Bug 564367 - COM.DoDragDrop crashes JVM with EXCEPTION_ACCESS_VIOLATION
Summary: COM.DoDragDrop crashes JVM with EXCEPTION_ACCESS_VIOLATION
Status: NEW
Alias: None
Product: Platform
Classification: Eclipse Project
Component: SWT (show other bugs)
Version: 4.16   Edit
Hardware: PC Windows 10
: P3 normal (vote)
Target Milestone: ---   Edit
Assignee: Platform-SWT-Inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-06-17 04:37 EDT by Thomas Butz CLA
Modified: 2020-06-27 12:01 EDT (History)
4 users (show)

See Also:


Attachments
Crash log (41.82 KB, text/plain)
2020-06-17 04:37 EDT, Thomas Butz CLA
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Butz CLA 2020-06-17 04:37:31 EDT
Created attachment 283318 [details]
Crash log

We encountered the problem after updating to SWT 4.15 and 4.16 didn't solve it. SWT 4.12 seems not to be affected.

I'm unsure if this is related to bug 513075 and bug 558501


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x000000eb46c80170, pid=308, tid=0x0000000000001c5c
#
# JRE version: OpenJDK Runtime Environment (8.0_252-b09) (build 1.8.0_252-b09)
# Java VM: OpenJDK 64-Bit Server VM (25.252-b09 mixed mode windows-amd64 compressed oops)
# Problematic frame:
# C  0x000000eb46c80170
#
# Core dump written. Default location: c:\OPTITOOL\Client\Oel-Pool\optitool\hs_err_pid308.mdmp
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

---------------  T H R E A D  ---------------

Current thread (0x000000eb19eda800):  JavaThread "main" [_thread_in_native, id=7260, stack(0x000000eb19fa0000,0x000000eb1a0a0000)]

siginfo: ExceptionCode=0xc0000005, ExceptionInformation=0x0000000000000008 0x000000eb46c80170

Registers:
RAX=0x000000eb46c801b0, RBX=0x000000eb46c80170, RCX=0x000000eb46c800f0, RDX=0x0000000000000000
RSP=0x000000eb1a09d2c8, RBP=0x000000eb1a09d350, RSI=0x000000eb508d7320, RDI=0x000000eb46c800f0
R8 =0x0000000000000007, R9 =0x000000eb3cf3cb40, R10=0x000000eb49b97400, R11=0x000000077d1ab860
R12=0x0000000000000000, R13=0x0000000000000000, R14=0x000000eb508d7338, R15=0x000000eb46c80090
RIP=0x000000eb46c80170, EFLAGS=0x0000000000010206

Top of Stack: (sp=0x000000eb1a09d2c8)
0x000000eb1a09d2c8:   00007ffed5660843 b97a593500000005
0x000000eb1a09d2d8:   000000eb46c80170 000000eb1a09d2f8
0x000000eb1a09d2e8:   000000eb1a09d350 0000000080004005
0x000000eb1a09d2f8:   00007ffed5696bcf 000000eb46c80170
0x000000eb1a09d308:   000000eb508d7320 00000000000201c8
0x000000eb1a09d318:   000000eb3cf3cb40 000000eb46caaa80
0x000000eb1a09d328:   00007ffed34a265a 0000000000000000
0x000000eb1a09d338:   000000eb1a09d400 000000eb46c80170
0x000000eb1a09d348:   0000000000000000 000000eb46c80170
0x000000eb1a09d358:   000000eb46caaa80 0000000000000001
0x000000eb1a09d368:   00000000000201c8 0000000000001c5c
0x000000eb1a09d378:   000000eb46c80090 000000eb1a09d400
0x000000eb1a09d388:   00007ffed56968de 0000000000000001
0x000000eb1a09d398:   00007ffed5604ba0 000000eb46c80170
0x000000eb1a09d3a8:   000000eb1a09d490 0000537f00000001
0x000000eb1a09d3b8:   0000000000000001 000002100000038f 

Instructions: (pc=0x000000eb46c80170)
0x000000eb46c80150:   5c 00 00 00 eb 00 00 00 7b 80 3a 5c 00 f1 00 88
0x000000eb46c80160:   50 11 eb 45 eb 00 00 00 78 80 35 5c 00 f2 00 88
0x000000eb46c80170:   d0 6e 0b 47 eb 00 00 00 79 80 34 5c 00 f3 00 88
0x000000eb46c80180:   00 00 00 00 00 00 00 00 76 80 37 5c 00 f4 00 80 


Register to memory mapping:

RAX=0x000000eb46c801b0 is an unknown value
RBX=0x000000eb46c80170 is an unknown value
RCX=0x000000eb46c800f0 is an unknown value
RDX=0x0000000000000000 is an unknown value
RSP=0x000000eb1a09d2c8 is pointing into the stack for thread: 0x000000eb19eda800
RBP=0x000000eb1a09d350 is pointing into the stack for thread: 0x000000eb19eda800
RSI=0x000000eb508d7320 is an unknown value
RDI=0x000000eb46c800f0 is an unknown value
R8 =0x0000000000000007 is an unknown value
R9 =0x000000eb3cf3cb40 is an unknown value
R10={method} {0x000000eb49b97408} 'callback1' '([J)J' in 'org/eclipse/swt/internal/ole/win32/COMObject'
R11=0x000000077d1ab860 is an oop
org.eclipse.swt.dnd.DragSource$2 
 - klass: 'org/eclipse/swt/dnd/DragSource$2'
R12=0x0000000000000000 is an unknown value
R13=0x0000000000000000 is an unknown value
R14=0x000000eb508d7338 is an unknown value
R15=0x000000eb46c80090 is an unknown value


Stack: [0x000000eb19fa0000,0x000000eb1a0a0000],  sp=0x000000eb1a09d2c8,  free space=1012k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  0x000000eb46c80170

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  org.eclipse.swt.internal.ole.win32.COM.DoDragDrop(JJI[I)I+0
j  org.eclipse.swt.dnd.DragSource.drag(Lorg/eclipse/swt/widgets/Event;)V+469
j  org.eclipse.swt.dnd.DragSource.lambda$new$0(Lorg/eclipse/swt/widgets/Event;)V+38
j  org.eclipse.swt.dnd.DragSource$$Lambda$149.handleEvent(Lorg/eclipse/swt/widgets/Event;)V+5
J 13107 C2 org.eclipse.swt.widgets.EventTable.sendEvent(Lorg/eclipse/swt/widgets/Event;)V (584 bytes) @ 0x000000eb1db5822c [0x000000eb1db580e0+0x14c]
J 29505 C2 org.eclipse.swt.widgets.Display.readAndDispatch()Z (96 bytes) @ 0x000000eb2085a520 [0x000000eb20859f20+0x600]
Comment 1 Thomas Butz CLA 2020-06-17 07:09:43 EDT
The regression seems to be introduced by 4.13
Comment 2 Lakshmi P Shanmugam CLA 2020-06-17 07:55:52 EDT
Can you please provide any steps/snippet to reproduce to the problem?
Comment 3 Thomas Butz CLA 2020-06-17 09:02:28 EDT
I'm able to trigger the bug in our application by using frequent drag&drop operations. But i fear that i'm not able to break it down to a simple and reproducible test case as our application is rather complex.

Any tips how to gather more information?
Comment 4 Paul Pazderski CLA 2020-06-27 12:01:49 EDT
I don't often deal with crash dumps so I might miss something but if I read it correctly you are starting another drag operation while the first is still active.
The full stacktrace contains two
j  org.eclipse.swt.internal.ole.win32.COM.DoDragDrop(JJI[I)I+0
j  org.eclipse.swt.dnd.DragSource.drag(Lorg/eclipse/swt/widgets/Event;)V+469
entries.
I'm not yet sure how this is even possible. However, from what I can tell DragSource was never really meant to be re-entrant and especially not after bug 549643.

On your side you might be able to prevent those nested drag&drop operation.

On SWT side we might be able to make drag() re-entrant safe or prevent a nested drag by deferring any dragDetect event while a drag is active.