jvm crash in libjpeg.so.8 caused by ImageIO.read

[Fergus Nelson]

Description: Ubuntu 12.04.2 LTS
Release: 12.04

java version "1.6.0_27"
OpenJDK Runtime Environment (IcedTea6 1.12.5) (6b27-1.12.5-0ubuntu0.12.04.1)
OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)

Running TestSuite
Configuring TestNG with: TestNG652Configurator
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007f8dc963d5e4, pid=16643, tid=140247736899328
#
# JRE version: 7.0_21-b02
# Java VM: OpenJDK 64-Bit Server VM (23.7-b01 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C [libjpeg.so.8+0x1e5e4] jpeg_save_markers+0x84
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /crypt/var/lib/jenkins/jobs/DS trunk build/workspace/collation/collation-core/hs_err_pid16643.log
#
# If you would like to submit a bug report, please include
# instructions on how to reproduce the bug and visit:
# https://bugs.launchpad.net/ubuntu/+source/openjdk-7/
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#
Aborted (core dumped)

RAX=0x0000000000000002 is an unknown value
RBX=0x00007f8df0929b40 is an unknown value
RCX=0x0000000000000000 is an unknown value
RDX=0x000000000000ffff is an unknown value
RSP=0x00007f8df889a718 is pointing into the stack for thread: 0x00007f8df0009000
RBP=0x00007f8df889a820 is pointing into the stack for thread: 0x00007f8df0009000
RSI=0x00000000000000e2 is an unknown value
RDI=0x00007f8df09298a0 is an unknown value
R8 =0x00007f8dc963d020: <offset 0x1e020> in /usr/lib/x86_64-linux-gnu/libjpeg.so.8 at 0x00007f8dc961f000
R9 =0x0000000000000003 is an unknown value
R10=0x00007f8df889a4b0 is pointing into the stack for thread: 0x00007f8df0009000
R11=0x00007f8dc963d560: jpeg_save_markers+0 in /usr/lib/x86_64-linux-gnu/libjpeg.so.8 at 0x00007f8dc961f000
R12=0x0000000000000000 is an unknown value
R13=0x00000000f6517210 is an oop
{method}
 - klass: {other class}
R14=0x00007f8df889a898 is pointing into the stack for thread: 0x00007f8df0009000
R15=0x00007f8df0009000 is a thread

Stack: [0x00007f8df879d000,0x00007f8df889e000], sp=0x00007f8df889a718, free space=1013k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libjpeg.so.8+0x1e5e4] jpeg_save_markers+0x84
j com.sun.imageio.plugins.jpeg.JPEGImageReader.initJPEGImageReader()J+0
j com.sun.imageio.plugins.jpeg.JPEGImageReader.<init>(Ljavax/imageio/spi/ImageReaderSpi;)V+185
j com.sun.imageio.plugins.jpeg.JPEGImageReaderSpi.createReaderInstance(Ljava/lang/Object;)Ljavax/imageio/ImageReader;+5
j javax.imageio.spi.ImageReaderSpi.createReaderInstance()Ljavax/imageio/ImageReader;+2
j javax.imageio.ImageIO$ImageReaderIterator.next()Ljavax/imageio/ImageReader;+16
j javax.imageio.ImageIO$ImageReaderIterator.next()Ljava/lang/Object;+1
j javax.imageio.ImageIO.read(Ljavax/imageio/stream/ImageInputStream;)Ljava/awt/image/BufferedImage;+31
j javax.imageio.ImageIO.read(Ljava/io/InputStream;)Ljava/awt/image/BufferedImage;+20

[Fergus Nelson (fergus-8)]

Bump. Does anyone have any update on this?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Adam Dingle (adam-yorba)]

I'm seeing a similar crash running a Scala program with Java on Ubuntu 14.04:

java version "1.7.0_25"
OpenJDK Runtime Environment (IcedTea 2.3.12) (7u25-2.3.12-4ubuntu3)
OpenJDK 64-Bit Server VM (build 23.7-b01, mixed mode)

Fergus, what steps exactly did you take to trigger this bug? Can you still reproduce it?

[Fergus Nelson (fergus-8)]

Something like this. Yes I can still reproduce, but have moved to pngs to get past it.

URL objUrl = this.getClass().getClassLoader().getResource("images/image1.jpg");
byte[] objBytes = Files.readAllBytes(Paths.get(objUrl.toURI()));
try (ByteArrayInputStream bais = new ByteArrayInputStream(imageData)) {
            BufferedImage image = ImageIO.read(bais); //>> this is where the error occurs.
            return image;
        } catch (IOException e) {
            LOG.error(null, "Failed to create buffered image", e);
            throw new RuntimeException(e);
        }

[Adam Dingle (adam-yorba)]

Unfortunately I can't reproduce this crash at will - it happens only occasionally when running a large Scala program. I attempted to reproduce this using the following test program (in Scala), but it runs fine:

===
import java.io.File
import javax.imageio.ImageIO

object Hello extends App {
    val file = new File("/home/adam/Desktop/Ginger_Ibex_1382.jpeg")
    for (i <- 1 to 20000) {
        val image = ImageIO.read(file)
    }
    println("success")
}
===

Fergus, if you can provide a program that actually repeats the crash I'd be happy to investigate more deeply.

[Adam Dingle (adam-yorba)]

Also, I expanded the Java code snippet you posted into a full program:

===
import java.awt.image.BufferedImage;
import java.io.*;
import java.net.*;
import java.nio.file.*;
import javax.imageio.ImageIO;

public class Hello {
    void read() {
        URL objUrl = this.getClass().getClassLoader().getResource("image1.jpg");
        try {
            byte[] objBytes = Files.readAllBytes(Paths.get(objUrl.toURI()));
            ByteArrayInputStream bais = new ByteArrayInputStream(objBytes);
            BufferedImage image = ImageIO.read(bais); //>> this is where the error occurs.
            System.out.println("success");
        } catch (Exception e) {
            System.out.println("Failed to create buffered image");
        }
    }

    public static void main(String[] args) {
        new Hello().read();
    }
}
===

When I run this it prints "success", so this isn't reproducing the crash for me either.