JDK-8149790 : NegativeArraySizeException with hprof
  • Type: Bug
  • Component: core-svc
  • Sub-Component: tools
  • Affected Version: 9
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2016-02-15
  • Updated: 2019-05-22
  • Resolved: 2017-08-22
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 10
10 b22Fixed
Related Reports
Relates :  
JDK-8129419 - heapDumper.cpp: assert(length_in_bytes > 0) failed: nothing to copy
Relates :  
JDK-8186501 - jmap fails with IndexOutOfBoundsException 20 18
Relates :  
JDK-8144732 - VM_HeapDumper hits assert with bad dump_len
Sub Tasks
JDK-8153206 :  
Quarantine heapdump/JMapHeap until JDK-8149790 has been fixed - Resolved
JDK-8186255 :  
[TESTBUG] Fix test heapdump/JMapHeap and unquarantine after JDK-8149790 has been fixed - Resolved
Description
Exception in thread "main" java.lang.NegativeArraySizeException
	at jdk.test.lib.hprof.model.JavaObjectArray.readValue(JavaObjectArray.java:167)
	at jdk.test.lib.hprof.model.JavaLazyReadObject.getValue(JavaLazyReadObject.java:72)
	at jdk.test.lib.hprof.model.JavaObjectArray.getElements(JavaObjectArray.java:91)
	at jdk.test.lib.hprof.model.JavaObjectArray.visitReferencedObjects(JavaObjectArray.java:117)
	at jdk.test.lib.hprof.model.Snapshot.calculateReferencesToObjects(Snapshot.java:323)
	at jdk.test.lib.hprof.model.Snapshot.resolve(Snapshot.java:291)
	at jdk.test.lib.hprof.HprofParser.parse(HprofParser.java:87)
	at jdk.test.lib.hprof.HprofParser.parse(HprofParser.java:54)
	at jdk.test.lib.hprof.HprofParser.main(HprofParser.java:47)
Comments
Someone else will have to take over this bug. Uploading patch that I tried to get reviewed.
27-05-2016
This is related to JDK-8129419 and JDK-8144732. This time it is the hprof verifier that overflows an int by trying to read an object array as a byte array. If the object array has more than 268435455 elements (on 64-bit) then the length counted in bytes will overflow an int and we get a NegativeArraySizeException. Code in question (JavaObjectArray.java:158): protected final byte[] readValue() throws IOException { ... int idSize = cl.getIdentifierSize(); ... byte[] res = new byte[len * idSize]; Since java can only use an int as array index, reading the object array as a byte array can never be guaranteed to work. Instead the hprof verifier will need to be changed to read it as the actual type (Object[]).
17-02-2016