Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext #1074

Closed
benzap opened this issue Mar 16, 2019 · 19 comments
Assignees

Comments

@benzap
Copy link

benzap commented Mar 16, 2019

Using RC13, I wonder if it's related to #712

Full command from https://github.com/benzap/eden

build-native.sh, Line 28

native-image -jar target/eden-$EDEN_VERSION-standalone.jar \
	     --no-server \
             -H:Name="eden-${EDEN_VERSION}" \
             -H:+ReportUnsupportedElementsAtRuntime \
	     --enable-url-protocols=http,https \
	     --enable-http \
	     --enable-https \
	     --enable-all-security-services \
	     --rerun-class-initialization-at-runtime=javax.net.ssl.SSLContext \
	     -H:+ReportExceptionStackTraces \
             -H:ReflectionConfigurationFiles=ReflectionConfig.json

This was definitely compiling when I was first messing around with it, so it's unclear why it suddenly decided to stop working. I'm wondering if the error output is a misdirection?

Here is the error output:

...
...
Building Native Image...
[eden-0.9.0:2955]    classlist:   7,702.61 ms
[eden-0.9.0:2955]        (cap):   1,454.41 ms
[eden-0.9.0:2955]        setup:   2,933.77 ms
[eden-0.9.0:2955]     analysis:  93,569.77 ms
Error: unsupported features in 2 methods
Detailed message:
Error: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext
Trace: 
	at parsing org.httpkit.client.HttpClient.exec(HttpClient.java:347)
Call path from entry point to org.httpkit.client.HttpClient.exec(String, RequestConfig, SSLEngine, IRespListener): 
	at org.httpkit.client.HttpClient.exec(HttpClient.java:269)
	at org.httpkit.client$request.invokeStatic(client.clj:243)
	at org.httpkit.client$request.doInvoke(client.clj:140)
	at clojure.lang.RestFn.applyTo(RestFn.java:139)
	at eden.commandline.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:152)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext
Trace: 
	at parsing org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
Call path from entry point to org.httpkit.client.SslContextFactory.trustAnybody(): 
	at org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
	at org.httpkit.client$coerce_req.invokeStatic(client.clj:68)
	at org.httpkit.client$coerce_req.invoke(client.clj:59)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at eden.std.function.EdenFunction.applyTo(function.cljc:81)
	at eden.commandline.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:152)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

com.oracle.svm.core.util.UserError$UserException: unsupported features in 2 methods
Detailed message:
Error: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext
Trace: 
	at parsing org.httpkit.client.HttpClient.exec(HttpClient.java:347)
Call path from entry point to org.httpkit.client.HttpClient.exec(String, RequestConfig, SSLEngine, IRespListener): 
	at org.httpkit.client.HttpClient.exec(HttpClient.java:269)
	at org.httpkit.client$request.invokeStatic(client.clj:243)
	at org.httpkit.client$request.doInvoke(client.clj:140)
	at clojure.lang.RestFn.applyTo(RestFn.java:139)
	at eden.commandline.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:152)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext
Trace: 
	at parsing org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
Call path from entry point to org.httpkit.client.SslContextFactory.trustAnybody(): 
	at org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
	at org.httpkit.client$coerce_req.invokeStatic(client.clj:68)
	at org.httpkit.client$coerce_req.invoke(client.clj:59)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at eden.std.function.EdenFunction.applyTo(function.cljc:81)
	at eden.commandline.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:152)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

	at com.oracle.svm.core.util.UserError.abort(UserError.java:67)
	at com.oracle.svm.hosted.NativeImageGenerator.runPointsToAnalysis(NativeImageGenerator.java:709)
	at com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:499)
	at com.oracle.svm.hosted.NativeImageGenerator.lambda$run$0(NativeImageGenerator.java:417)
	at java.util.concurrent.ForkJoinTask$AdaptedRunnableAction.exec(ForkJoinTask.java:1386)
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)
Error: Image building with exit status 1
...
...

