1.0.0 RC7 breaks support for Micronaut/Netty: No instances are allowed in the image heap

[graemerocher]

With RC7 and attempting to build a native image that previously worked in RC6 results in:

error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Trace: 	object io.netty.handler.ssl.util.ThreadLocalInsecureRandom
	method io.netty.handler.ssl.util.ThreadLocalInsecureRandom.current()
Call path from entry point to io.netty.handler.ssl.util.ThreadLocalInsecureRandom.current(): 
	at io.netty.handler.ssl.util.ThreadLocalInsecureRandom.current(ThreadLocalInsecureRandom.java:35)
	at io.netty.handler.ssl.util.SelfSignedCertificate.<init>(SelfSignedCertificate.java:110)
	at io.netty.handler.ssl.util.SelfSignedCertificate.<init>(SelfSignedCertificate.java:88)
	at io.netty.handler.ssl.util.SelfSignedCertificate.<init>(SelfSignedCertificate.java:79)
	at io.micronaut.http.server.netty.ssl.NettyServerSslBuilder.build(NettyServerSslBuilder.java:67)
	at io.micronaut.http.server.netty.NettyHttpServer.<init>(NettyHttpServer.java:207)
	at 

Further trace:

com.oracle.svm.reflect.proxies.Proxy_io_micronaut_http_server_netty_NettyHttpServer_constructor_io_micronaut_http_server_netty_configuration_NettyHttpServerConfiguration_io_micronaut_context_ApplicationContext_io_micronaut_web_router_Router_io_micronaut_http_server_binding_RequestArgumentSatisfier_io_micronaut_http_codec_MediaTypeCodecRegistry_io_micronaut_http_server_netty_types_NettyCustomizableResponseTypeHandlerRegistry_io_micronaut_web_router_resource_StaticResourceResolver_java_util_concurrent_ExecutorService_java_util_concurrent_ThreadFactory_io_micronaut_scheduling_executor_ExecutorSelector_io_micronaut_http_server_netty_ssl_NettyServerSslBuilder_java_util_List_430.newInstance(Unknown Source)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
	at sun.security.x509.OtherName.getGNI(OtherName.java:132)
	at sun.security.x509.OtherName.equals(OtherName.java:184)
	at io.micronaut.caffeine.cache.UnboundedLocalCache$EntrySetView.contains(UnboundedLocalCache.java:729)
	at java.util.AbstractCollection.containsAll(AbstractCollection.java:318)
	at java.util.RegularEnumSet.containsAll(RegularEnumSet.java:199)
	at com.oracle.svm.core.amd64.AMD64CPUFeatureAccess.verifyHostSupportsArchitecture(AMD64CPUFeatureAccess.java:158)
	at com.oracle.svm.core.JavaMainWrapper.run(JavaMainWrapper.java:138)
	at com.oracle.svm.core.code.CEntryPointCallStubs.com_002eoracle_002esvm_002ecore_002eJavaMainWrapper_002erun_0028int_002corg_002egraalvm_002enativeimage_002ec_002etype_002eCCharPointerPointer_0029(generated:0)

Error: Processing image build request failed

Are there any new flags that should be passed to avoid this? Or am I missing something

[graemerocher]

Possibly relates to #712

[cstancu]

Can you try pushing the initialization of ThreadLocalInsecureRandom to runtime using --delay-class-initialization-to-runtime=ThreadLocalInsecureRandom?

[graemerocher]

@cstancu If I do that it now fails with:

error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	field sun.security.jca.JCAUtil$CachedSecureRandomHolder.instance

Error: Processing image build request failed

If I try add java.security.SecureRandom then it fails with:

error: Class is already initialized, so it is too late to register delaying class initialization: java.security.SecureRandom
Error: Processing image build request failed

[cstancu]

You cannot delay SecureRandom, we need that in the image. You need --rerun-class-initialization-at-runtime=sun.security.jca.JCAUtil$CachedSecureRandomHolder. Notice that this is --rerun-class-initialization-at-runtime instead of --delay-class-initialization-to-runtime since this is a JDK class and might be already initialized during image building.

[graemerocher]

I made the following change:

--- a/app-with-discovery/build-native-image.sh
+++ b/app-with-discovery/build-native-image.sh
@@ -8,4 +8,5 @@ native-image --class-path build/libs/app-with-discovery-0.1-all.jar \
                         -H:Class=app.with.discovery.Application \
                         -H:+ReportUnsupportedElementsAtRuntime \
                         -H:+AllowVMInspection \
-                        --delay-class-initialization-to-runtime=io.netty.handler.codec.http.HttpObjectEncoder,io.netty.handler.codec.http.websocketx.WebSocket00FrameEncoder,io.netty.handler.codec.http.HttpObjectDecoder
+                        --delay-class-initialization-to-runtime=io.netty.handler.codec.http.HttpObjectEncoder,io.netty.handler.codec.http.websocketx.WebSocket00FrameEncoder,io.netty.handler.codec.http.HttpObjectDecoder,io.netty.handler.ssl.util.ThreadLocalInsecureRandom \
+                        --rerun-class-initialization-at-runtime=sun.security.jca.JCAUtil$CachedSecureRandomHolder

But it still fails with the same error:

error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	field sun.security.jca.JCAUtil$CachedSecureRandomHolder.instance

[cstancu]

Can you point me to the repo/branch to replicate this?

[graemerocher]

@cstancu you can replicate with the steps in #714 just using RC7 instead of RC6

[cstancu]

Trying to build I fail with

$ ./gradlew assemble

FAILURE: Build failed with an exception.

* What went wrong:
Could not determine the dependencies of task ':shadowJar'.
> Could not resolve all dependencies for configuration ':runtimeClasspath'.
   > Could not find io.micronaut:graal:.
     Required by:
         project :

[graemerocher]

@cstancu are you behind a proxy? I cleaned my Maven and Gradle caches and it seems to work fine. You need to able to resolve snapshots from https://oss.sonatype.org/content/repositories/snapshots

[graemerocher]

@cstancu maybe the step to install the Graal SVM dependency is missing?

mvn install:install-file -Dfile=${JAVA_HOME}/jre/lib/svm/builder/svm.jar \
                           -DgroupId=com.oracle.substratevm \
                           -DartifactId=svm \
                           -Dversion=GraalVM-1.0.0-rc6 \
                           -Dpackaging=jar

If you install the RC7 SVM jar you will need to update the reference in the build.gradle

[mavilein]

We are hitting the same issue. We have a reproduction available here. This is the error we are seeing:

[main:498]     analysis:  14,269.80 ms
error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Detailed message:
Error: No instances are allowed in the image heap for a class that is initialized or reinitialzied at image runtime: sun.security.provider.NativePRNG
Trace: 	object java.security.SecureRandom
	object sun.security.ssl.SSLContextImpl$DefaultSSLContext
	object javax.net.ssl.SSLContext
	field javax.net.ssl.SSLContext.defaultContext

Error: Processing image build request failed

I am also happy to jump on a call if this easier for you @cstancu