, 0x2b7f3e00, 0x2be60000)

Dynamic libraries:
0x00400000 - 0x0040c000 	C:\Program Files\Java\jdk1.5.0\bin\javaw.exe
0x77f50000 - 0x77ff7000 	C:\WINDOWS\System32\ntdll.dll
0x77e60000 - 0x77f46000 	C:\WINDOWS\system32\kernel32.dll
0x77dd0000 - 0x77e5d000 	C:\WINDOWS\system32\ADVAPI32.dll
0x78000000 - 0x78087000 	C:\WINDOWS\system32\RPCRT4.dll
0x77d40000 - 0x77dcc000 	C:\WINDOWS\system32\USER32.dll
0x7e090000 - 0x7e0d1000 	C:\WINDOWS\system32\GDI32.dll
0x77c10000 - 0x77c63000 	C:\WINDOWS\system32\MSVCRT.dll
0x6d630000 - 0x6d7b4000 	C:\Program Files\Java\jdk1.5.0\jre\bin\client\jvm.dll
0x76b40000 - 0x76b6c000 	C:\WINDOWS\System32\WINMM.dll
0x6d280000 - 0x6d288000 	C:\Program Files\Java\jdk1.5.0\jre\bin\hpi.dll
0x76bf0000 - 0x76bfb000 	C:\WINDOWS\System32\PSAPI.DLL
0x6d600000 - 0x6d60c000 	C:\Program Files\Java\jdk1.5.0\jre\bin\verify.dll
0x6d2f0000 - 0x6d30d000 	C:\Program Files\Java\jdk1.5.0\jre\bin\java.dll
0x6d620000 - 0x6d62f000 	C:\Program Files\Java\jdk1.5.0\jre\bin\zip.dll
0x6d000000 - 0x6d166000 	C:\Program Files\Java\jdk1.5.0\jre\bin\awt.dll
0x73000000 - 0x73023000 	C:\WINDOWS\System32\WINSPOOL.DRV
0x76390000 - 0x763ac000 	C:\WINDOWS\System32\IMM32.dll
0x771b0000 - 0x772d4000 	C:\WINDOWS\system32\ole32.dll
0x5ad70000 - 0x5ada4000 	C:\WINDOWS\System32\uxtheme.dll
0x51000000 - 0x51047000 	C:\WINDOWS\System32\ddraw.dll
0x73bc0000 - 0x73bc6000 	C:\WINDOWS\System32\DCIMAN32.dll
0x5c000000 - 0x5c0c8000 	C:\WINDOWS\System32\D3DIM700.DLL
0x6d240000 - 0x6d27e000 	C:\Program Files\Java\jdk1.5.0\jre\bin\fontmanager.dll
0x74720000 - 0x74764000 	C:\WINDOWS\System32\MSCTF.dll
0x74e30000 - 0x74e9a000 	C:\WINDOWS\System32\RICHED20.DLL
0x605d0000 - 0x605d8000 	C:\WINDOWS\System32\mslbui.dll
0x77120000 - 0x771ab000 	C:\WINDOWS\system32\OLEAUT32.DLL

VM Arguments:
java_command: CrashTest

Environment Variables:
PATH=C:\orant\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\sun\AppServer\bin;C:\Program Files\Common Files\GTK\2.0\bin;C:\Sun\AppServer\bin
USERNAME=csbmsvt
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel


---------------  S Y S T E M  ---------------

OS: Windows XP Build 2600 Service Pack 1

CPU:total 2 family 15, cmov, cx8, fxsr, mmx, sse, sse2, ht

Memory: 4k page, physical 523756k(224476k free), swap 1018476k(753044k free)

vm_info: Java HotSpot(TM) Client VM (1.5.0-beta2-b51) for windows-x86, built on May 13 2004 02:09:25 by "java_re" with MS VC++ 6.0



REPRODUCIBILITY :
This bug can be reproduced often.

---------- BEGIN SOURCE ----------
//note: may need to run more than once for crash to occur
//Only tried this on XP Home and Pro Service pack 1
//crashes on virtually every run. (Some runs longer than others)
//WARNING: Robot will control your Mouse for about a minute
//DO NOTE MOVE THE MOUSE WHILE CRASH DEMO RUNS!
import java.awt.*;
import java.awt.event.*;

public class CrashTest {

	static final Frame testFrame = new Frame("Just watch and wait for the crash to happen");;
	static final TextArea ta = new TextArea(20,70);
		
	public static void main(String args[]) {
		Frame f1;
		f1 = new Frame("Main Window (closes on crash)");
		
		f1.addWindowListener(new WindowAdapter() {
			public void windowClosing(WindowEvent we) {
				System.exit(0);
			}
		});
		f1.setSize(300,100);
		
		
		testFrame.add(ta);
		testFrame.pack();
		testFrame.setLocation(100,100);
		
		testFrame.addWindowListener(new WindowAdapter() {
			public void windowClosing(WindowEvent we) {
				//hotspot crash happens when window closed
				testFrame.dispose();
				testFrame.setVisible(true);
					ta.setText("");
				
			}
		});
		
		Thread textWriter = new Thread() {
			public void run() {
				while (true)
				{
					//this line the cause?
					ta.append("Attempting crash Attempting crash Attempting crash Attempting crash Attempting crash \n");
				}
			}
		};
		
		f1.setVisible(true);
		testFrame.setVisible(true);
		textWriter.start();
		
		Thread repeater = new Thread() {
			//robot repeatedly closes frame
			public void run() {
				try {
				Robot r = new Robot();
				int count=0;
				while(true)
				{
					count++;
					r.mouseMove(testFrame.getLocation().x+testFrame.getWidth()-18,
						testFrame.getLocation().y+14);
					r.mousePress(MouseEvent.BUTTON1_MASK);
					r.mouseRelease(MouseEvent.BUTTON1_MASK);
					try {
						Thread.sleep(count+80);
					} catch(Exception e) {}
					//makes 180 attempts to crash
					if (count > 180) return;
				}
				} catch (AWTException ae) {ae.printStackTrace();}
			}
		};
		repeater.start();
	}

}
---------- END SOURCE ----------
(Incident Review ID: 279842) 
======================================================================

Comments
CONVERTED DATA BugTraq+ Release Management Values COMMIT TO FIX: mustang
17-09-2004

EVALUATION The crash happens because we access HWND after its disposal. Here is the stack from debug mode java, here we first hit the assertion check: AwtDebugSupport::AssertCallback(const char * 0x035eddb0 `string', const char * 0x03616b08 `string', int 61) line 165 DAssert_Impl(const char * 0x035eddb0 `string', const char * 0x03616b08 `string', int 61) line 20 + 18 bytes AwtTextComponent::SendMessageW(unsigned int 194, unsigned int 0, long 78911456) line 61 + 29 bytes Java_sun_awt_windows_WTextAreaPeer_replaceText(JNIEnv_ * 0x03218830, _jobject * 0x03dffa2c, _jstring * 0x03dffa28, long 3480, long 3480) line 1004 Java_sun_awt_windows_WTextAreaPeer_insertText(JNIEnv_ * 0x03218830, _jobject * 0x03dffa2c, _jstring * 0x03dffa28, long 3440) line 1025 009ba778() 009b2c29() 00a8be24() 00a8bbc0() 00a60d00() 009b2923() 009b01b7() JavaCalls::call_helper(JavaValue * 0x03dffd58, methodHandle * 0x03dffc44, JavaCallArguments * 0x03dffcac, Thread * 0x03218758) line 376 + 54 bytes os::os_exception_wrapper(void (JavaValue *, methodHandle *, JavaCallArguments *, Thread *)* 0x0813ed59 JavaCalls::call_helper(JavaValue *, methodHandle *, JavaCallArguments *, Thread *), JavaValue * 0x03dffd58, methodHandle * 0x03dffc44, JavaCallArguments * 0x03dffcac, Thread * 0x03218758) line 53 + 19 bytes JavaCalls::call(JavaValue * 0x03dffd58, methodHandle {...}, JavaCallArguments * 0x03dffcac, Thread * 0x03218758) line 286 + 26 bytes JavaCalls::call_virtual(JavaValue * 0x03dffd58, KlassHandle {...}, symbolHandle {...}, symbolHandle {...}, JavaCallArguments * 0x03dffcac, Thread * 0x03218758) line 182 + 21 bytes JavaCalls::call_virtual(JavaValue * 0x03dffd58, Handle {...}, KlassHandle {...}, symbolHandle {...}, symbolHandle {...}, Thread * 0x03218758) line 188 + 29 bytes thread_entry(JavaThread * 0x03218758, Thread * 0x03218758) line 2300 + 68 bytes JavaThread::thread_main_inner() line 1324 + 18 bytes JavaThread::run() line 1311 _start(Thread * 0x03218758) line 304 _threadstartex(void * 0x03219760) line 212 + 13 bytes KERNEL32! 77e7d33b() In AwtTextComponent::SendMessage, we check that HWND is not NULL. This happens because we access the text component directly from the thread on which these methods were called, while Toolkit thread disposes the component. ###@###.### 2004-06-18 While looking into AWT native windows code I have found several other places with SendMessage() calls on non-Toolkit thread. Thea are potentially dangerous so we should fix all of them. Here is (not complete) the list of files to be fixed: awt_Checkbox.cpp, awt_Choice.cpp, awt_TextArea.cpp, awt_TextComponent.cpp, awt_TextField.cpp. For some of them I was able to reproduce the bug ###@###.### 2004-07-22 ###@###.### 2004-07-22
22-07-2004

SUGGESTED FIX Make all the changes to the TextComponents on Toolkit. Wrap the actions of _replaceText, _insertText into methods and call them through messages. ###@###.### 2004-06-18
18-06-2004