If you would like to reproduce, it will require installing leiningen, and setting GRAAL_HOME to the graalvm folder

GRAAL_HOME=/path/to/graal sh build-native.sh

Thank you for your time,

Ben

@benzap
Copy link
Author

benzap commented Mar 16, 2019

Compilation is successful if I remove http-server libraries which is making use of java.net.*, through the use of the http-kit library. This was working in previous releases without issues, so it isn't clear what has changed.

@cstancu cstancu self-assigned this Mar 18, 2019
@lvh
Copy link

lvh commented May 12, 2019

FWIW, I can reproduce this using 19.0.0. I'm using this with Clojure, so I already have --initialize-at-build-time on by default (since otherwise Clojure itself won't work).

@vjovanov
Copy link
Member

The problem comes from --rerun-class-initialization-at-runtime=javax.net.ssl.SSLContext. This requires that there are no instances of this class in the image heap and the instances somehow end up in the image heap.

We should trace where this happens and fix support for javax.net.ssl.SSLContext. Also, --rerun-class-initialization-at-runtime=javax.net.ssl.SSLContext should not be done in the user space, it should be done in native image.

@lvh
Copy link

lvh commented May 13, 2019

Yep, it's definitely true that there are image heap instances of SSLContext. For example, clj-http (which wraps the Apache HTTP client) has org.apache.http.nio.conn.ssl.SSLIOSessionStrategy, which shows up in the Trace for the "No instances are allowed..." error. Same with java.security.SecureRandom, which appears to be pulled in via SSLContext anyway (specifically via sun.security.ssl.SSLContextImpl$TLSContext, details in paste below).

One confusing tidbit is that the suggested remediation from the error is --initialize-at-build-time=sun.security.provider.NativePRNG, but I'm already passing --initialize-at-build-time which appears to get translated to -H:ClassInitialization=:build_time. I have also passed -H:+PrintClassInitialization, but I'm not seeing any class initialization printed (maybe the failure is too early).

Does "fix support for j.n.s.SSLContext" here mean changing something about GraalVM? Is there any amount of minimal reproducer I can help make that would be helpful to you? Just in case, I created https://github.com/lvh/cljurl-graalvm-demo, created an uberjar with lein uberjar, and ran native-image producing the following error:

./native-image.sh -jar target/uberjar/cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone.jar                                                                                                                                                                                                                                  git:master*
Build on Server(pid: 60494, port: 37535)
SendBuildRequest [
-task=com.oracle.svm.hosted.NativeImageGeneratorRunner
-imagecp
/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/svm.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/objectfile.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/pointsto.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/svm-llvm.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/graal-llvm.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/llvm-wrapper.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/javacpp.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/llvm-platform-specific.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/graal.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/graal-management.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/jvmci-hotspot.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/jvmci-api.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/boot/graal-sdk.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/boot/graaljs-scriptengine.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/library-support.jar:/home/lvh/src/cljurl-graalvm-demo/target/uberjar/cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone.jar
-H:Path=/home/lvh/src/cljurl-graalvm-demo
-H:FallbackThreshold=0
-H:+ReportExceptionStackTraces
-H:+PrintClassInitialization
-H:+ReportUnsupportedElementsAtRuntime
-H:ClassInitialization=:build_time
-H:EnableURLProtocols=https
-H:Class=cljurl_graalvm_demo.core
-H:Name=cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone
-H:CLibraryPath=/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/clibraries/linux-amd64
]
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:60494]    classlist:   2,717.02 ms
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:60494]        (cap):     644.82 ms
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:60494]        setup:     922.15 ms
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:60494]     analysis:  17,043.48 ms
Error: Unsupported features in 2 methods
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext. Try marking this class for build-time initialization with --initialize-at-build-time=javax.net.ssl.SSLContext
Trace: 	object org.apache.http.nio.conn.ssl.SSLIOSessionStrategy
	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$input_coercion_request.invokeStatic(Object)
Call path from entry point to clj_http.client$input_coercion_request.invokeStatic(Object): 
	at clj_http.client$input_coercion_request.invokeStatic(client.clj:593)
	at clj_http.client$input_coercion_request.invoke(client.clj:593)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Keyword.applyTo(Keyword.java:254)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG. Try marking this class for build-time initialization with --initialize-at-build-time=sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	object sun.security.ssl.SSLContextImpl$TLSContext
	object sun.security.ssl.SSLSocketFactoryImpl
	object org.apache.http.conn.ssl.SSLConnectionSocketFactory
	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$input_coercion_request.invokeStatic(Object)
Call path from entry point to clj_http.client$input_coercion_request.invokeStatic(Object): 
	at clj_http.client$input_coercion_request.invokeStatic(client.clj:593)
	at clj_http.client$input_coercion_request.invoke(client.clj:593)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Keyword.applyTo(Keyword.java:254)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

com.oracle.svm.core.util.UserError$UserException: Unsupported features in 2 methods
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext. Try marking this class for build-time initialization with --initialize-at-build-time=javax.net.ssl.SSLContext
Trace: 	object org.apache.http.nio.conn.ssl.SSLIOSessionStrategy
	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$input_coercion_request.invokeStatic(Object)
Call path from entry point to clj_http.client$input_coercion_request.invokeStatic(Object): 
	at clj_http.client$input_coercion_request.invokeStatic(client.clj:593)
	at clj_http.client$input_coercion_request.invoke(client.clj:593)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Keyword.applyTo(Keyword.java:254)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG. Try marking this class for build-time initialization with --initialize-at-build-time=sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	object sun.security.ssl.SSLContextImpl$TLSContext
	object sun.security.ssl.SSLSocketFactoryImpl
	object org.apache.http.conn.ssl.SSLConnectionSocketFactory
	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$input_coercion_request.invokeStatic(Object)
Call path from entry point to clj_http.client$input_coercion_request.invokeStatic(Object): 
	at clj_http.client$input_coercion_request.invokeStatic(client.clj:593)
	at clj_http.client$input_coercion_request.invoke(client.clj:593)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Keyword.applyTo(Keyword.java:254)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

	at com.oracle.svm.core.util.UserError.abort(UserError.java:75)
	at com.oracle.svm.hosted.FallbackFeature.reportAsFallback(FallbackFeature.java:218)
	at com.oracle.svm.hosted.NativeImageGenerator.runPointsToAnalysis(NativeImageGenerator.java:733)
	at com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:523)
	at com.oracle.svm.hosted.NativeImageGenerator.lambda$run$0(NativeImageGenerator.java:441)
	at java.util.concurrent.ForkJoinTask$AdaptedRunnableAction.exec(ForkJoinTask.java:1386)
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)
Caused by: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: Unsupported features in 2 methods
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: javax.net.ssl.SSLContext. Try marking this class for build-time initialization with --initialize-at-build-time=javax.net.ssl.SSLContext
Trace: 	object org.apache.http.nio.conn.ssl.SSLIOSessionStrategy
	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$input_coercion_request.invokeStatic(Object)
Call path from entry point to clj_http.client$input_coercion_request.invokeStatic(Object): 
	at clj_http.client$input_coercion_request.invokeStatic(client.clj:593)
	at clj_http.client$input_coercion_request.invoke(client.clj:593)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Keyword.applyTo(Keyword.java:254)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG. Try marking this class for build-time initialization with --initialize-at-build-time=sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	object sun.security.ssl.SSLContextImpl$TLSContext
	object sun.security.ssl.SSLSocketFactoryImpl
	object org.apache.http.conn.ssl.SSLConnectionSocketFactory
	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$input_coercion_request.invokeStatic(Object)
Call path from entry point to clj_http.client$input_coercion_request.invokeStatic(Object): 
	at clj_http.client$input_coercion_request.invokeStatic(client.clj:593)
	at clj_http.client$input_coercion_request.invoke(client.clj:593)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Keyword.applyTo(Keyword.java:254)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

	at com.oracle.graal.pointsto.constraints.UnsupportedFeatures.report(UnsupportedFeatures.java:133)
	at com.oracle.graal.pointsto.BigBang.finish(BigBang.java:564)
	at com.oracle.svm.hosted.NativeImageGenerator.runPointsToAnalysis(NativeImageGenerator.java:684)
	... 7 more
Error: Image build request failed with exit status 1

@vjovanov
Copy link
Member

Hmm, we need to see how this instance ended up in the heap.

The problem comes from: --rerun-class-initialization-at-runtime=javax.net.ssl.SSLContext which prevents instances of classes being in the heap.

