Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8360139

JVM crashes on invalid bytecode in Unsafe.defineAnonymousClass (JDK 8)

XMLWordPrintable

    • x86_64
    • linux_ubuntu

      ADDITIONAL SYSTEM INFORMATION :
      wsl2-ubuntu 22.04
      Linux 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

      java version "1.8.0_451"
      Java(TM) SE Runtime Environment (build 1.8.0_451-b10)
      Java HotSpot(TM) 64-Bit Server VM (build 25.451-b10, mixed mode)

      java version "11.0.27" 2025-04-15 LTS
      Java(TM) SE Runtime Environment 18.9 (build 11.0.27+8-LTS-232)
      Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.27+8-LTS-232, mixed mode)

      A DESCRIPTION OF THE PROBLEM :
      The following test program will crash Java Runtime Environment in JDK 8. However, it executes successfully in JDK 11.

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      Using JDK 8, run the following command:
      ```
      javac Test.java
      java Test
      ```

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      The program should throw an exception.
      ACTUAL -
      The program will crash Java Runtime Environment.
      ```
      #
      # A fatal error has been detected by the Java Runtime Environment:
      #
      # SIGSEGV (0xb) at pc=0x00007f1924471a24, pid=4866, tid=0x00007f1923bd4640
      #
      # JRE version: Java(TM) SE Runtime Environment (8.0_451) (build 1.8.0_451-b10)
      # Java VM: Java HotSpot(TM) 64-Bit Server VM (25.451-b10 mixed mode linux-amd64 compressed oops)
      # Problematic frame:
      # V [libjvm.so+0x7b5a24] Klass::external_name() const+0x14
      ...
      ```

      ---------- BEGIN SOURCE ----------
      public class Test {
          public static void main(String[] args) {
              try {
                  java.lang.reflect.Field field = sun.misc.Unsafe.class.getDeclaredField("theUnsafe");
                  field.setAccessible(true);
                  sun.misc.Unsafe unsafe = (sun.misc.Unsafe) field.get(null);
                  Class<?> hostClass = int.class;
                  byte[] bytecode = new byte[] { (byte) 0x00, (byte) 0x01, (byte) 0x02, (byte) 0x03 };
                  Object instance = unsafe.defineAnonymousClass(hostClass, bytecode, null);
              } catch (Exception e) {
              }
          }
      }
      ---------- END SOURCE ----------

            Unassigned Unassigned
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: