{"record":{"id":"a5fbba5c206f4de4","repo":"ruby-concurrency/concurrent-ruby","slug":"could-not-initialize-intrinsics","errorCode":null,"errorMessage":"Could not initialize intrinsics","messagePattern":"Could not initialize intrinsics","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"ext/concurrent-ruby/com/concurrent_ruby/ext/jsr166e/ConcurrentHashMapV8.java","lineNumber":3858,"sourceCode":"     *\n     * @return a sun.misc.Unsafe\n     */\n    private static sun.misc.Unsafe getUnsafe() {\n        try {\n            return sun.misc.Unsafe.getUnsafe();\n        } catch (SecurityException se) {\n            try {\n                return java.security.AccessController.doPrivileged\n                        (new java.security\n                                .PrivilegedExceptionAction<sun.misc.Unsafe>() {\n                            public sun.misc.Unsafe run() throws Exception {\n                                java.lang.reflect.Field f = sun.misc\n                                        .Unsafe.class.getDeclaredField(\"theUnsafe\");\n                                f.setAccessible(true);\n                                return (sun.misc.Unsafe) f.get(null);\n                            }});\n            } catch (java.security.PrivilegedActionException e) {\n                throw new RuntimeException(\"Could not initialize intrinsics\",\n                        e.getCause());\n            }\n        }\n    }\n}\n","sourceCodeStart":3840,"sourceCodeEnd":3864,"githubUrl":"https://github.com/ruby-concurrency/concurrent-ruby/blob/0b88d5ff75f69b3740c8f0868e76f833cb2fd45d/ext/concurrent-ruby/com/concurrent_ruby/ext/jsr166e/ConcurrentHashMapV8.java#L3840-L3864","documentation":"On first use, ConcurrentHashMapV8's static initializer reflects on sun.misc.Unsafe.theUnsafe (with setAccessible) to obtain memory-access intrinsics; if a SecurityManager denies it, it retries inside AccessController.doPrivileged. A PrivilegedActionException there is wrapped in RuntimeException(\"Could not initialize intrinsics\"), class initialization fails, and later uses of the class degrade to NoClassDefFoundError. This file is the JRuby/Java half of the concurrent-ruby gem, so the failure surfaces when the JRuby extension loads under restrictive runtimes.","triggerScenarios":"First touch of ConcurrentHashMapV8 (map construction, JRuby loading the concurrent-ruby Java extension) when: the SecurityManager policy grants neither ReflectPermission(\"suppressAccessChecks\") nor access to sun.misc.Unsafe.theUnsafe; the JVM's class library lacks sun.misc.Unsafe (Android/Dalvik, minimal runtimes); or an agent blocks setAccessible. The first failure surfaces as ExceptionInInitializerError wrapping this RuntimeException; subsequent touches throw NoClassDefFoundError.","commonSituations":"JRuby plus concurrent-ruby under a SecurityManager (sandboxed/embedded deployments, corporate policy files); nonstandard JVMs without sun.misc.Unsafe; environments where reflection-blocking agents were added. The gem ships a parallel nounsafe source tree (com.concurrent_ruby.ext.jsr166e.nounsafe) precisely to avoid this.","solutions":["Run on a standard JVM that ships sun.misc.Unsafe (HotSpot/OpenJDK/OpenJ9 — the normal JRuby target)","Grant what the initializer needs in the policy: permission java.lang.reflect.ReflectPermission \"suppressAccessChecks\"; (plus RuntimePermission \"accessDeclaredMembers\") for the extension jar's code base","Remove or relax the SecurityManager if it is not actually required","Use the bundled no-Unsafe build: the com.concurrent_ruby.ext.jsr166e.nounsafe.* sources avoid sun.misc.Unsafe entirely","If you maintain a fork, replace getUnsafe() with a VarHandle/atomic-field-updater fallback"],"exampleFix":"// before: class init fails under a SecurityManager without reflective access\n// -> RuntimeException: Could not initialize intrinsics (ExceptionInInitializerError)\n\n// after: grant the permission in the .policy file\n// grant codeBase \"file:<path-to-concurrent-ruby-ext>\" {\n//   permission java.lang.reflect.ReflectPermission \"suppressAccessChecks\";\n//   permission java.lang.RuntimePermission \"accessDeclaredMembers\";\n// };\n// or deploy the nounsafe variant shipped in com.concurrent_ruby.ext.jsr166e.nounsafe","handlingStrategy":"validation","validationCode":"static boolean unsafeAvailable() {\n    try {\n        java.lang.reflect.Field f = sun.misc.Unsafe.class.getDeclaredField(\"theUnsafe\");\n        f.setAccessible(true);\n        return f.get(null) != null;\n    } catch (Throwable t) {\n        return false;\n    }\n}\n// if (unsafeAvailable()) use the jsr166e classes; else fall back to\n// java.util.concurrent.ConcurrentHashMap or the nounsafe build","typeGuard":null,"tryCatchPattern":"try {\n    Object m = Class.forName(\"com.concurrent_ruby.ext.jsr166e.ConcurrentHashMapV8\").newInstance();\n} catch (ExceptionInInitializerError e) {\n    Throwable c = e.getCause();\n    if (c instanceof RuntimeException\n            && \"Could not initialize intrinsics\".equals(((RuntimeException) c).getMessage())) {\n        // fall back: platform ConcurrentHashMap or nounsafe build; restart if already loaded\n    } else {\n        throw e;\n    }\n}","preventionTips":["Verify the target JVM is a standard OpenJDK/HotSpot/OpenJ9 with sun.misc.Unsafe before deploying sandboxed","Add ReflectPermission \\\"suppressAccessChecks\\\" to the policy for the extension jar","Smoke-test the first map construction at startup, not mid-request","Remember the class is dead after the first failure (NoClassDefFoundError) — restart or switch to the nounsafe build"],"tags":["java","sun-misc-unsafe","security-manager","jvm","class-init","concurrent-ruby","jruby"],"backgroundTag":"sun-misc-unsafe-unavailable","analyzedSha":"0b88d5ff75f69b3740c8f0868e76f833cb2fd45d","analyzedAt":"2026-08-21T20:12:56.291Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}