First, --rerun-class-initialization-at-runtime is now not in the API anymore because it is complex to get right. It is also added by the native image so there is no need for that flag.

Now we need to find which initializer added this class to the heap and we need to delay it to runtime: --initialize-at-run-time=<name-of-the-class>.

Do you have an idea where this class could of been added? Can you attach a debugger to clojure to see where is this instance created? If yes, all we need is a breakpoint in org.apache.http.nio.conn.ssl.SSLIOSessionStrategy.<init> and to pass --debug-attach to the native image.

The error message is actually correct as the policy for the given class is RERUN and not BUILD_TIME.

@lvh
Copy link

lvh commented May 13, 2019

@vjovanov Sorry, I may be adding to the confusion here. I'm speaking about my reproducer, which has --initialize-at-build-time and no --rerun-class-initialization-at-runtime flags, and still produces that output. You can see the native-image.sh I'm using here: https://github.com/lvh/cljurl-graalvm-demo/blob/master/native-image.sh but for your convenience here's the contents:

NI="${GRAALVM_HOME}/bin/native-image"
"${NI}" --verbose \
        --no-fallback \
        -Dclojure.compiler.direct-linking=true \
        -H:+ReportExceptionStackTraces \
        -H:+PrintClassInitialization \
        --report-unsupported-elements-at-runtime \
        --initialize-at-build-time \
        --enable-https \
        $@

I can try to figure out if the instance is created, but is there a way for me to confirm that the given class is actually RERUB and not BUILD_TIME?

@vjovanov
Copy link
Member

It is most likely ‘RERUN’ as it is set so in ‘native-image’. There is a flag ‘-H:+PrintClassInitialization’ that will give you all the details and reasons. You can also look at the new documentation that explains it:

https://github.com/oracle/graal/blob/master/substratevm/CLASS-INITIALIZATION.md

@lvh
Copy link

lvh commented May 13, 2019

Yep; I read that doc and I'm running with -H:+PrintClassInitialization for the output I pasted but I'm not seeing anything in the output about attempting to initialize any classes. Am I missing something?

I tried picking some classes that look promising from the traces:

        --initialize-at-run-time=org.apache.http.nio.conn.ssl.SSLIOSessionStrategy \
        --initialize-at-run-time=org.apache.http.conn.ssl.SSLConnectionSocketFactory \

... but now I just get the same errors at different

./native-image.sh -jar target/uberjar/cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone.jar                                                                                                                                                                                                                                  git:master*
Build on Server(pid: 81294, port: 42667)
SendBuildRequest [
-task=com.oracle.svm.hosted.NativeImageGeneratorRunner
-imagecp
/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/svm.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/objectfile.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/pointsto.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/svm-llvm.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/graal-llvm.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/llvm-wrapper.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/javacpp.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/builder/llvm-platform-specific.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/graal.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/graal-management.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/jvmci-hotspot.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/jvmci/jvmci-api.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/boot/graal-sdk.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/boot/graaljs-scriptengine.jar:/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/library-support.jar:/home/lvh/src/cljurl-graalvm-demo/target/uberjar/cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone.jar
-H:Path=/home/lvh/src/cljurl-graalvm-demo
-H:FallbackThreshold=0
-H:+ReportExceptionStackTraces
-H:+PrintClassInitialization
-H:+ReportUnsupportedElementsAtRuntime
-H:ClassInitialization=:build_time
-H:ClassInitialization=org.apache.http.nio.conn.ssl.SSLIOSessionStrategy:run_time
-H:ClassInitialization=org.apache.http.conn.ssl.SSLConnectionSocketFactory:run_time
-H:EnableURLProtocols=https
-H:Class=cljurl_graalvm_demo.core
-H:Name=cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone
-H:CLibraryPath=/home/lvh/.local/graalvm-ce-19.0.0/jre/lib/svm/clibraries/linux-amd64
]
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:81294]    classlist:   2,658.24 ms
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:81294]        (cap):     608.42 ms
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:81294]        setup:     879.72 ms
[cljurl-graalvm-demo-0.1.0-SNAPSHOT-standalone:81294]     analysis:  15,036.63 ms
Error: Unsupported features in 2 methods
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: org.apache.http.conn.ssl.SSLConnectionSocketFactory. Try marking this class for build-time initialization with --initialize-at-build-time=org.apache.http.conn.ssl.SSLConnectionSocketFactory
Trace: 	object java.util.concurrent.ConcurrentHashMap$Node
	object java.util.concurrent.ConcurrentHashMap$Node[]
	object java.util.concurrent.ConcurrentHashMap
	object org.apache.http.config.Registry
	object clojure.lang.Var
	method clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(Object)
Call path from entry point to clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(Object): 
	at clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(conn_mgr.clj:234)
	at clj_http.conn_mgr$make_regular_conn_manager.invoke(conn_mgr.clj:234)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Ref.applyTo(Ref.java:366)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: org.apache.http.nio.conn.ssl.SSLIOSessionStrategy. Try marking this class for build-time initialization with --initialize-at-build-time=org.apache.http.nio.conn.ssl.SSLIOSessionStrategy
Trace: 	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$generate_query_string.invokeStatic(Object, ISeq)
Call path from entry point to clj_http.client$generate_query_string.invokeStatic(Object, ISeq): 
	at clj_http.client$generate_query_string.invokeStatic(client.clj:789)
	at clj_http.client$generate_query_string.doInvoke(client.clj:789)
	at clojure.lang.RestFn.applyTo(RestFn.java:139)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

com.oracle.svm.core.util.UserError$UserException: Unsupported features in 2 methods
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: org.apache.http.conn.ssl.SSLConnectionSocketFactory. Try marking this class for build-time initialization with --initialize-at-build-time=org.apache.http.conn.ssl.SSLConnectionSocketFactory
Trace: 	object java.util.concurrent.ConcurrentHashMap$Node
	object java.util.concurrent.ConcurrentHashMap$Node[]
	object java.util.concurrent.ConcurrentHashMap
	object org.apache.http.config.Registry
	object clojure.lang.Var
	method clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(Object)
Call path from entry point to clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(Object): 
	at clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(conn_mgr.clj:234)
	at clj_http.conn_mgr$make_regular_conn_manager.invoke(conn_mgr.clj:234)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Ref.applyTo(Ref.java:366)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: org.apache.http.nio.conn.ssl.SSLIOSessionStrategy. Try marking this class for build-time initialization with --initialize-at-build-time=org.apache.http.nio.conn.ssl.SSLIOSessionStrategy
Trace: 	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$generate_query_string.invokeStatic(Object, ISeq)
Call path from entry point to clj_http.client$generate_query_string.invokeStatic(Object, ISeq): 
	at clj_http.client$generate_query_string.invokeStatic(client.clj:789)
	at clj_http.client$generate_query_string.doInvoke(client.clj:789)
	at clojure.lang.RestFn.applyTo(RestFn.java:139)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

