Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8327177

macOS: wrong GlobalRef deleted in GlassMenu

    XMLWordPrintable

Details

    Backports

      Description

        When `com.sun.glass.ui.mac.MacMenuDelegate` is invoked with an empty callback, there is a possibility that later a globalRef will be deleted for wrong reasons.

        The problem is in the native implementation in GlassMenu.m. The invoked `Java_com_sun_glass_ui_mac_MacMenuDelegate__1setCallback` will delete the JNI globalRef to the current `menu->jCallback`, but it does not remove the value of `menu->jCallback` when the new callback is `null`.
        When later the `menu` object is released, the `dealloc` method will check if the `menu->jCallback` is null, and if not, it will invoke `env->DeleteGlobalRef` on it.

        There is a possibility that in the meantime (between invoking setCallback with an empty callback and deleting the menu) the old value is reused as the result of a next call to env->newGlobalRef, in which case that new globalRef will suddenly become deleted.

        This caused a crash in applications where the first globalRef was reused in a submitForLaterInvocation call.

        Solution:
        set the value of `menu->jCallback` to `null` immediately after invoking `(*env)->DeleteGlobalRef(env, menu->jCallback);` in `Java_com_sun_glass_ui_mac_MacMenuDelegate__1setCallback`

        Attachments

          Issue Links

            Activity

              People

                jvos Johan Vos
                jvos Johan Vos
                Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: