P3
ADDITIONAL SYSTEM INFORMATION :
Tested on Windows 11 with multiple JDKs from 1.8 to 23 - all with the same result
A DESCRIPTION OF THE PROBLEM :
Attempting to read data from the windows system clipboard via Toolkit.getDefaultToolkit().getSystemClipboard().getData(flavor) from multiple threads hard-crashes the JVM - there is not even a hs_err file created. I was able to analyze a windows crashdump with WinDbg and it pointed at a double-free error in awt.dll:
************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : true
AllowNugetExeUpdate : true
NonInteractiveNuget : true
AllowNugetMSCredentialProviderInstall : true
AllowParallelInitializationOfLocalRepositories : true
EnableRedirectToV8JsProvider : false
-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true
>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds
************* Waiting for Debugger Extensions Gallery to Initialize **************
>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.125 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 41
Microsoft (R) Windows Debugger Version 10.0.27553.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\User\AppData\Local\CrashDumps\java.exe.47948.dmp]
User Mini Dump File with Full Memory: Only application data is available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 22635 MP (24 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Debug session time: Fri May 3 00:22:41.000 2024 (UTC + 2:00)
System Uptime: 0 days 14:50:17.422
Process Uptime: 0 days 0:00:02.000
....................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(bb4c.65bc): Unknown exception - code c0000374 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ffa`2df904a4 c3 ret
0:024> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Check Image - Checksum mismatch - Dump: 0x21d3f8, File: 0x2232bf - C:\ProgramData\Dbg\sym\ntdll.dll\92B2DF34217000\ntdll.dll
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 468
Key : Analysis.Elapsed.mSec
Value: 788
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 124
Key : Analysis.Init.Elapsed.mSec
Value: 3757
Key : Analysis.Memory.CommitPeak.Mb
Value: 94
Key : Failure.Bucket
Value: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_awt.dll!Unknown
Key : Failure.Hash
Value: {79be7af0-5da8-6287-6e60-4343c4e39886}
Key : Timeline.OS.Boot.DeltaSec
Value: 53417
Key : Timeline.Process.Start.DeltaSec
Value: 2
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
Key : WER.Process.Version
Value: 23.0.0.0
FILE_IN_CAB: java.exe.47948.dmp
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=00000000c0000374 rcx=c595765353b5e950
rdx=0000000000000000 rsi=0000000000000001 rdi=00007ffa2e0738b0
rip=00007ffa2dffc769 rsp=000000e37fbfebb0 rbp=000000e37fbfefa8
r8=0000000000000000 r9=0000ca22932b3d9d r10=00007ff95f8c3c87
r11=0000000000000b08 r12=0000000000000000 r13=000002469d1b6908
r14=0000000000000800 r15=000000e37fbfeed0
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
ntdll!RtlReportFatalFailure+0x9:
00007ffa`2dffc769 eb00 jmp ntdll!RtlReportFatalFailure+0xb (00007ffa`2dffc76b)
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffa2dffc769 (ntdll!RtlReportFatalFailure+0x0000000000000009)
ExceptionCode: c0000374
ExceptionFlags: 00000081
NumberParameters: 1
Parameter[0]: 00007ffa2e0738b0
PROCESS_NAME: java.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.
EXCEPTION_CODE_STR: c0000374
EXCEPTION_PARAMETER1: 00007ffa2e0738b0
FAULTING_THREAD: ffffffff
STACK_TEXT:
00007ffa`2e073908 00007ffa`2e011aa5 ntdll!RtlpLogHeapFailure+0x45
00007ffa`2e073910 00007ffa`2df66217 ntdll!RtlpProbeUserBufferSafe+0x53
00007ffa`2e073918 00007ffa`2df65ede ntdll!RtlGetUserInfoHeap+0xce
00007ffa`2e073920 00007ffa`2b87983d KERNELBASE!GlobalSize+0xbd
00007ffa`2e073928 00007ff9`7ca0e197 awt+0x87
00007ffa`2e073930 00000246`3a62d227 unknown!unknown+0x0
STACK_COMMAND: ** Pseudo Context ** HeapPseudo ** Value: 18299bf78c0 ** ; kb
SYMBOL_NAME: awt+87
MODULE_NAME: awt
IMAGE_NAME: awt.dll
FAILURE_BUCKET_ID: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_awt.dll!Unknown
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 23.0.0.0
FAILURE_ID_HASH: {79be7af0-5da8-6287-6e60-4343c4e39886}
Followup: MachineOwner
---------
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Execute Toolkit.getDefaultToolkit().getSystemClipboard().getData(flavor) from multiple threads
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Getting the contents of the clipboard in all threads
ACTUAL -
A hard crash of the JVM with no ErrorFile for memdump being created from Java's side
---------- BEGIN SOURCE ----------
package org.example;
import java.awt.*;
import java.awt.datatransfer.Clipboard;
import java.awt.datatransfer.DataFlavor;
public class Main {
public static void main(String[] args) {
new Thread(new ClipboardLoader()).start();
new Thread(new ClipboardLoader()).start();
while (true) {
try {
Thread.sleep(1000);
} catch (InterruptedException ignored) {
}
System.out.println("Still alive");
}
}
public static class ClipboardLoader implements Runnable {
@Override
public void run() {
final Clipboard systemClipboard = Toolkit.getDefaultToolkit().getSystemClipboard();
while (true) {
try {
if(systemClipboard.isDataFlavorAvailable(DataFlavor.stringFlavor)) {
systemClipboard.getData(DataFlavor.stringFlavor);
}
} catch (Exception ignored) {
}
}
}
}
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Add a guard against multi-threaded access to the clipboard.
FREQUENCY : always
Tested on Windows 11 with multiple JDKs from 1.8 to 23 - all with the same result
A DESCRIPTION OF THE PROBLEM :
Attempting to read data from the windows system clipboard via Toolkit.getDefaultToolkit().getSystemClipboard().getData(flavor) from multiple threads hard-crashes the JVM - there is not even a hs_err file created. I was able to analyze a windows crashdump with WinDbg and it pointed at a double-free error in awt.dll:
************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : true
AllowNugetExeUpdate : true
NonInteractiveNuget : true
AllowNugetMSCredentialProviderInstall : true
AllowParallelInitializationOfLocalRepositories : true
EnableRedirectToV8JsProvider : false
-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true
>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds
************* Waiting for Debugger Extensions Gallery to Initialize **************
>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.125 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 41
Microsoft (R) Windows Debugger Version 10.0.27553.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\User\AppData\Local\CrashDumps\java.exe.47948.dmp]
User Mini Dump File with Full Memory: Only application data is available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 22635 MP (24 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Debug session time: Fri May 3 00:22:41.000 2024 (UTC + 2:00)
System Uptime: 0 days 14:50:17.422
Process Uptime: 0 days 0:00:02.000
....................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(bb4c.65bc): Unknown exception - code c0000374 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ffa`2df904a4 c3 ret
0:024> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Check Image - Checksum mismatch - Dump: 0x21d3f8, File: 0x2232bf - C:\ProgramData\Dbg\sym\ntdll.dll\92B2DF34217000\ntdll.dll
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 468
Key : Analysis.Elapsed.mSec
Value: 788
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 124
Key : Analysis.Init.Elapsed.mSec
Value: 3757
Key : Analysis.Memory.CommitPeak.Mb
Value: 94
Key : Failure.Bucket
Value: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_awt.dll!Unknown
Key : Failure.Hash
Value: {79be7af0-5da8-6287-6e60-4343c4e39886}
Key : Timeline.OS.Boot.DeltaSec
Value: 53417
Key : Timeline.Process.Start.DeltaSec
Value: 2
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
Key : WER.Process.Version
Value: 23.0.0.0
FILE_IN_CAB: java.exe.47948.dmp
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=00000000c0000374 rcx=c595765353b5e950
rdx=0000000000000000 rsi=0000000000000001 rdi=00007ffa2e0738b0
rip=00007ffa2dffc769 rsp=000000e37fbfebb0 rbp=000000e37fbfefa8
r8=0000000000000000 r9=0000ca22932b3d9d r10=00007ff95f8c3c87
r11=0000000000000b08 r12=0000000000000000 r13=000002469d1b6908
r14=0000000000000800 r15=000000e37fbfeed0
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
ntdll!RtlReportFatalFailure+0x9:
00007ffa`2dffc769 eb00 jmp ntdll!RtlReportFatalFailure+0xb (00007ffa`2dffc76b)
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffa2dffc769 (ntdll!RtlReportFatalFailure+0x0000000000000009)
ExceptionCode: c0000374
ExceptionFlags: 00000081
NumberParameters: 1
Parameter[0]: 00007ffa2e0738b0
PROCESS_NAME: java.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.
EXCEPTION_CODE_STR: c0000374
EXCEPTION_PARAMETER1: 00007ffa2e0738b0
FAULTING_THREAD: ffffffff
STACK_TEXT:
00007ffa`2e073908 00007ffa`2e011aa5 ntdll!RtlpLogHeapFailure+0x45
00007ffa`2e073910 00007ffa`2df66217 ntdll!RtlpProbeUserBufferSafe+0x53
00007ffa`2e073918 00007ffa`2df65ede ntdll!RtlGetUserInfoHeap+0xce
00007ffa`2e073920 00007ffa`2b87983d KERNELBASE!GlobalSize+0xbd
00007ffa`2e073928 00007ff9`7ca0e197 awt+0x87
00007ffa`2e073930 00000246`3a62d227 unknown!unknown+0x0
STACK_COMMAND: ** Pseudo Context ** HeapPseudo ** Value: 18299bf78c0 ** ; kb
SYMBOL_NAME: awt+87
MODULE_NAME: awt
IMAGE_NAME: awt.dll
FAILURE_BUCKET_ID: HEAP_CORRUPTION_ACTIONABLE_BlockNotBusy_DOUBLE_FREE_c0000374_awt.dll!Unknown
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 23.0.0.0
FAILURE_ID_HASH: {79be7af0-5da8-6287-6e60-4343c4e39886}
Followup: MachineOwner
---------
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Execute Toolkit.getDefaultToolkit().getSystemClipboard().getData(flavor) from multiple threads
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Getting the contents of the clipboard in all threads
ACTUAL -
A hard crash of the JVM with no ErrorFile for memdump being created from Java's side
---------- BEGIN SOURCE ----------
package org.example;
import java.awt.*;
import java.awt.datatransfer.Clipboard;
import java.awt.datatransfer.DataFlavor;
public class Main {
public static void main(String[] args) {
new Thread(new ClipboardLoader()).start();
new Thread(new ClipboardLoader()).start();
while (true) {
try {
Thread.sleep(1000);
} catch (InterruptedException ignored) {
}
System.out.println("Still alive");
}
}
public static class ClipboardLoader implements Runnable {
@Override
public void run() {
final Clipboard systemClipboard = Toolkit.getDefaultToolkit().getSystemClipboard();
while (true) {
try {
if(systemClipboard.isDataFlavorAvailable(DataFlavor.stringFlavor)) {
systemClipboard.getData(DataFlavor.stringFlavor);
}
} catch (Exception ignored) {
}
}
}
}
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Add a guard against multi-threaded access to the clipboard.
FREQUENCY : always