	at com.oracle.svm.core.util.UserError.abort(UserError.java:75)
	at com.oracle.svm.hosted.FallbackFeature.reportAsFallback(FallbackFeature.java:218)
	at com.oracle.svm.hosted.NativeImageGenerator.runPointsToAnalysis(NativeImageGenerator.java:733)
	at com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:523)
	at com.oracle.svm.hosted.NativeImageGenerator.lambda$run$0(NativeImageGenerator.java:441)
	at java.util.concurrent.ForkJoinTask$AdaptedRunnableAction.exec(ForkJoinTask.java:1386)
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)
Caused by: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: Unsupported features in 2 methods
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: org.apache.http.conn.ssl.SSLConnectionSocketFactory. Try marking this class for build-time initialization with --initialize-at-build-time=org.apache.http.conn.ssl.SSLConnectionSocketFactory
Trace: 	object java.util.concurrent.ConcurrentHashMap$Node
	object java.util.concurrent.ConcurrentHashMap$Node[]
	object java.util.concurrent.ConcurrentHashMap
	object org.apache.http.config.Registry
	object clojure.lang.Var
	method clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(Object)
Call path from entry point to clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(Object): 
	at clj_http.conn_mgr$make_regular_conn_manager.invokeStatic(conn_mgr.clj:234)
	at clj_http.conn_mgr$make_regular_conn_manager.invoke(conn_mgr.clj:234)
	at clojure.lang.AFn.applyToHelper(AFn.java:154)
	at clojure.lang.Ref.applyTo(Ref.java:366)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: org.apache.http.nio.conn.ssl.SSLIOSessionStrategy. Try marking this class for build-time initialization with --initialize-at-build-time=org.apache.http.nio.conn.ssl.SSLIOSessionStrategy
Trace: 	object clojure.lang.Var
	object java.lang.Object[]
	object clojure.lang.PersistentHashMap$BitmapIndexedNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap$INode[]
	object clojure.lang.PersistentHashMap$ArrayNode
	object clojure.lang.PersistentHashMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object java.lang.Object[]
	object clojure.lang.PersistentArrayMap
	object java.util.concurrent.atomic.AtomicReference
	object clojure.lang.Namespace
	object clojure.lang.Var
	method clj_http.client$generate_query_string.invokeStatic(Object, ISeq)
Call path from entry point to clj_http.client$generate_query_string.invokeStatic(Object, ISeq): 
	at clj_http.client$generate_query_string.invokeStatic(client.clj:789)
	at clj_http.client$generate_query_string.doInvoke(client.clj:789)
	at clojure.lang.RestFn.applyTo(RestFn.java:139)
	at cljurl_graalvm_demo.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:153)
	at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

	at com.oracle.graal.pointsto.constraints.UnsupportedFeatures.report(UnsupportedFeatures.java:133)
	at com.oracle.graal.pointsto.BigBang.finish(BigBang.java:564)
	at com.oracle.svm.hosted.NativeImageGenerator.runPointsToAnalysis(NativeImageGenerator.java:684)
	... 7 more
Error: Image build request failed with exit status 1

I'll keep banging at it to see if I can find which class is introducing the issue :) I guess I'm more likely to find the culprit from the "Call path from entry point"? (Functions in Clojure map to classes on the JVM so hopefully we'll have fine granularity here.)

@vjovanov
Copy link
Member

vjovanov commented May 13, 2019

Yes, in combination with object path. Note that the call path is just the shortest path and not necessarily the one that causes the issue.

The error messages are misleading here. Since you already explicitly marked classes as BUILD_TIME the message should tell you how to use the information below and not suggest to use --initialize-at-build-time as this is clearly not what you want.

@lvh
Copy link

lvh commented May 14, 2019

Gotcha, makes sense. So: find classes introducing objects in the image, make them initialize at run-time, rinse, repeat. I might just parse the output and try to come up with those locations automatically. Also, since you mention that's just a shortest path, is there a way for native-image to dump all the paths? I'm happy to burn hours of CPU time on this and less happy to burn hours of human time on this :-)

Any idea if/when/where I should be seeing output from -H:+PrintClassInitialization?

@lvh
Copy link

lvh commented May 14, 2019

Figured it out: unfortunately the printed classes only happen after analysis, and the error above happens before analysis. Also for any Clojure folks reading: it's a lot easier to get https://github.com/martinklepsch/clj-http-lite/ working than clj-http. The former relies on the JVM builtin URL openers, whereas the latter is a pretty involved library using the Apache HTTP Client. There's some reduction in functionality but odds are you don't really care about that.

@vjovanov
Copy link
Member

Yes, I am working on error reporting now: It will print all of the issues it finds on one go so repeat happens less. Also, I will try to print available info when the error occurs so that it is easier to get things right.

Unfortunately, error reporting requires using java agents to track initialization and that is hard to integrate with the rest. The solution will be out soon.

Thanks for the valuable feedback, it will make things better.

@ilya-murzinov
Copy link

Hello, I've come across (presumably) the same issue with

$ native-image --version
GraalVM Version 1.0.0-rc15 CE

I've created the repo with the code to reproduce the issue: https://github.com/ilya-murzinov/weblfux-graalvm
I've tried different (mostly random) options like --enable-https, but nothing worked.

Can someone please point me to some simple workaround?

@lvh
Copy link

lvh commented May 20, 2019

@ilya-murzinov

  1. Use clj-http-lite
  2. Use --initialize-at-build-time with 19.0.0
  3. See Optional "sunec" native library of SunEC provider becomes mandatory when using SVM #951 where I will post updates if I get it working with BouncyCastle so you don't have to care about libsunec.so -- you can already get it working without libsunec.so, but then you don't get ECDSA certs ort ECDHE handshakes.

@ilya-murzinov
Copy link

@lvh I've tried

--initialize-at-build-time=io.netty,reactor.netty,\
reactor.core,\
reactor.util,\
reactor.core.CoreSubscriber,\
javax.net.ssl.SSLContext

but got the following error:

Error: Incompatible change of initialization policy for javax.net.ssl.SSLContext: trying to change BUILD_TIME from the command line to RERUN for substitutions
com.oracle.svm.core.util.UserError$UserException: Incompatible change of initialization policy for javax.net.ssl.SSLContext: trying to change BUILD_TIME from the command line to RERUN for substitutions
	at com.oracle.svm.core.util.UserError.abort(UserError.java:65)
	at com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:89)
	at com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:100)
	at com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:100)
	at com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:100)
	at com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:100)
	at com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insert(ClassInitializationConfiguration.java:62)
	at com.oracle.svm.hosted.classinitialization.ConfigurableClassInitialization.rerunInitialization(ConfigurableClassInitialization.java:216)
	at com.oracle.svm.hosted.SecurityServicesFeature.duringSetup(SecurityServicesFeature.java:123)
	at com.oracle.svm.hosted.NativeImageGenerator.lambda$setupNativeImage$12(NativeImageGenerator.java:837)
	at com.oracle.svm.hosted.FeatureHandler.forEachFeature(FeatureHandler.java:64)
	at com.oracle.svm.hosted.NativeImageGenerator.setupNativeImage(NativeImageGenerator.java:837)
	at com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:521)
	at com.oracle.svm.hosted.NativeImageGenerator.lambda$run$0(NativeImageGenerator.java:441)
	at java.util.concurrent.ForkJoinTask$AdaptedRunnableAction.exec(ForkJoinTask.java:1386)
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)
Error: Image build request failed with exit status 1

@lvh
Copy link

lvh commented May 21, 2019

@ilya-murzinov that looks like a similar problem with netty, which I haven't tried to get working either. Note, I suggested just --serialize-at-build-time (which makes it the default for all classes) :)

@vjovanov
Copy link
Member

This is expected behavior: we can not specify two different policies for the same class (javax.net.ssl.SSLContext). The JDK specifies this class as RERUN so we are not allowed to change that. If that behavior is incorrect we need to fix it in our JDK support.

nicokosi added a commit to nicokosi/hubstats that referenced this issue Jul 14, 2019
Using a lighter HTTP client library makes it possible
to use GraalVM native image with the no fallback mode.
Executable is now faster:

  time ./hubstats.core
  ...
  ./hubstats.core  0.00s user 0.00s system 60% cpu 0.008 total

instead of:

  time ./hubstats.core
  ...
  ./hubstats.core  5.34s user 0.28s system 234% cpu 2.398 total

See oracle/graal#1074 (comment)
nicokosi added a commit to nicokosi/hubstats that referenced this issue Jul 15, 2019
Using a lighter HTTP client library makes it possible
to use GraalVM native image with the no fallback mode.
Executable is now faster:

  time ./hubstats.core
  ...
  ./hubstats.core  0.00s user 0.00s system 60% cpu 0.008 total

instead of:

  time ./hubstats.core
  ...
  ./hubstats.core  5.34s user 0.28s system 234% cpu 2.398 total

See oracle/graal#1074 (comment)
@vjovanov vjovanov assigned vjovanov and unassigned cstancu Dec 4, 2019
@ashwinbhaskar
Copy link

ashwinbhaskar commented Nov 8, 2020

@ilya-murzinov that looks like a similar problem with netty, which I haven't tried to get working either. Note, I suggested just --serialize-at-build-time (which makes it the default for all classes) :)

@ivh I think you meant --initialize-at-build-time and not --serialize-at-build-time ?

@vjovanov
Copy link
Member

Is this still a valid issue? If yes, please reopen.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants