JDK-6450538 : Crash when applying LookupOp on color indexed image
  • Type: Bug
  • Component: client-libs
  • Sub-Component: 2d
  • Affected Version: 5.0
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2006-07-19
  • Updated: 2011-01-19
  • Resolved: 2006-12-08
Related Reports
Duplicate :  
JDK-4919031 - LookOp.filter() crashes VM when attempt to filter CMYK jpeg.
Relates :  
JDK-4886732 - AffineTransformOp does not work properly for some of the rendering hints
Description
FULL PRODUCT VERSION :
java SE Runtime Env: 1.6.0-beta2-b86

FULL OS VERSION :
Microsoft Windows XP [version 5.1.2600]

A DESCRIPTION OF THE PROBLEM :
I am developing a game. When the mouse is over a game item, I display the images using a LookupOp to give the feeling that the item is highlighted. Everything works like a charm with 24bits PNG images. I load them and I create a compatible image with them to speed up display.

Here is how I load the image:

private static BufferedImage load(String imgFileName) {
		URL url = ImageLoader.class.getClassLoader().getResource(
				"images/" + imgFileName);

		if (url == null) {
			System.out.println("ImageLoader: Image " + imgFileName
					+ " doesn't exist!!!");
			return null;
		}

		BufferedImage copy = null;
		try {
			BufferedImage im = ImageIO.read(url);
  			int transparency = im.getColorModel().getTransparency();
			copy = gc.createCompatibleImage(im.getWidth(), im.getHeight(),
					transparency);

			Graphics2D g2d = copy.createGraphics();

			g2d.drawImage(im, 0, 0, null);
			g2d.dispose();

			images.put(imgFileName, copy);

		} catch (IOException e) {
			System.out.println("Image loading error for" + url + ":\n" + e);
		}

		return copy;

	}

I use the image returned by this function as argument for the drawImage primitive as follow to generate an highlighted image:

g2d.drawImage(im, lop, 0, 0);

with "lop" created as follow:

public static LookupOp lop = null;
(...)
if (lop == null) {
				byte hl[][] = new byte[4][256];
				int split = 100;
				for (int i = 0; i < 4; i++) {
					for (int j = 0; j < 256; j++) {
						hl[i][j] = (byte) (j);
					}
				}
				for (int j = split; j < 256; j++) {
					hl[0][j] = (byte) Math.min(255, split + 3 * (j - split));
					hl[1][j] = (byte) Math.min(255, split + 3 * (j - split));
					hl[2][j] = (byte) Math.min(255, split + 3 * (j - split));
				}

				ByteLookupTable blut = new ByteLookupTable(0, hl);
				lop = new LookupOp(blut, null);
			}


My problem occurs when I use color indexed PNG images. With those, the non highlighted image (the one returned by function BufferedImage load(String imgFileName) written above)  works absolutely fine. It is displayed OK. As soon as I put my mouse over the image, I call my method in charge of generating an highlighted version of the image. Then it crashes immediately.
I attached the log file.

The thing I don't get is how come there are differences between images created using a gc.createCompatibleImage. For me, if my LookupOp works correctly with some images (the ones created from 24 bits PNG), it should work the same with images created from color indexed images. Am I wrong ?

If you have any idea about this problem, please let me know about it...

Thanks a lot.

Regards.

Vincent.

THE PROBLEM WAS REPRODUCIBLE WITH -Xint FLAG: Did not try

THE PROBLEM WAS REPRODUCIBLE WITH -server FLAG: Did not try

ERROR MESSAGES/STACK TRACES THAT OCCUR :
#
# An unexpected error has been detected by Java Runtime Environment:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x6d050d61, pid=2280, tid=3400
#
# Java VM: Java HotSpot(TM) Client VM (1.6.0-beta2-b86 mixed mode, sharing)
# Problematic frame:
# C  [awt.dll+0x50d61]
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x02b03c00):  JavaThread "Thread-2" [_thread_in_native, id=3400]

siginfo: ExceptionCode=0xc0000005, writing address 0x311320d0

Registers:
EAX=0x1ea897d4, EBX=0xffffffe8, ECX=0x09d0a020, EDX=0x09d0a050
ESP=0x0354f4e0, EBP=0x02b03ce4, ESI=0x09d0a558, EDI=0x00000000
EIP=0x6d050d61, EFLAGS=0x00010206

  Top of Stack: (sp=0x0354f4e0)
0x0354f4e0:   02b03c00 26aaeea0 26aaeea0 0354f678
0x0354f4f0:   09d0a0a0 09d0a2f0 09d0a050 09d0a558
0x0354f500:   037ab968 00000004 09d0a540 09d35e38
0x0354f510:   00000004 00000001 00000004 202297cc
0x0354f520:   1ea9a12c 00000001 00000001 00000001
0x0354f530:   02b5e774 00000001 00000000 00000003
0x0354f540:   02b629d0 6d9be450 00979580 00000000
0x0354f550:   009795cf 00979980 00000000 00000000

Instructions: (pc=0x6d050d61)
0x6d050d51:   4c 24 10 8b 91 1c 02 00 00 8b 0c ba 8b 54 24 18
0x6d050d61:   89 04 8a 8b 44 24 38 47 83 c6 04 3b f8 7c c6 8b


Stack: [0x03500000,0x03550000),  sp=0x0354f4e0,  free space=317k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [awt.dll+0x50d61]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  sun.awt.image.ImagingLib.lookupByteBI(Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImage;[[B)I+0
j  sun.awt.image.ImagingLib.filter(Ljava/awt/image/BufferedImageOp;Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImage;)Ljava/awt/image/BufferedImage;+145
j  java.awt.image.LookupOp.filter(Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImage;)Ljava/awt/image/BufferedImage;+283
j  sun.java2d.pipe.DrawImage.transformImage(Lsun/java2d/SunGraphics2D;Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImageOp;II)V+41
j  sun.java2d.pipe.ValidatePipe.transformImage(Lsun/java2d/SunGraphics2D;Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImageOp;II)V+19
j  sun.java2d.SunGraphics2D.drawImage(Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImageOp;II)V+15
j  kernel.TimeFrame.generateHighlightTimeFrame()V+266
j  kernel.TimeFrame.get(ILkernel/TimeFrame$TF_MODE;)Ljava/awt/image/BufferedImage;+34
J  kernel.MovieClip.display(Ljava/awt/Graphics;II)V
J  kernel.Board.drawImage(Ljava/awt/Graphics2D;)V
j  kernel.Game.gameRender(Ljava/awt/Graphics;)V+179
j  kernel.Game.screenUpdate()V+20
j  kernel.Game.run()V+55
j  java.lang.Thread.run()V+11
v  ~StubRoutines::call_stub

---------------  P R O C E S S  ---------------

Java Threads: ( => current thread )
  0x003a5000 JavaThread "DestroyJavaVM" [_thread_blocked, id=2372]
=>0x02b03c00 JavaThread "Thread-2" [_thread_in_native, id=3400]
  0x02b6c800 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=2424]
  0x02b5d400 JavaThread "AWT-Windows" daemon [_thread_in_native, id=2428]
  0x02b5c800 JavaThread "AWT-Shutdown" [_thread_blocked, id=1176]
  0x02b5a400 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=3680]
  0x02ae2400 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=2412]
  0x02ae1000 JavaThread "CompilerThread0" daemon [_thread_blocked, id=2404]
  0x02adec00 JavaThread "Attach Listener" daemon [_thread_blocked, id=2408]
  0x02addc00 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=2400]
  0x02a9dc00 JavaThread "Finalizer" daemon [_thread_blocked, id=2392]
  0x02a9cc00 JavaThread "Reference Handler" daemon [_thread_blocked, id=2360]

Other Threads:
  0x02a93800 VMThread [id=2344]
  0x02ae3c00 WatcherThread [id=2420]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
 def new generation   total 2304K, used 1117K [0x1e990000, 0x1ec00000, 0x1f360000)
  eden space 2112K,  52% used [0x1e990000, 0x1eaa5cb0, 0x1eba0000)
  from space 192K,   3% used [0x1eba0000, 0x1eba1798, 0x1ebd0000)
  to   space 192K,   0% used [0x1ebd0000, 0x1ebd0000, 0x1ec00000)
 tenured generation   total 29132K, used 29001K [0x1f360000, 0x20fd3000, 0x26990000)
   the space 29132K,  99% used [0x1f360000, 0x20fb24c8, 0x20fb2600, 0x20fd3000)
 compacting perm gen  total 12288K, used 1156K [0x26990000, 0x27590000, 0x2a990000)
   the space 12288K,   9% used [0x26990000, 0x26ab1070, 0x26ab1200, 0x27590000)
    ro space 8192K,  63% used [0x2a990000, 0x2aea2500, 0x2aea2600, 0x2b190000)
    rw space 12288K,  56% used [0x2b190000, 0x2b853e10, 0x2b854000, 0x2bd90000)

Dynamic libraries:
0x00400000 - 0x00423000 	C:\Program Files\Java\jre1.6.0\bin\javaw.exe
0x7c910000 - 0x7c9c7000 	C:\WINDOWS\system32\ntdll.dll
0x7c800000 - 0x7c904000 	C:\WINDOWS\system32\kernel32.dll
0x77da0000 - 0x77e4c000 	C:\WINDOWS\system32\ADVAPI32.dll
0x77e50000 - 0x77ee1000 	C:\WINDOWS\system32\RPCRT4.dll
0x77d10000 - 0x77da0000 	C:\WINDOWS\system32\USER32.dll
0x77ef0000 - 0x77f37000 	C:\WINDOWS\system32\GDI32.dll
0x76320000 - 0x7633d000 	C:\WINDOWS\system32\IMM32.DLL
0x62dc0000 - 0x62dc9000 	C:\WINDOWS\system32\LPK.DLL
0x753c0000 - 0x7542b000 	C:\WINDOWS\system32\USP10.dll
0x77be0000 - 0x77c38000 	C:\WINDOWS\system32\msvcrt.dll
0x7c340000 - 0x7c396000 	C:\Program Files\Java\jre1.6.0\bin\msvcr71.dll
0x6d7f0000 - 0x6da2f000 	C:\Program Files\Java\jre1.6.0\bin\client\jvm.dll
0x76ae0000 - 0x76b0f000 	C:\WINDOWS\system32\WINMM.dll
0x6d310000 - 0x6d318000 	C:\Program Files\Java\jre1.6.0\bin\hpi.dll
0x76ba0000 - 0x76bab000 	C:\WINDOWS\system32\PSAPI.DLL
0x6d7a0000 - 0x6d7ac000 	C:\Program Files\Java\jre1.6.0\bin\verify.dll
0x6d3a0000 - 0x6d3bf000 	C:\Program Files\Java\jre1.6.0\bin\java.dll
0x6d7e0000 - 0x6d7ef000 	C:\Program Files\Java\jre1.6.0\bin\zip.dll
0x6d1f0000 - 0x6d21f000 	C:\Program Files\Java\jre1.6.0\bin\cmm.dll
0x6d440000 - 0x6d464000 	C:\Program Files\Java\jre1.6.0\bin\jpeg.dll
0x6d000000 - 0x6d1c2000 	C:\Program Files\Java\jre1.6.0\bin\awt.dll
0x72f50000 - 0x72f76000 	C:\WINDOWS\system32\WINSPOOL.DRV
0x774a0000 - 0x775dd000 	C:\WINDOWS\system32\ole32.dll
0x5b090000 - 0x5b0c8000 	C:\WINDOWS\system32\uxtheme.dll
0x736b0000 - 0x736f9000 	C:\WINDOWS\system32\ddraw.dll
0x73b10000 - 0x73b16000 	C:\WINDOWS\system32\DCIMAN32.dll
0x6d2b0000 - 0x6d302000 	C:\Program Files\Java\jre1.6.0\bin\fontmanager.dll
0x74690000 - 0x746db000 	C:\WINDOWS\system32\MSCTF.dll
0x10000000 - 0x1000e000 	C:\Program Files\MessengerPlus! 3\MsgPlusLoader.dll
0x63000000 - 0x63014000 	C:\WINDOWS\system32\SynTPFcs.dll
0x77bd0000 - 0x77bd8000 	C:\WINDOWS\system32\VERSION.dll
0x75140000 - 0x7516e000 	C:\WINDOWS\system32\msctfime.ime
0x7c9d0000 - 0x7d1f3000 	C:\WINDOWS\system32\shell32.dll
0x77f40000 - 0x77fb6000 	C:\WINDOWS\system32\SHLWAPI.dll
0x77390000 - 0x77492000 	C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
0x58b50000 - 0x58be7000 	C:\WINDOWS\system32\comctl32.dll
0x60970000 - 0x60979000 	C:\WINDOWS\system32\mslbui.dll
0x73890000 - 0x73960000 	C:\WINDOWS\system32\D3DIM700.DLL
0x6d560000 - 0x6d573000 	C:\Program Files\Java\jre1.6.0\bin\net.dll
0x719f0000 - 0x71a07000 	C:\WINDOWS\system32\WS2_32.dll
0x719e0000 - 0x719e8000 	C:\WINDOWS\system32\WS2HELP.dll
0x6d580000 - 0x6d589000 	C:\Program Files\Java\jre1.6.0\bin\nio.dll

VM Arguments:
jvm_args: -Xmx128m
java_command: kernel.Main 40
Launcher Type: SUN_STANDARD

Environment Variables:
PATH=c:\imagemagick-6.2.2-q16;C:\Latex\texmf\miktex\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\CVS_HOME;C:\AgentCont\bin;C:\Program Files\IDM Computer Solutions\UltraEdit-32;C:\Program Files\Java\jdk1.6.0\bin;C:\Program Files\CVSNTUSERNAME=Vince
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel



---------------  S Y S T E M  ---------------

OS: Windows XP Build 2600 Service Pack 2

CPU:total 2 family 15, cmov, cx8, fxsr, mmx, sse, sse2, ht

Memory: 4k page, physical 523244k(65580k free), swap 1279712k(819192k free)

vm_info: Java HotSpot(TM) Client VM (1.6.0-beta2-b86) for windows-x86, built on Jun  2 2006 00:36:31 by "java_re" with unknown MS VC++:1310



REPRODUCIBILITY :
This bug can be reproduced always.

CUSTOMER SUBMITTED WORKAROUND :
use 24 bits PNG images instead of color indexed PNG.
Comments
EVALUATION The awt_parseImage() does not initialize helper colorOrder array for some custom buffered images (e.g. INT_1888_ARGB, as in this test). This array is used by medialib gluecode in order to re-arrange the lookup table according to proper color order. The elements of the colorOrder array are used as the indexes in updated lookup table and incorrect value (greater than number of image components) can cause the array overrun and leads to memory corruption and crash. The root of the problem seems to be exactly same as the 4919031.
08-12-2006
EVALUATION The root cause of this problem is wrong conversion of INT_1888_ARGB buffered image in the medialib glue code (please take a lookto attached test case). It seems to be related to the bug 4886732.
19-07-2006