Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8332866

Crash in ImageIO JPEG decoding when MEM_STATS in enabled

XMLWordPrintable

    • b26
    • generic
    • generic

        In IJG library's jmemmgr.c file we can define MEM_STATS to enable printing of memory statistic logs when we have OOM. But if we enable it we get crash while disposing IJG stored objects in jmemmgr->free-pool() function.

        #
        # A fatal error has been detected by the Java Runtime Environment:
        #
        # SIGSEGV (0xb) at pc=0x0000000103743164, pid=82400, tid=8707
        #
        # JRE version: Java(TM) SE Runtime Environment (23.0) (fastdebug build 23-internal-2024-05-24-0701510.jdv...)
        # Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 23-internal-2024-05-24-0701510.jdv..., mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, bsd-aarch64)
        # Problematic frame:
        # C [libjavajpeg.dylib+0x23164] free_pool+0x50
        #
        # No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
        #
        # If you would like to submit a bug report, please visit:
        # https://bugreport.java.com/bugreport/crash.jsp
        # The crash happened outside the Java Virtual Machine in native code.
        # See problematic frame for where to report the bug.
        #

        --------------- S U M M A R Y ------------

        Command Line: -javaagent:/Applications/IntelliJ IDEA CE.app/Contents/lib/idea_rt.jar=49954:/Applications/IntelliJ IDEA CE.app/Contents/bin -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8 -Dsun.stderr.encoding=UTF-8 ImageDecoding

        Host: jdv-mac, "MacBookPro18,1" arm64, 10 cores, 32G, Darwin 23.3.0, macOS 14.3.1 (23D60)
        Time: Fri May 24 13:27:36 2024 IST elapsed time: 5.160990 seconds (0d 0h 0m 5s)

        --------------- T H R E A D ---------------

        Current thread (0x0000000153009810): JavaThread "main" [_thread_in_native, id=8707, stack(0x000000016dcd4000,0x000000016ded7000) (2060K)]

        Stack: [0x000000016dcd4000,0x000000016ded7000], sp=0x000000016ded66c0, free space=2057k
        Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
        C [libjavajpeg.dylib+0x23164] free_pool+0x50
        C [libjavajpeg.dylib+0x23324] self_destruct+0x18
        C [libjavajpeg.dylib+0xdf34] jDestroy+0x24
        C [libjavajpeg.dylib+0x409c] Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_disposeReader+0x40

        This is happening because we delete the error handler before we actually start deleting IJG stored objects and while freeing the IJG objects we try to access cinfo->err->trace_level of error handler. This early deletion of error handler is happening in jpegloader.c->imageio_dispose() function. We should delete error handler after we are done with deleting IJG stored objects.

              jdv Jayathirth D V
              jdv Jayathirth D V
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: