alibaba / alibaba/fastjson2

[BUG] 2.0.63 fatal error

Open
#7,760 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
4.4k
Forks
613
Avg merge
1d 22h
Merged PRs (30d)
6

Description

### 问题描述
```
SIGSEGV (0xb) at pc=0x0000ffffc0009bae4, pid=1404273
Java VM: OpenJDK 64-Bit Server VM (25.242-b08 mixed mode linux-aarch64 compressed oops)
Problematic frame:
j com.alibaba.fastjson2.writer.FieldWriterString.write(Lcom/alibaba/fastjson2/JSONWriter;Ljava/lang/Object;)+15
```
### 环境信息
- OS信息: linux-aarch64 compressed oop 8GB
- JDK信息: Openjdk 8.0_242-b08
- 版本信息:Fastjson2 2.0.63

### 重现步骤

崩溃路径就三行 fastjson2 API:

```java
ObjectWriter objectWriter = (ObjectWriter)
JSONFactory.getDefaultObjectWriterProvider().getObjectWriter(Bean.class);
FieldWriter fieldWriter = objectWriter.getFieldWriters().get(0);
fieldWriter.write(JSONWriter.of(), new Alien()); // <-- SIGSEGV

public static class Bean {
public String name = "hello-fastjson2";
}

public static class Alien {
public int slot0 = 0x7FFFFFFF;
public int slot1 = 0x7FFFFFFF;
}
```

`FieldWriter.write` 的第二个入参声明成 `Object`,内部经 `PropertyAccessor` 直接用 Unsafe
按偏移读取,没有任何类型校验。`Alien` 在 `Bean.name` 的偏移(12)上放的是 `0x7FFFFFFF`,
被当成压缩指针解码后是 `0x400000000` —— 未映射地址。

### 期待的正确结果
可以抛出异常,不要jvm崩溃

### 相关日志输出
```
# A fatal error has been detected by the Java Runtime Environment:

SIGSEGV (0xb) at pc=0x0000ffffc0009bae4, pid=1404273, tid=0x0000ffffbb57ffe0

JRE version: OpenJDK Runtime Environment (8.0_242-b08)
Java VM: OpenJDK 64-Bit Server VM (25.242-b08 mixed mode linux-aarch64 compressed oops)

Problematic frame:
j com.alibaba.fastjson2.writer.FieldWriterString.write(Lcom/alibaba/fastjson2/JSONWriter;Ljava/lang/Object;)V+15

Core dump written. Default location:
/home/report/gateway/core or core.1404273

An error report file with more information is saved as:
/home/report/gateway/hs_err_pid1404273.log

If you would like to submit a bug report, please visit:
http://bugreport.java.com/bugreport/crash.jsp
```

#### 附加信息
我创建了一个maven + docker的工程可以一键复现bug
仓库地址:https://github.com/ren1151576/fastjson2-sigsegv

类似issue:https://github.com/alibaba/fastjson2/issues/2456

Contributor guide

Open the contributing guide

Research direction

Start with FieldWriterString.write and trace the PropertyAccessor path described in the report, then run the Maven/Docker reproducer at ren1151576/fastjson2-sigsegv on the stated Java 8 linux-aarch64 environment. Compare the behavior with issue 2456. Done means the mismatched Bean and Alien objects produce an exception rather than a JVM SIGSEGV.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.