JDK-8345256 : Starting process (ProcessBuilder.start()) with Mac App Sandbox hangs for minutes
  • Type: Bug
  • Component: core-libs
  • Sub-Component: java.lang
  • Affected Version: 17
  • Priority: P3
  • Status: Resolved
  • Resolution: Incomplete
  • OS: os_x
  • CPU: x86_64
  • Submitted: 2024-11-28
  • Updated: 2024-12-02
  • Resolved: 2024-12-02
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other
tbdResolved
Related Reports
Duplicate :  
Relates :  
Relates :  
Description
ADDITIONAL SYSTEM INFORMATION :
macOS 15.1.1 (24B91)
Apple M3 (ARM)

openjdk version "17.0.13" 2024-10-15 LTS
OpenJDK Runtime Environment Zulu17.54+21-CA (build 17.0.13+11-LTS)
OpenJDK 64-Bit Server VM Zulu17.54+21-CA (build 17.0.13+11-LTS, mixed mode, sharing)

(also tested and confirmed issue with Adoptium OpenJDK)
(also tested and confirmed with OpenJDK 21)

A DESCRIPTION OF THE PROBLEM :
If a process is started from a Java app that is run from within the macOS App Sandbox (https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox), the Java program will hang for a few minutes before successfully running the process. For example, the provided Java code should just open Finder. If you compile that into a jar file and use a macOS sandboxed app to execute the java file (e.g. `java -jar /path/to/file.jar`), it will hang for several minutes before finally opening Finder.

I do understand that this may be a macOS issue, and also intend to report the issue to Apple.


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Compile a jar file with the provided code.
2. Build a native macOS app that has App Sandbox enabled that runs the jar file. For example, something like this code in Swift:
```
let jarURL = Bundle.main.url(forResource: "JavaProcessBuilder", withExtension: "jar")
let javaURL = URL(filePath: "/Library/Java/JavaVirtualMachines/zulu-17.jdk/Contents/Home/bin/java")
let process = Process()
process.executableURL = javaURL
process.arguments = ["-jar", jarURL!.path]
try? process.run()
process.waitUntilExit()
```
3. Run the app.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Finder opens almost instantly.
ACTUAL -
Java hangs for up to several minutes.

During this time, you can see a child process was launched called `jspawnhelper`. Using a debugger, I found that `jspawnhelper` was stuck during a call to the `close` C function. From looking at the source code, I believe the relevant line is at https://github.com/openjdk/jdk/blob/1a07d542ec810282eb78653698d098a24b35686f/src/java.base/unix/native/jspawnhelper/jspawnhelper.c#L183 and linked to the fix for the bug https://bugs.openjdk.org/browse/JDK-8307990. If I revert to an older OpenJDK before that fix (such as 17.0.10), I can no longer reproduce the issue.

---------- BEGIN SOURCE ----------
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

public class Main {
    public static void main(String[] args) {
        ProcessBuilder builder = new ProcessBuilder();
        List<String> cmd = new ArrayList<>();
        cmd.add("/usr/bin/open");
        cmd.add("-aFinder");
        builder.command(cmd);
        try {
            builder.start();
        } catch (IOException e) {
            System.out.println("Process failed to start: " + e.getLocalizedMessage());
        }
    }
}
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Downgrade to a version of Java without the fix to https://bugs.openjdk.org/browse/JDK-8307990, or disable App Sandbox.

FREQUENCY : always



Comments
This appears to be a duplicate of JDK-8343285.
02-12-2024

Please re-test with JDK 17.0.14.
02-12-2024

Its reasonable to request the submitter to re-confirm using the latest release that should have the current fix. 17.0.14. Thanks
02-12-2024

This looks like it indeed would be fixed by JDK-8343285, though I am having a difficult time to reproduce it, because I don't have Apple developer ID, so I can not create a valid signed sandboxed binary produced by Xcode to try it. I might just have to get a personal Apple developer ID to do it.
02-12-2024

[~gziemski] Can you take a look and comment if JDK-8343285 should have addressed it.
02-12-2024

This hang looks like JDK-8324577, the launcher is closing an excessively large number of file descriptors. The original change was backported to 17 and 21. The revised limit has been backported to 17.0.14 and 21.0.6
02-12-2024

Additional Information from submitter: ==================================== Hmm, not sure what the difference is between my and your environments that cause you to not be able to reproduce. To test I additionally did the following and was able to reproduce the issue in every case: - Tested in a macOS 15.1.1 VM - Tested in a freshly created macOS 14.6.1 VM, installed OpenJDK, and ran the app - Tried both native ARM and x86_64 (using Rosetta) versions of OpenJDK in the aforementioned VM - Tested with both disabled and enabled System Integrity Protection in the aforementioned VM - Tried the latest OpenJDK reference implementation at https://openjdk.org/projects/jdk/23/ to rule out a Zulu/Adoptium-specific issue; build 23.0.1+11-39 In each case `jspawnhelper` is hanging with 100% CPU usage for a few minutes. I would upload the Xcode project that I am using to rule out any differences there, though I don't see an option to upload files here. The App Sandbox entitlement settings are the same as they are in a default macOS App project, though (App Sandbox enabled + no special entitlements also reproduces the issue). However, an interesting workaround I found is that applying an entitlement to allow the sandboxed app to read `/dev/` gets rid of the hang, example entitlements file: ``` <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.temporary-exception.files.absolute-path.read-only</key> <array> <string>/dev/</string> </array> </dict> </plist> ```
02-12-2024

The observations on M2: JDK 17.0.13+10: Passed, finder responds immediately.
29-11-2024