Repository navigation
JNI local reference leak in StreamHandle._writev #26
Description
Summary
Java_com_iwebpp_libuvpp_handles_StreamHandle__1writev in app/src/main/jni/stream.cpp creates one JNI local reference per buffer and never releases it.
bufcount is the array length, with no cap. The references stay until _writev returns. Android's local reference table holds 512 entries. Overflow aborts the process: JNI ERROR (app bug): local reference table overflow (max=512).
Where
for (int i = 0; i < bufcount; i++) {
jbyteArray data = (jbyteArray) env->GetObjectArrayElement(buffers, i);
jbyte* base = (jbyte*) env->GetByteArrayElements(data, NULL);
elements[i] = (jobject) data;
bases[i] = base;
bufs[i].base = reinterpret_cast<char*>(base);
bufs[i].len = env->GetArrayLength(data);
}
req_data->set_elements(buffers, elements, bases, bufcount);
Storing data in elements does not remove it from the local reference table. ContextHolder's destructor runs later in _write_cb. It deletes the global references created by set_elements and calls ReleaseByteArrayElements. It does not free the local references created in this loop. A large writev fills the table before uv_write.
Fix
Promote each buffer inside the loop, then drop the local reference. set_elements still calls NewGlobalRef on elements[i], so do not delete the local reference before that, and do not create a second global reference for the same object.
jbyteArray data = (jbyteArray) env->GetObjectArrayElement(buffers, i);
jbyte* base = (jbyte*) env->GetByteArrayElements(data, NULL);
elements[i] = env->NewGlobalRef(data);
bases[i] = base;
bufs[i].base = reinterpret_cast<char*>(base);
bufs[i].len = env->GetArrayLength(data);
env->DeleteLocalRef(data);
Activity