jvm crash when compress

[eddiezhou1]

java: target/snappy-1.1.1/snappy.cc:423: char* snappy::internal::CompressFragment(const char*, size_t, char*, snappy::uint16*, int): Assertion `0 == memcmp(base, candidate, matched)' failed.
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007fcfb60c7529, pid=1, tid=0x00007fcf713c2700
#
# JRE version: OpenJDK Runtime Environment (8.0_222-b10) (build 1.8.0_222-b10)
# Java VM: OpenJDK 64-Bit Server VM (25.222-b10 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C  [libc.so.6+0x34529]  abort+0x269
#
# Core dump written. Default location: /home/docker/core or core.1
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

---------------  T H R E A D  ---------------

Current thread (0x00007fcf9c04e800):  JavaThread "task-exec-thread-19" [_thread_in_native, id=108, stack(0x00007fcf712c2000,0x00007fcf713c3000)]

siginfo: si_signo: 11 (SIGSEGV), si_code: 128 (SI_KERNEL), si_addr: 0x0000000000000000

Registers:
RAX=0x0000000000000006, RBX=0x00007fcfb6a8d000, RCX=0xffffffffffffffff, RDX=0x0000000000000000
RSP=0x00007fcf713c08d0, RBP=0x00007fcf72d06b97, RSI=0x00007fcf713c07c0, RDI=0x0000000000000002
R8 =0x0000000000000000, R9 =0x00007fcf713c07c0, R10=0x0000000000000008, R11=0x0000000000000246
R12=0x0000000000000180, R13=0x00007fcf72d072a0, R14=0x00000000833f9398, R15=0x00000000833f3444
RIP=0x00007fcfb60c7529, EFLAGS=0x0000000000010246, CSGSFS=0x0000000000000033, ERR=0x0000000000000000
  TRAPNO=0x000000000000000d

Top of Stack: (sp=0x00007fcf713c08d0)
0x00007fcf713c08d0:   0000000000000020 0000000000000000
0x00007fcf713c08e0:   0000000000000000 0000000000000000
0x00007fcf713c08f0:   0000000000000000 0000000000000000
0x00007fcf713c0900:   0000000000000000 0000000000000000
0x00007fcf713c0910:   0000000000000000 0000000000000000
0x00007fcf713c0920:   0000000000000000 0000000000000000
0x00007fcf713c0930:   0000000000000000 0000000000000000
0x00007fcf713c0940:   0000000000000000 0000000000000000
0x00007fcf713c0950:   0000000000000000 ffffffffffffffff
0x00007fcf713c0960:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c0970:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c0980:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c0990:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c09a0:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c09b0:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c09c0:   ffffffffffffffff ffffffffffffffff
0x00007fcf713c09d0:   ffffffffffffffff 0000000000000000
0x00007fcf713c09e0:   0000000000000000 00000000833f9398
0x00007fcf713c09f0:   00000000833f3444 00007fcfb60bee67
0x00007fcf713c0a00:   00000077000000a5 00007fcf72d06a54
0x00007fcf713c0a10:   0000018000000000 00007fcf72d072a0
0x00007fcf713c0a20:   0000100000000180 00007fcfb15a7190
0x00007fcf713c0a30:   00000000833f9398 00007fcf72d06b97
0x00007fcf713c0a40:   00007fcf72d06a54 00007fcfb60bef12
0x00007fcf713c0a50:   00007fcf713c1318 00007fcfb0c792b0
0x00007fcf713c0a60:   00000000833f3444 00000000833f189b
0x00007fcf713c0a70:   00000000833f13a0 00007fcf72cec3ba
0x00007fcf713c0a80:   13a07fcf713c1380 00007fcfb0c792b0
0x00007fcf713c0a90:   00000000833f93a0 00000000833f9391
0x00007fcf713c0aa0:   00000012c1889218 00000000833e79f7
0x00007fcf713c0ab0:   00007fcfb0c792b0 0000000000008000
0x00007fcf713c0ac0:   00007fcf713c1380 00000000833f13a0

Instructions: (pc=0x00007fcfb60c7529)
0x00007fcfb60c7509:   00 00 c7 05 cb 66 36 00 06 00 00 00 e8 16 ea ff
0x00007fcfb60c7519:   ff 8b 05 c0 66 36 00 83 f8 06 0f 85 39 fe ff ff
0x00007fcfb60c7529:   f4 bf 7f 00 00 00 c7 05 a7 66 36 00 08 00 00 00
0x00007fcfb60c7539:   e8 a2 40 08 00 66 90 41 57 41 56 41 55 41 54 55

Register to memory mapping:

RAX=0x0000000000000006 is an unknown value
RBX=0x00007fcfb6a8d000 is an unknown value
RCX=0xffffffffffffffff is an unknown value
RDX=0x0000000000000000 is an unknown value
RSP=0x00007fcf713c08d0 is pointing into the stack for thread: 0x00007fcf9c04e800
RBP=0x00007fcf72d06b97: <offset 0x2eb97> in /tmp/snappy-unknown-f8e101fe-18e5-435e-a5f4-deb9251e4a34-libsnappyjava.so at 0x00007fcf72cd8000
RSI=0x00007fcf713c07c0 is pointing into the stack for thread: 0x00007fcf9c04e800
RDI=0x0000000000000002 is an unknown value
R8 =0x0000000000000000 is an unknown value
R9 =0x00007fcf713c07c0 is pointing into the stack for thread: 0x00007fcf9c04e800
R10=0x0000000000000008 is an unknown value
R11=0x0000000000000246 is an unknown value
R12=0x0000000000000180 is an unknown value
R13=0x00007fcf72d072a0: <offset 0x2f2a0> in /tmp/snappy-unknown-f8e101fe-18e5-435e-a5f4-deb9251e4a34-libsnappyjava.so at 0x00007fcf72cd8000
R14=0x00000000833f9398 is pointing into object: 0x00000000833f1390
[B
 - klass: {type array byte}
 - length: 32768
R15=0x00000000833f3444 is pointing into object: 0x00000000833f1390
[B
 - klass: {type array byte}
 - length: 32768


Stack: [0x00007fcf712c2000,0x00007fcf713c3000],  sp=0x00007fcf713c08d0,  free space=1018k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libc.so.6+0x34529]  abort+0x269

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
J 14242  org.xerial.snappy.SnappyNative.rawCompress(Ljava/lang/Object;IILjava/lang/Object;I)I (0 bytes) @ 0x00007fcfa2f00c67 [0x00007fcfa2f00c00+0x67]
J 18356 C2 org.xerial.snappy.SnappyOutputStream.compressInput()V (76 bytes) @ 0x00007fcfa15566c4 [0x00007fcfa15564c0+0x204]
J 20717 C2 com.xxx.xxx.xxx.xxx.util.SnappyCompressUtil.compressData([B)[B (301 bytes) @ 0x00007fcfa2df0f04 [0x00007fcfa2df04a0+0xa64]
J 21499 C2 com.xxx.xxx.xxx.xxx.component.TaskLogManager.saveLog(Ljava/lang/Long;)V (61 bytes) @ 0x00007fcfa2cb51a8 [0x00007fcfa2cb4ea0+0x308]
J 21163 C2 com.xxx.xxx.xxx.xxx.component.HttpTaskHandle$HttpTaskJob.run()V (761 bytes) @ 0x00007fcfa40fe4ec [0x00007fcfa40fcfe0+0x150c]
J 13768 C2 java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run()V (59 bytes) @ 0x00007fcfa2640a1c [0x00007fcfa26408c0+0x15c]
J 19994% C2 java.util.concurrent.ThreadPoolExecutor.runWorker(Ljava/util/concurrent/ThreadPoolExecutor$Worker;)V (225 bytes) @ 0x00007fcfa1776da4 [0x00007fcfa1776c00+0x1a4]
j  java.util.concurrent.ThreadPoolExecutor$Worker.run()V+5
j  java.lang.Thread.run()V+11
v  ~StubRoutines::call_stub


………………


VM Arguments:
jvm_args: -Denv=daily -Xms2048M -Xmx2048M -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MetaspaceSize=64m -verbose:gc -XX:+HeapDumpOnOutOfMemoryError -XX:+PrintGC -XX:+PrintGCDetails -XX:+PrintGCDateStamps -Xloggc:/home/docker/logs/gc.log
java_command: /home/docker/start.jar
java_class_path (initial): /home/docker/start.jar
Launcher Type: SUN_STANDARD

Environment Variables:
JAVA_HOME=/usr/local/openjdk-8
PATH=/usr/local/openjdk-8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Signal Handlers:
SIGSEGV: [libjvm.so+0xa4c9c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGBUS: [libjvm.so+0xa4c9c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGFPE: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGPIPE: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGXFSZ: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGILL: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGUSR1: SIG_DFL, sa_mask[0]=00000000000000000000000000000000, sa_flags=none
SIGUSR2: [libjvm.so+0x8b6990], sa_mask[0]=00000000000000000000000000000000, sa_flags=SA_RESTART|SA_SIGINFO
SIGHUP: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGINT: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGTERM: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGQUIT: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO


---------------  S Y S T E M  ---------------

OS:PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
VERSION_CODENAME=stretch
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

uname:Linux 3.10.0-957.21.3.el7.x86_64 #1 SMP Tue Jun 18 16:35:19 UTC 2019 x86_64
libc:glibc 2.24 NPTL 2.24
rlimit: STACK 8192k, CORE infinity, NPROC infinity, NOFILE 1048576, AS infinity
load average:0.02 0.07 0.20

/proc/meminfo:
MemTotal:        3880560 kB
MemFree:          166172 kB
MemAvailable:     553540 kB
Buffers:            7888 kB
Cached:           758776 kB
SwapCached:            0 kB
Active:          3218508 kB
Inactive:         370996 kB
Active(anon):    2915516 kB
Inactive(anon):   101716 kB
Active(file):     302992 kB
Inactive(file):   269280 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:              2212 kB
Writeback:             0 kB
AnonPages:       2822908 kB
Mapped:            47108 kB
Shmem:            194340 kB
Slab:              59472 kB
SReclaimable:      39540 kB
SUnreclaim:        19932 kB
KernelStack:        6368 kB
PageTables:        11064 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:     1940280 kB
Committed_AS:    4867628 kB
VmallocTotal:   34359738367 kB
VmallocUsed:       14348 kB
VmallocChunk:   34359715252 kB
HardwareCorrupted:     0 kB
AnonHugePages:    421888 kB
CmaTotal:              0 kB
CmaFree:               0 kB
HugePages_Total:       0
HugePages_Free:        0
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB
DirectMap4k:       69496 kB
DirectMap2M:     4124672 kB
DirectMap1G:     2097152 kB

container (cgroup) information:
container_type: cgroupv1
cpu_cpuset_cpus: 0
cpu_memory_nodes: 0
active_processor_count: 1
cpu_quota: -1
cpu_period: 100000
cpu_shares: -1
memory_limit_in_bytes: -1
memory_and_swap_limit_in_bytes: -1
memory_soft_limit_in_bytes: -1
memory_usage_in_bytes: 2675822592
memory_max_usage_in_bytes: 2698739712


CPU:total 1 (initial active 1) (1 cores per cpu, 1 threads per core) family 6 model 85 stepping 5, cmov, cx8, fxsr, mmx, sse, sse2, sse3, ssse3, sse4.1, sse4.2, popcnt, avx, avx2, aes, clmul, erms, rtm, 3dnowpref, lzcnt, tsc, bmi1, bmi2, adx

/proc/cpuinfo:
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 85
model name	: Intel(R) Xeon(R) Platinum 8255C CPU @ 2.50GHz
stepping	: 5
microcode	: 0x1
cpu MHz		: 2499.990
cache size	: 36608 KB
physical id	: 0
siblings	: 1
core id		: 0
cpu cores	: 1
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl eagerfpu pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch fsgsbase bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx avx512f avx512dq rdseed adx smap clflushopt clwb avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 arat avx512_vnni
bogomips	: 4999.98
clflush size	: 64
cache_alignment	: 64
address sizes	: 46 bits physical, 48 bits virtual
power management:



Memory: 4k page, physical 3880560k(166048k free), swap 0k(0k free)

vm_info: OpenJDK 64-Bit Server VM (25.222-b10) for linux-amd64 JRE (1.8.0_222-b10), built on Jul 11 2019 10:18:43 by "openjdk" with gcc 4.4.7 20120313 (Red Hat 4.4.7-23)

time: Thu Nov 25 15:52:33 2021
timezone: CST
elapsed time: 532897 seconds (6d 4h 1m 37s)

<snappy.version>1.1.1.7</snappy.version>

[garyelephant]

@eddie-zhou-yi Hi，I also encounterd this problem when using this api:

public static int compress(byte[] input, int inputOffset, int inputLength, byte[] output, int outputOffset)
            throws IOException

but, strangely, when I use the follow api, it does not core dump:

public static byte[] compress(byte[] input)
            throws IOException

So, I suspect that the implementation of the first api in snappy-java java code has a serious bug. @xerial can you take a look at this ?

[xerial]

@garyelephant, I cannot undertake such an investigation work for free as my time is limited. Can you provide a reproduction and propose a fix?