Unable to complete the scan for annotations for web application [/app] due to a StackOverflowError

Question

I am developing a Spring MVC application using STS (eclipse plugin) and maven.

For creating the project, I followed the STS wizard for a new "Spring MVC project". Afterwards, I added some dependencies to other projects and libraries.

However, when I am now trying to deploy the project to the integrated vFabric server of STS, I sometimes get an exception:

SEVERE: ContainerBase.addChild: start: 
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/wsa]]
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:154)
    at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
    ...
Caused by: java.lang.IllegalStateException: Unable to complete the scan for annotations for web application [/app] due to a StackOverflowError. Possible root causes include a too low setting for -Xss and illegal cyclic inheritance dependencies. The class hierarchy being processed was [org.bouncycastle.asn1.ASN1EncodableVector->org.bouncycastle.asn1.DEREncodableVector->org.bouncycastle.asn1.ASN1EncodableVector]
    at org.apache.catalina.startup.ContextConfig.checkHandlesTypes(ContextConfig.java:2179)
    ...

When issuing a "maven clean", followed by a "maven install" and a restart of the server, the exception sometimes doesn't get thrown and the application works fine. Yet, most of the times, it doesn't work.

I guess there is no need to scan the bouncycastle dependencies for annotations.
Can I somehow disable this scanning for some jars?

I already tried adding metadata-complete="true" to my web.xml and increasing the stack size with no result.

What can I do to fix this?

Proteiform

Possible root causes include a too low setting for -Xss and illegal cyclic inheritance dependencies. I guess that message already answers you. – Gametogenesis

As said: I already increased the stack size. And I can't change the inheritance of some external dependencies. I just need some way to exclude them from scanning. – Proteiform

Where you raised the stack size? – Gametogenesis

In the "Run configuration" setting of my project for the server under "Arguments - VM arguments", I set "-Xss4m" (was Xss768k or so before). – Proteiform

Answer 1

In my case the org.bouncycastle.asn1.DEREncodableVector class, which was causing the cyclic dependency, was served by two jars in the class path.

bcprov-jdk15on-1.47.jar and bcprov-jdk16-1.45.jar

Excluded the unwanted jar(bcprov-jdk16-1.45.jar) and it worked well

Example: If apache CFX web services security is adding the unnecessary bcprov maven dependency, then it can be excluded as follows

<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-ws-security</artifactId>
    <version>${org.apache.cxf.version}</version>
    <exclusions>
        <exclusion>
          <groupId>org.bouncycastle</groupId>
          <artifactId>bcprov-jdk15on</artifactId>
        </exclusion>
    </exclusions>
 </dependency>

Pi

in my case only bcprov-jdk15on-1.47.jar was resolved problem – Lavinia

I was facing this issue with tomcat 9 and only in debug mode. It was working fine when tomcat started in run mode. The fix suggested here worked for me as well. – Prudery

I'm facing exactly the same symptoms/error message. How/where did you find out about those two jars bcprov-jdk15on-1.47.jar and bcprov-jdk16-1.45.jar? How exactly did you "exclude" the unwanted jar(bcprov-jdk16-1.45.jar), please? – Heine

Why why does this occur? the same happened to me, I was using a version of an internal library and this library used a version of bcprov. I upgraded to another library that used a more up-to-date version, but the old bcprov was still there. Is there any option in maven to remove unused libraries or should this always be done by hand? – Samaritan

@Samaritan Yes, if the root dependency includes it as transitive dependency then it should be excluded manually. You can read about maven dependency scopes here. maven.apache.org/guides/introduction/… – Pi

Answer 2

You have a cyclic dependency. org.bouncycastle.asn1.ASN1EncodableVector depends on org.bouncycastle.asn1.DEREncodableVector which depends back on org.bouncycastle.asn1.ASN1EncodableVector which ... . This is an infinite cycle and so you're getting a StackOverflowException.

If you have the Maven plugin installed in Eclipse, look at the Dependency Hierarchy and look for these classes. I found someone with a similar issue here, he solved it by looking at the dependency tree and then adding an exclusion to break the cyclic dependency.

Dierolf

Thanks for your response. The dependency tree looks quite normal for those libraries (I can't recognize any cyclic dependency): \- org.apache.activemq:activemq-all:jar:5.8.0:compile \- org.apache.activemq:activemq-amqp:jar:5.8.0:compile \- org.apache.qpid:proton-jms:jar:0.3.0-fuse-2:compile \- org.apache.qpid:proton:jar:0.3.0-fuse-2:compile \- org.bouncycastle:bcpkix-jdk15on:jar:1.47:compile \- org.bouncycastle:bcprov-jdk15on:jar:1.47:compile Should I try excluding the library from maven using the pom? Or only from deployment? – Proteiform

I see you have two org.bouncycastle* dependencies. Can you check if one of them depends on the other? Try to remove one of them and see if your code still works. If one of them depends on the other, it will probably download the other by itself. – Dierolf

The problem is that those are only indirect dependencies, i.e. they are required by a required project which I can not change. Thus, I added group "org.bouncycastle" / artifact "bcprov-jdk16" to the "exclusions" list of this dependency in my pom file. Still no luck, however. – Proteiform

Answer 3

I just encountered this problem. Others already give the answer to this problem. I would say something else.

I guess that you are using maven-shade-plugin or something alike that packaging all dependencies into an Uber jar, right?

You can see from grepcode that bcprov-jdk15on:1.52 defines DEREncodableVector as

public class DEREncodableVector extends ASN1EncodableVector

While bcprov-jdk14:1.38 defines ASN1EncodableVector as

public class ASN1EncodableVector extends DEREncodableVector

And with maven-shade-plugin, it would randomly choose a class when two or more same classes exist. And when it chooses this combination, cyclic dependency happens. If it choose other combinations, your application may work fine. It matches what you described

Yet, most of the times, it doesn't work.

It's a probabilistic event.

Fideicommissary

Note that this condition can arise too by depending on pdfbox-app which bundles its own Bouncy Castle version. – Nest

also selenium-server-standalone has it's own ASN1EncodableVectore.class – Maryjomaryl

I confirm, it happens to me randomly for this reason – Jailhouse

Answer 4

I also had the same issue in my spring boot project. To find out the conflicting dependencies I issues this command from my project directory:

mvn dependency:tree -Dverbose -Dincludes=org.bouncycastle

From the output following information was found:

[INFO] +- org.springframework.cloud:spring-cloud-starter-openfeign:jar:2.1.0.RC3:compile
[INFO] |  \- org.springframework.cloud:spring-cloud-starter:jar:2.1.0.RC2:compile
[INFO] |     \- org.springframework.security:spring-security-rsa:jar:1.0.7.RELEASE:compile
[INFO] |        \- org.bouncycastle:bcpkix-jdk15on:jar:1.60:compile
[INFO] |           \- org.bouncycastle:bcprov-jdk15on:jar:1.60:compile
[INFO] \- com.cybersource:cybersource-rest-client-java:jar:0.0.16:compile
[INFO]    \- com.cybersource:AuthenticationSdk:jar:0.0.8:compile
[INFO]       \- org.bouncycastle:bcprov-jdk16:jar:1.45:compile

Here we can see that openfeign and cybersource-rest-client are using different versions of bcprov-jdk package. As cybersource-rest-client have the updated version of this package, I excluded this dependency from openfeign in pom.xml like this:

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-openfeign</artifactId>
    <exclusions>
        <exclusion>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
        </exclusion>
    </exclusions>
</dependency>

This helped me solve this issue for me.

Calcification

Answer 5

This was happening to me using

        <groupId>org.bouncycastle</groupId>
        <artifactId>bcpkix-jdk15on</artifactId>
        <version>1.54</version>

I upgraded that to

        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-jdk16</artifactId>
        <version>1.46</version>

and that seems to have fixed it

Chausses

Answer 6

I have this error in tomcat 8 and jdk 1.8

04-Apr-2018 16:35:06.358 SEVERE [localhost-startStop-1] org.apache.catalina.core.ContainerBase.addChildInternal ContainerBase.addChild: start: 
 org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/myapp]]
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
    at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:752)
    at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:728)
    at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
    at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1141)
    at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1875)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.IllegalStateException: Unable to complete the scan for annotations for web application [/myapp] due to a StackOverflowError. Possible root causes include a too low setting for -Xss and illegal cyclic inheritance dependencies. The class hierarchy being processed was [org.bouncycastle.asn1.ASN1EncodableVector->org.bouncycastle.asn1.DEREncodableVector->org.bouncycastle.asn1.ASN1EncodableVector]
    at org.apache.catalina.startup.ContextConfig.checkHandlesTypes(ContextConfig.java:2110)
    at org.apache.catalina.startup.ContextConfig.processAnnotationsStream(ContextConfig.java:2054)
    at org.apache.catalina.startup.ContextConfig.processAnnotationsJar(ContextConfig.java:2000)
    at org.apache.catalina.startup.ContextConfig.processAnnotationsUrl(ContextConfig.java:1970)
    at org.apache.catalina.startup.ContextConfig.processAnnotations(ContextConfig.java:1923)
    at org.apache.catalina.startup.ContextConfig.webConfig(ContextConfig.java:1163)
    at org.apache.catalina.startup.ContextConfig.configureStart(ContextConfig.java:775)
    at org.apache.catalina.startup.ContextConfig.lifecycleEvent(ContextConfig.java:299)
    at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:94)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5105)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
    ... 10 more

04-Apr-2018 16:35:06.359 SEVERE [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Error deploying web application directory [/usr/apache-tomcat-8.5.24.Core/webapps/myapp]
 java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/myapp]]
    at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:756)
    at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:728)
    at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
    at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1141)
    at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1875)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

And I found two jar with name bcprov-jdk*.jar in my app lib. I removed all of those and use bcprov-jdk15on-1.52.jar. In this way, my problem was solved.

Roturier

Answer 7

I had the same problem and fixed it finally . Go to your pom and search for bouncycastle You should see more than one exclude one of them and it should fix it

Diaspore

Answer 8

Also double check your lib folder under Tomcat to make sure the duplicate dependency is not present there.

Aboral

Answer 9

I had the same issue I remove every trace of bouncycastle library in the buildConfig file. No trace in dependecy or excludes. Just add the plug in crypto.2.0 and everything works fine!

Borecole

Answer 10

If it is already excluded in the build config and error still exist, you can try to clean your project's working directory before building.

maven clean

-

grails clean

Blakeney

Answer 11

I had the same problem but with a different solution. My conflict was with bcprov-jdk15on-1.55.jar and tika-app-1.7.jar. Apparently tika includes bouncy castle, and in this case the older version of bouncy castle that causes the conflict.

Nexus

Answer 12

Doing mvn clean in jenkins workspace folder (where my project runs) and doing a Jenkins build (that deletes the old war file) worked for me.

Joejoeann