Error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG

[gaberger]

Executing [
/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/bin/java \
-Xbootclasspath/a:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graal-sdk.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graaljs-scriptengine.jar \
-cp \
/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/svm.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/objectfile.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/pointsto.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal-management.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-hotspot.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-api.jar \
-server \
-d64 \
-noverify \
-XX:+UnlockExperimentalVMOptions \
-XX:+EnableJVMCI \
-XX:-UseJVMCIClassLoader \
-Dgraal.EagerSnippets=true \
-Xss10m \
-Xms1g \
-Xmx6648509232 \
-Duser.country=US \
-Duser.language=en \
-Dgraalvm.version=1.0.0-rc7 \
-Dorg.graalvm.version=1.0.0-rc7 \
-Dcom.oracle.graalvm.isaot=true \
-Djvmci.class.path.append=/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal.jar \
com.oracle.svm.hosted.NativeImageGeneratorRunner \
-imagecp \
/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graal-sdk.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graaljs-scriptengine.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/svm.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/objectfile.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/pointsto.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal-management.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-hotspot.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-api.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/library-support.jar:/mnt/jamastore1/WIP/githubid/src:/mnt/jamastore1/WIP/githubid/target/classes:/home/gary/.m2/repository/org/clojure/clojure/1.9.0/clojure-1.9.0.jar:/home/gary/.m2/repository/org/clojure/core.specs.alpha/0.1.24/core.specs.alpha-0.1.24.jar:/home/gary/.m2/repository/org/clojure/spec.alpha/0.1.143/spec.alpha-0.1.143.jar:/home/gary/.m2/repository/com/taoensso/encore/2.91.0/encore-2.91.0.jar:/home/gary/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.0/jackson-dataformat-cbor-2.9.0.jar:/home/gary/.m2/repository/io/aviso/pretty/0.1.33/pretty-0.1.33.jar:/home/gary/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.9.0/jackson-core-2.9.0.jar:/home/gary/.m2/repository/com/taoensso/truss/1.5.0/truss-1.5.0.jar:/home/gary/.m2/repository/com/taoensso/timbre/4.10.0/timbre-4.10.0.jar:/home/gary/.m2/repository/cheshire/cheshire/5.8.0/cheshire-5.8.0.jar:/home/gary/.m2/repository/tigris/tigris/0.1.1/tigris-0.1.1.jar:/home/gary/.m2/repository/org/clojure/tools.reader/0.10.0/tools.reader-0.10.0.jar:/home/gary/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-smile/2.9.0/jackson-dataformat-smile-2.9.0.jar:/home/gary/.m2/repository/http-kit/http-kit/2.3.0/http-kit-2.3.0.jar \
-watchpid \
2072 \
-H:Path=/mnt/jamastore1/WIP/githubid \
-H:+ReportUnsupportedElementsAtRuntime \
-H:Name=target/githubid \
-H:CLibraryPath=/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/clibraries/linux-amd64 \
-H:EnableURLProtocols=https \
-H:Class=githubid.core
]
[target/githubid:2073]    classlist:   4,697.72 ms
[target/githubid:2073]        (cap):     744.79 ms
[target/githubid:2073]        setup:   1,496.16 ms
[target/githubid:2073]     analysis:  69,419.87 ms
error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	object sun.security.ssl.SSLContextImpl$TLSContext
	object javax.net.ssl.SSLContext
	method org.httpkit.client.SslContextFactory.trustAnybody()
Call path from entry point to org.httpkit.client.SslContextFactory.trustAnybody():
	at org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
	at org.httpkit.client$coerce_req.invokeStatic(client.clj:68)
	at org.httpkit.client$coerce_req.invoke(client.clj:59)
	at clojure.core$juxt$fn__5548$fn__5551.invoke(core.clj:2601)
	at taoensso.timbre$handle_uncaught_jvm_exceptions_BANG_$reify__5207.uncaughtException(timbre.clj:639)
	at com.oracle.svm.core.thread.JavaThreads.dispatchUncaughtException(JavaThreads.java:575)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:166)
	at com.oracle.svm.core.code.CEntryPointCallStubs.com_002eoracle_002esvm_002ecore_002eJavaMainWrapper_002erun_0028int_002corg_002egraalvm_002enativeimage_002ec_002etype_002eCCharPointerPointer_0029(generated:0)

Error: Image building with exit status 1```

[cstancu]

@gaberger can you please try running with --rerun-class-initialization-at-runtime=javax.net.ssl.SSLContext?

[gaberger]

Still failing

native-image --verbose --rerun-class-initialization-at-runtime=javax.net.ssl.SSLContext  --no-server -cp src:target/classes:/home/gary/.m2/repository/org/clojure/clojure/1.9.0/clojure-1.9.0.jar:/home/gary/.m2/repository/org/clojure/core.specs.alpha/0.1.24/core.specs.alpha-0.1.24.jar:/home/gary/.m2/repository/org/clojure/spec.alpha/0.1.143/spec.alpha-0.1.143.jar:/home/gary/.m2/repository/com/taoensso/encore/2.91.0/encore-2.91.0.jar:/home/gary/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.0/jackson-dataformat-cbor-2.9.0.jar:/home/gary/.m2/repository/io/aviso/pretty/0.1.33/pretty-0.1.33.jar:/home/gary/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.9.0/jackson-core-2.9.0.jar:/home/gary/.m2/repository/com/taoensso/truss/1.5.0/truss-1.5.0.jar:/home/gary/.m2/repository/com/taoensso/timbre/4.10.0/timbre-4.10.0.jar:/home/gary/.m2/repository/cheshire/cheshire/5.8.0/cheshire-5.8.0.jar:/home/gary/.m2/repository/tigris/tigris/0.1.1/tigris-0.1.1.jar:/home/gary/.m2/repository/org/clojure/tools.reader/0.10.0/tools.reader-0.10.0.jar:/home/gary/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-smile/2.9.0/jackson-dataformat-smile-2.9.0.jar:/home/gary/.m2/repository/http-kit/http-kit/2.3.0/http-kit-2.3.0.jar -H:+ReportUnsupportedElementsAtRuntime -H:Name=target/githubid -H:EnableURLProtocols=https githubid.core
Executing [
/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/bin/java \
-Xbootclasspath/a:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graal-sdk.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graaljs-scriptengine.jar \
-cp \
/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/svm.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/objectfile.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/pointsto.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal-management.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-hotspot.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-api.jar \
-server \
-d64 \
-noverify \
-XX:+UnlockExperimentalVMOptions \
-XX:+EnableJVMCI \
-XX:-UseJVMCIClassLoader \
-Dgraal.EagerSnippets=true \
-Xss10m \
-Xms1g \
-Xmx6648509232 \
-Duser.country=US \
-Duser.language=en \
-Dgraalvm.version=1.0.0-rc7 \
-Dorg.graalvm.version=1.0.0-rc7 \
-Dcom.oracle.graalvm.isaot=true \
-Djvmci.class.path.append=/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal.jar \
com.oracle.svm.hosted.NativeImageGeneratorRunner \
-imagecp \
/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graal-sdk.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/boot/graaljs-scriptengine.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/svm.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/objectfile.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/builder/pointsto.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/graal-management.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-hotspot.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/jvmci/jvmci-api.jar:/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/library-support.jar:/mnt/jamastore1/WIP/githubid/src:/mnt/jamastore1/WIP/githubid/target/classes:/home/gary/.m2/repository/org/clojure/clojure/1.9.0/clojure-1.9.0.jar:/home/gary/.m2/repository/org/clojure/core.specs.alpha/0.1.24/core.specs.alpha-0.1.24.jar:/home/gary/.m2/repository/org/clojure/spec.alpha/0.1.143/spec.alpha-0.1.143.jar:/home/gary/.m2/repository/com/taoensso/encore/2.91.0/encore-2.91.0.jar:/home/gary/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.0/jackson-dataformat-cbor-2.9.0.jar:/home/gary/.m2/repository/io/aviso/pretty/0.1.33/pretty-0.1.33.jar:/home/gary/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.9.0/jackson-core-2.9.0.jar:/home/gary/.m2/repository/com/taoensso/truss/1.5.0/truss-1.5.0.jar:/home/gary/.m2/repository/com/taoensso/timbre/4.10.0/timbre-4.10.0.jar:/home/gary/.m2/repository/cheshire/cheshire/5.8.0/cheshire-5.8.0.jar:/home/gary/.m2/repository/tigris/tigris/0.1.1/tigris-0.1.1.jar:/home/gary/.m2/repository/org/clojure/tools.reader/0.10.0/tools.reader-0.10.0.jar:/home/gary/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-smile/2.9.0/jackson-dataformat-smile-2.9.0.jar:/home/gary/.m2/repository/http-kit/http-kit/2.3.0/http-kit-2.3.0.jar \
-watchpid \
10734 \
-H:Path=/mnt/jamastore1/WIP/githubid \
-H:RerunClassInitialization=javax.net.ssl.SSLContext \
-H:+ReportUnsupportedElementsAtRuntime \
-H:Name=target/githubid \
-H:CLibraryPath=/mnt/jamastore1/runtime/graalvm-ce-1.0.0-rc7/jre/lib/svm/clibraries/linux-amd64 \
-H:EnableURLProtocols=https \
-H:Class=githubid.core
]
[target/githubid:10735]    classlist:   4,369.05 ms
[target/githubid:10735]        (cap):     785.63 ms
[target/githubid:10735]        setup:   1,561.71 ms
[target/githubid:10735]     analysis:  70,932.13 ms
error: unsupported features in 2 methods
Detailed message:
Error: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: javax.net.ssl.SSLContext
Trace:
	at parsing org.httpkit.client.HttpClient.exec(HttpClient.java:347)
Call path from entry point to org.httpkit.client.HttpClient.exec(String, RequestConfig, SSLEngine, IRespListener):
	at org.httpkit.client.HttpClient.exec(HttpClient.java:269)
	at org.httpkit.client$request.invokeStatic(client.clj:258)
	at org.httpkit.client$request.doInvoke(client.clj:152)
	at clojure.lang.RestFn.applyTo(RestFn.java:139)
	at githubid.core.main(Unknown Source)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:163)
	at com.oracle.svm.core.code.CEntryPointCallStubs.com_002eoracle_002esvm_002ecore_002eJavaMainWrapper_002erun_0028int_002corg_002egraalvm_002enativeimage_002ec_002etype_002eCCharPointerPointer_0029(generated:0)
Error: com.oracle.graal.pointsto.constraints.UnsupportedFeatureException: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: javax.net.ssl.SSLContext
Trace:
	at parsing org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
Call path from entry point to org.httpkit.client.SslContextFactory.trustAnybody():
	at org.httpkit.client.SslContextFactory.trustAnybody(SslContextFactory.java:36)
	at org.httpkit.client$coerce_req.invokeStatic(client.clj:68)
	at org.httpkit.client$coerce_req.invoke(client.clj:59)
	at clojure.core$comp$fn__5529.invoke(core.clj:2562)
	at taoensso.timbre$handle_uncaught_jvm_exceptions_BANG_$reify__5207.uncaughtException(timbre.clj:639)
	at com.oracle.svm.core.thread.JavaThreads.dispatchUncaughtException(JavaThreads.java:575)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:166)
	at com.oracle.svm.core.code.CEntryPointCallStubs.com_002eoracle_002esvm_002ecore_002eJavaMainWrapper_002erun_0028int_002corg_002egraalvm_002enativeimage_002ec_002etype_002eCCharPointerPointer_0029(generated:0)

Error: Image building with exit status 1

[narkisr]

Got similar error from another project the adding the flag had no effect

[apetrelli]

Hello
I have a similar problem with compiling natively using jcifs. The reason seemed to be the SecureRandom instance inside Type3Message as a static field.
I added:
--rerun-class-initialization-at-runtime=jcifs.ntlmssp.Type3Message
and it compiled.
Notice that I have previously used 1.0.0-rc6 and it compiled well without this flag. Upgrading to rc7 causes this problem.
@gaberger can you try using:
--rerun-class-initialization-at-runtime=org.httpkit.client.SslContextFactory
I see this class has a static SSLContext field, that may be the culprit.

[cstancu]

I'll close this since it is an old issue that should be fixed in the latest GraalVM RC. Please reopen if you still have problems and provide steps to reproduce.

[twblamer]

It's still failing. My program is closed source, but if this issue can be reopened, I can try to construct a synthetic repro case.

$ native-image --version
GraalVM Version 1.0.0-rc12

$ native-image -H:-UseServiceLoaderFeature -cp "<other deps>:./lib/mongo-java-driver-3.4.3.jar:./build/main/jar/myprogram.jar" myprogram
Build on Server(pid: 17745, port: 34248)
[myprogram:17745]    classlist:   1,496.56 ms
[myprogram:17745]        (cap):     526.70 ms
[myprogram:17745]        setup:     808.88 ms
[myprogram:17745]     analysis:   7,278.66 ms
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG
Trace:  object java.security.SecureRandom
        object sun.security.ssl.SSLContextImpl$DefaultSSLContext
        object sun.security.ssl.SSLSocketFactoryImpl
        method com.mongodb.MongoClientOptions.getSocketFactory()
Call path from entry point to com.mongodb.MongoClientOptions.getSocketFactory():
        at com.mongodb.MongoClientOptions.getSocketFactory(MongoClientOptions.java:578)
        at com.mongodb.Mongo.createCluster(Mongo.java:749)
        at com.mongodb.Mongo.createCluster(Mongo.java:728)
        at com.mongodb.Mongo.createCluster(Mongo.java:702)
        at com.mongodb.Mongo.<init>(Mongo.java:310)
        at com.mongodb.Mongo.<init>(Mongo.java:306)
        at com.mongodb.MongoClient.<init>(MongoClient.java:284)
        *snip*
        at myprogram.main(myprogram.java:123)
        at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:152)
        at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

[cstancu]

@twblamer have you tried using --delay-class-initialization-at-runtime=... as suggested above? You can read more details about that option in this article. This behavior is not a bug in the native-image tool and it is a symptom of the limitations that our design imposes on class initializers. We are working on a mechanism to automatically detect classes that cannot be initialized at image build time, in the meantime that process is manual and it must be carried out by the user as described in the article.

After inspecting your stack trace and the corresponding JDK classes I think the problem is the SecureRandom object stored in the SSLContextImpl.secureRandom instance field which gets initialized by the class initializer of SSLContextImpl.DefaultSSLContextHolder when it allocates an instance of SSLContextImpl.DefaultSSLContext and stores it in the static field SSLContextImpl.DefaultSSLContextHolder.sslContext. This is triggered by the constructor of SSLSocketFactoryImpl which calls SSLContextImpl.DefaultSSLContext.getDefaultImpl() and stores the returned value in the SSLSocketFactoryImpl.context instance field. So you can try to delay the initialization of SSLContextImpl.DefaultSSLContextHolder (i.e., using --delay-class-initialization-at-runtime='sun.security.ssl.SSLContextImpl$DefaultSSLContextHolder').

You can reopen this issue if that doesn't work and you can make a minimal, synthetic repro case.

[twblamer]

@cstancu Thanks for the explanation and link.

I tried the option you suggested and still no luck:

$ native-image --delay-class-initialization-to-runtime='sun.security.ssl.SSLContextImpl$DefaultSSLContextHolder' -cp myprogram.jar myprogram
Build on Server(pid: 371, port: 46663)
[myprogram:371]    classlist:   1,460.39 ms
[myprogram:371]        (cap):     564.18 ms
[myprogram:371]        setup:     879.18 ms
[myprogram:371]     analysis:   6,947.91 ms
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialized at image runtime: sun.security.provider.NativePRNG
Trace:  object java.security.SecureRandom
        object sun.security.ssl.SSLContextImpl$DefaultSSLContext
        object sun.security.ssl.SSLSocketFactoryImpl
        method com.mongodb.MongoClientOptions.getSocketFactory()
Call path from entry point to com.mongodb.MongoClientOptions.getSocketFactory():
        at com.mongodb.MongoClientOptions.getSocketFactory(MongoClientOptions.java:578)
        at com.mongodb.Mongo.createCluster(Mongo.java:749)
        at com.mongodb.Mongo.createCluster(Mongo.java:728)
        at com.mongodb.Mongo.createCluster(Mongo.java:702)
        at com.mongodb.Mongo.<init>(Mongo.java:310)
        at com.mongodb.Mongo.<init>(Mongo.java:306)
        at com.mongodb.MongoClient.<init>(MongoClient.java:284)
        *snip*
        at myprogram.main(myprogram.java:123)
        at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:152)
        at com.oracle.svm.core.code.IsolateEnterStub.JavaMainWrapper_run_5087f5482cc9a6abc971913ece43acb471d2631b(generated:0)

Error: Use -H:+ReportExceptionStackTraces to print stacktrace of underlying exception
Error: Processing image build request failed

I will follow your suggestion and try to create a minimal repro case.