Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8332271

Reading data from the clipboard from multiple threads crashes the JVM

XMLWordPrintable

    • b02
    • x86_64
    • windows

        ADDITIONAL SYSTEM INFORMATION :
        Tested on Windows 11 with multiple JDKs from 1.8 to 23 - all with the same result

        A DESCRIPTION OF THE PROBLEM :
        Attempting to read data from the windows system clipboard via Toolkit.getDefaultToolkit().getSystemClipboard().getData(flavor) from multiple threads hard-crashes the JVM - there is not even a hs_err file created. I was able to analyze a windows crashdump with WinDbg and it pointed at a double-free error in awt.dll:


        ************* Preparing the environment for Debugger Extensions Gallery repositories **************
           ExtensionRepository : Implicit
           UseExperimentalFeatureForNugetShare : true
           AllowNugetExeUpdate : true
           NonInteractiveNuget : true
           AllowNugetMSCredentialProviderInstall : true
           AllowParallelInitializationOfLocalRepositories : true

           EnableRedirectToV8JsProvider : false

           -- Configuring repositories
              ----> Repository : LocalInstalled, Enabled: true
              ----> Repository : UserExtensions, Enabled: true

        >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

        ************* Waiting for Debugger Extensions Gallery to Initialize **************

        >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.125 seconds
           ----> Repository : UserExtensions, Enabled: true, Packages count: 0
           ----> Repository : LocalInstalled, Enabled: true, Packages count: 41

        Microsoft (R) Windows Debugger Version 10.0.27553.1004 AMD64
        Copyright (c) Microsoft Corporation. All rights reserved.


        Loading Dump File [C:\Users\User\AppData\Local\CrashDumps\java.exe.47948.dmp]
        User Mini Dump File with Full Memory: Only application data is available


        ************* Path validation summary **************
        Response Time (ms) Location
        Deferred srv*
        Symbol search path is: srv*
        Executable search path is:
        Windows 10 Version 22635 MP (24 procs) Free x64
        Product: WinNt, suite: SingleUserTS
        Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
        Debug session time: Fri May 3 00:22:41.000 2024 (UTC + 2:00)
        System Uptime: 0 days 14:50:17.422
        Process Uptime: 0 days 0:00:02.000
        ....................................................
        This dump file has an exception of interest stored in it.
        The stored exception information can be accessed via .ecxr.
        (bb4c.65bc): Unknown exception - code c0000374 (first/second chance not available)
        For analysis of this file, run !analyze -v
        ntdll!NtWaitForMultipleObjects+0x14:
        00007ffa`2df904a4 c3 ret
        0:024> !analyze -v
        *******************************************************************************
        * *
        * Exception Analysis *
        * *
        *******************************************************************************

        *** WARNING: Check Image - Checksum mismatch - Dump: 0x21d3f8, File: 0x2232bf - C:\ProgramData\Dbg\sym\ntdll.dll\92B2DF34217000\ntdll.dll

        KEY_VALUES_STRING: 1

            Key : Analysis.CPU.mSec
            Value: 468

            Key : Analysis.Elapsed.mSec
            Value: 788

            Key : Analysis.IO.Other.Mb
            Value: 0

            Key : Analysis.IO.Read.Mb
            Value: 0

            Key : Analysis.IO.Write.Mb
            Value: 0

            Key : Analysis.Init.CPU.mSec
            Value: 124

            Key : Analysis.Init.Elapsed.mSec
            Value: 3757

            Key : Analysis.Memory.CommitPeak.Mb
            Value: 94

            Key : Failure.Bucket
            Value: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_awt.dll!Unknown

            Key : Failure.Hash
            Value: {79be7af0-5da8-6287-6e60-4343c4e39886}

            Key : Timeline.OS.Boot.DeltaSec
            Value: 53417

            Key : Timeline.Process.Start.DeltaSec
            Value: 2

            Key : WER.OS.Branch
            Value: ni_release

            Key : WER.OS.Version
            Value: 10.0.22621.1

            Key : WER.Process.Version
            Value: 23.0.0.0


        FILE_IN_CAB: java.exe.47948.dmp

        NTGLOBALFLAG: 0

        APPLICATION_VERIFIER_FLAGS: 0

        CONTEXT: (.ecxr)
        rax=0000000000000000 rbx=00000000c0000374 rcx=c595765353b5e950
        rdx=0000000000000000 rsi=0000000000000001 rdi=00007ffa2e0738b0
        rip=00007ffa2dffc769 rsp=000000e37fbfebb0 rbp=000000e37fbfefa8
         r8=0000000000000000 r9=0000ca22932b3d9d r10=00007ff95f8c3c87
        r11=0000000000000b08 r12=0000000000000000 r13=000002469d1b6908
        r14=0000000000000800 r15=000000e37fbfeed0
        iopl=0 nv up ei pl nz na po nc
        cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
        ntdll!RtlReportFatalFailure+0x9:
        00007ffa`2dffc769 eb00 jmp ntdll!RtlReportFatalFailure+0xb (00007ffa`2dffc76b)
        Resetting default scope

        EXCEPTION_RECORD: (.exr -1)
        ExceptionAddress: 00007ffa2dffc769 (ntdll!RtlReportFatalFailure+0x0000000000000009)
           ExceptionCode: c0000374
          ExceptionFlags: 00000081
        NumberParameters: 1
           Parameter[0]: 00007ffa2e0738b0

        PROCESS_NAME: java.exe

        ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

        EXCEPTION_CODE_STR: c0000374

        EXCEPTION_PARAMETER1: 00007ffa2e0738b0

        FAULTING_THREAD: ffffffff

        STACK_TEXT:
        00007ffa`2e073908 00007ffa`2e011aa5 ntdll!RtlpLogHeapFailure+0x45
        00007ffa`2e073910 00007ffa`2df66217 ntdll!RtlpProbeUserBufferSafe+0x53
        00007ffa`2e073918 00007ffa`2df65ede ntdll!RtlGetUserInfoHeap+0xce
        00007ffa`2e073920 00007ffa`2b87983d KERNELBASE!GlobalSize+0xbd
        00007ffa`2e073928 00007ff9`7ca0e197 awt+0x87
        00007ffa`2e073930 00000246`3a62d227 unknown!unknown+0x0


        STACK_COMMAND: ** Pseudo Context ** HeapPseudo ** Value: 18299bf78c0 ** ; kb

        SYMBOL_NAME: awt+87

        MODULE_NAME: awt

        IMAGE_NAME: awt.dll

        FAILURE_BUCKET_ID: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_awt.dll!Unknown

        OS_VERSION: 10.0.22621.1

        BUILDLAB_STR: ni_release

        OSPLATFORM_TYPE: x64

        OSNAME: Windows 10

        IMAGE_VERSION: 23.0.0.0

        FAILURE_ID_HASH: {79be7af0-5da8-6287-6e60-4343c4e39886}

        Followup: MachineOwner
        ---------



        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        Execute Toolkit.getDefaultToolkit().getSystemClipboard().getData(flavor) from multiple threads

        EXPECTED VERSUS ACTUAL BEHAVIOR :
        EXPECTED -
        Getting the contents of the clipboard in all threads
        ACTUAL -
        A hard crash of the JVM with no ErrorFile for memdump being created from Java's side

        ---------- BEGIN SOURCE ----------
        package org.example;

        import java.awt.*;
        import java.awt.datatransfer.Clipboard;
        import java.awt.datatransfer.DataFlavor;

        public class Main {
            public static void main(String[] args) {
                new Thread(new ClipboardLoader()).start();
                new Thread(new ClipboardLoader()).start();
                while (true) {
                    try {
                        Thread.sleep(1000);
                    } catch (InterruptedException ignored) {
                    }
                    System.out.println("Still alive");
                }
            }

            public static class ClipboardLoader implements Runnable {
                @Override
                public void run() {
                    final Clipboard systemClipboard = Toolkit.getDefaultToolkit().getSystemClipboard();
                    while (true) {
                        try {
                            if(systemClipboard.isDataFlavorAvailable(DataFlavor.stringFlavor)) {
                                systemClipboard.getData(DataFlavor.stringFlavor);
                            }
                        } catch (Exception ignored) {
                        }
                    }
                }
            }
        }
        ---------- END SOURCE ----------

        CUSTOMER SUBMITTED WORKAROUND :
        Add a guard against multi-threaded access to the clipboard.

        FREQUENCY : always


              achung Alisen Chung
              webbuggrp Webbug Group
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: