Native Crash with RN - SIGSEGV - 245459.0.0

[cristianoccazinsp]

Bug

After upgrading some dependencies (and most importantly compile sdk from 28 to 29), I'm starting to get random SIGSEGV crashes from various android devices

The following is the stack trace of one of them:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)
JSC::AccessCase::propagateTransitions(JSC::SlotVisitor&) const

Samsung Galaxy Note9 (crownqltesq), Android 9
Report 1 of 1
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 0 >>> com.zinspector3 <<<

backtrace:
  #00  pc 00000000000f7748  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::AccessCase::propagateTransitions(JSC::SlotVisitor&) const+16)
  #01  pc 0000000000143fe8  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::PolymorphicAccess::propagateTransitions(JSC::SlotVisitor&) const+48)
  #02  pc 000000000012f0a8  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::CodeBlock::propagateTransitions(JSC::ConcurrentJSLocker const&, JSC::SlotVisitor&)+556)
  #03  pc 0000000000139484  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::ExecutableToCodeBlockEdge::runConstraint(JSC::ConcurrentJSLocker const&, JSC::VM&, JSC::SlotVisitor&)+40)
  #04  pc 000000000013900c  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::ExecutableToCodeBlockEdge::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)+1044)
  #05  pc 00000000001fb9c4  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const+324)
  #06  pc 00000000001f8e90  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::SlotVisitor::drain(WTF::MonotonicTime)+132)
  #07  pc 00000000001f96bc  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime)+580)
  #08  pc 00000000001e41a0  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_17>::run()+580)
  #09  pc 00000000006171ec  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()>, WTF::DumbPtrTraits<WTF::DumbPtrTraits>> const&)+40)
  #10  pc 0000000000617950  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (WTF::ParallelHelperPool::Thread::work()+16)
  #11  pc 000000000060de7c  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call()+376)
  #12  pc 000000000061b084  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)+212)
  #13  pc 0000000000646dc8  /data/data/com.zinspector3/lib-0/libjsc.so (offset 0xbf000) (WTF::wtfThreadEntryPoint(void*)+4)
  #14  pc 0000000000083840  /system/lib64/libc.so (__pthread_start(void*)+36)
  #15  pc 0000000000023d80  /system/lib64/libc.so (__start_thread+68)

Environment info

React native info output:

System:
    OS: macOS Mojave 10.14.6
    CPU: (4) x64 Intel(R) Core(TM) i5-6267U CPU @ 2.90GHz
    Memory: 53.99 MB / 8.00 GB
    Shell: 3.2.57 - /bin/bash
  Binaries:
    Node: 10.15.3 - /usr/local/bin/node
    npm: 6.13.4 - /usr/local/bin/npm
    Watchman: 4.9.0 - /usr/local/bin/watchman
  SDKs:
    iOS SDK:
      Platforms: iOS 13.2, DriverKit 19.0, macOS 10.15, tvOS 13.2, watchOS 6.1
    Android SDK:
      API Levels: 28, 29
      Build Tools: 28.0.3, 29.0.2
  IDEs:
    Android Studio: 3.4 AI-183.6156.11.34.5522156
    Xcode: 11.2.1/11B53 - /usr/bin/xcodebuild
  npmPackages:
    react: 16.12.0 => 16.12.0 
    react-native: 0.61.5 => 0.61.5 
  npmGlobalPackages:
    create-react-native-app: 2.0.2
    create-react-native-module: 0.10.2
    react-native-cli: 2.0.1

Using the following build.gradle:

ext {
        buildToolsVersion = "29.0.2"
        minSdkVersion = 21
        compileSdkVersion = 29
        targetSdkVersion = 29
        supportLibVersion = "28.+"

        googlePlayServicesVisionVersion = "17.+"
        googlePlayServicesVersion = "17.+"
        firebaseVersion = "17.+"
    }

Library version: RN 0.61.5 default ("jsc-android": "^245459.0.0")

Steps To Reproduce

Unknown. Regular use, not related to any specific use case.

[cristianoccazinsp]

A few other crash logs from the other crash reporting tool. Not necessarily the same crash.

Samsung SM-N960U

SIGSEGV Segmentation violation (invalid memory reference) 
    /data/data/com.zinspector3/lib-0/libjsc.so:1013576 0x73eb17c748
    /data/data/com.zinspector3/lib-0/libjsc.so:1327084 0x73eb1c8fec
    /data/data/com.zinspector3/lib-0/libjsc.so:1241260 0x73eb1b40ac
    /data/data/com.zinspector3/lib-0/libjsc.so:1283208 0x73eb1be488
    /data/data/com.zinspector3/lib-0/libjsc.so:1282064 0x73eb1be010
    /data/data/com.zinspector3/lib-0/libjsc.so:2079176 0x73eb2809c8
    /data/data/com.zinspector3/lib-0/libjsc.so:2068116 0x73eb27de94
    /data/data/com.zinspector3/lib-0/libjsc.so:2070208 0x73eb27e6c0
    /data/data/com.zinspector3/lib-0/libjsc.so:1982884 0x73eb2691a4
    /data/data/com.zinspector3/lib-0/libjsc.so:6386160 0x73eb69c1f0
    /data/data/com.zinspector3/lib-0/libjsc.so:6388052 0x73eb69c954
    /data/data/com.zinspector3/lib-0/libjsc.so:6348416 0x73eb692e80
    /data/data/com.zinspector3/lib-0/libjsc.so:6402184 0x73eb6a0088
    /data/data/com.zinspector3/lib-0/libjsc.so:6581708 0x73eb6cbdcc
    /system/lib64/libc.so:538692 0x7485e43844
    /system/lib64/libc.so:146820 0x7485de3d84

OnePlus GM1917

SIGSEGV Segmentation violation (invalid memory reference) 
    /data/data/com.zinspector3/lib-0/libjsc.so:1013576 0x76188c1748
    /data/data/com.zinspector3/lib-0/libjsc.so:1327084 0x761890dfec
    /data/data/com.zinspector3/lib-0/libjsc.so:1241260 0x76188f90ac
    /data/data/com.zinspector3/lib-0/libjsc.so:1283208 0x7618903488
    /data/data/com.zinspector3/lib-0/libjsc.so:1282064 0x7618903010
    /data/data/com.zinspector3/lib-0/libjsc.so:2079176 0x76189c59c8
    /data/data/com.zinspector3/lib-0/libjsc.so:2068116 0x76189c2e94
    /data/data/com.zinspector3/lib-0/libjsc.so:2070208 0x76189c36c0
    /data/data/com.zinspector3/lib-0/libjsc.so:1982884 0x76189ae1a4
    /data/data/com.zinspector3/lib-0/libjsc.so:6386160 0x7618de11f0
    /data/data/com.zinspector3/lib-0/libjsc.so:6388052 0x7618de1954
    /data/data/com.zinspector3/lib-0/libjsc.so:6348416 0x7618dd7e80
    /data/data/com.zinspector3/lib-0/libjsc.so:6402184 0x7618de5088
    /data/data/com.zinspector3/lib-0/libjsc.so:6581708 0x7618e10dcc
    /apex/com.android.runtime/lib64/bionic/libc.so:879476 0x770ef25b74
    /apex/com.android.runtime/lib64/bionic/libc.so:478896 0x770eec3eb0
    unknown 0x0

Google Pixel 3 XL

SIGSEGV Segmentation violation (invalid memory reference) 
    /data/data/com.zinspector3/lib-0/libjsc.so:1013576 0x73ebfc0748
    /data/data/com.zinspector3/lib-0/libjsc.so:1327084 0x73ec00cfec
    /data/data/com.zinspector3/lib-0/libjsc.so:1241260 0x73ebff80ac
    /data/data/com.zinspector3/lib-0/libjsc.so:1283208 0x73ec002488
    /data/data/com.zinspector3/lib-0/libjsc.so:1282064 0x73ec002010
    /data/data/com.zinspector3/lib-0/libjsc.so:2079176 0x73ec0c49c8
    /data/data/com.zinspector3/lib-0/libjsc.so:2068116 0x73ec0c1e94
    /data/data/com.zinspector3/lib-0/libjsc.so:2070208 0x73ec0c26c0
    /data/data/com.zinspector3/lib-0/libjsc.so:1982884 0x73ec0ad1a4
    /data/data/com.zinspector3/lib-0/libjsc.so:6386160 0x73ec4e01f0
    /data/data/com.zinspector3/lib-0/libjsc.so:6388052 0x73ec4e0954
    /data/data/com.zinspector3/lib-0/libjsc.so:6348416 0x73ec4d6e80
    /data/data/com.zinspector3/lib-0/libjsc.so:6402184 0x73ec4e4088
    /data/data/com.zinspector3/lib-0/libjsc.so:6581708 0x73ec50fdcc
    /apex/com.android.runtime/lib64/bionic/libc.so:921860 0x74df6b3104
    /apex/com.android.runtime/lib64/bionic/libc.so:539316 0x74df655ab4
    unknown 0x0

[cristianoccazinsp]

Any ideas? If I'm right about this being an issue due to the SDK version being set to 29 (instead of 28), this will be an issue for a lot of people very shortly since RN will be upgrading to SDK 29 as well in the next major version.

Seems to be happening quite randomly, but it is definitely happening very often (with about ~800 devices).

[cristianoccazinsp]

For the record, there are also crashes with ARM64 builds:

[BenRPeloton]

I'm getting the exact same crashes and stacktraces on an arm64 build on Samsung SM-T830 but with API 28. Have you found anything else about this?

SIGSEGV Segmentation violation (invalid memory reference) 
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:1013576 0x758f36e748
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:1327084 0x758f3bafec
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:1241260 0x758f3a60ac
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:1283208 0x758f3b0488
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:1282064 0x758f3b0010
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:2079176 0x758f4729c8
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:2068116 0x758f46fe94
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:2070208 0x758f4706c0
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:1982884 0x758f45b1a4
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:6386160 0x758f88e1f0
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:6388052 0x758f88e954
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:6348416 0x758f884e80
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:6402184 0x758f892088
    /data/app/com.package.dev-QxLIBvGN9PztEl6jdpvMzA==/lib/arm64/libjsc.so:6581708 0x758f8bddcc
    /system/lib64/libc.so:596460 0x7632dae9ec
    /system/lib64/libc.so:147380 0x7632d40fb4
    unknown 0x0

[cristianoccazinsp]

I haven't, sadly. I keep seeing these crashes, but they seem to be very rare. Thought they were related to the SDK upgrade, but if you're seeing them as well now I don't know what's really going on. However, I definitely didn't see these crashes before with SDK 28.

[jgreen210]

In our app, we've seen a SEGV at libjsc.so:1013576 from at least Dec 28th 2019. It's affecting 0.2% of a large number of sessions, making it our most common crash.

That's an offset of 0xf7748 in hex. This is for org.webkit:android-jsc:r245459.

According to nm, it's in:

00000000000f7738 t _ZNK3JSC10AccessCase20propagateTransitionsERNS_11SlotVisitorE

...which is "JSC::AccessCase::propagateTransitions(JSC::SlotVisitor&) const" which is in the backtrace you've got in the issue description. I.e. there's a good chance the libjsc.so:1013576 crash is the same as the one in the issue description (although it's not completely certain unless decode more of the backtrace).

[jgreen210]

I found the symbol by converting the offset to hex and looking it up in:

nm android/app/build/intermediates/merged_native_libs/productRelease/out/lib/arm64-v8a/libjsc.so | sort | ${ANDROID_HOME}/ndk-bundle/toolchains/llvm/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-c++filt | less

[jgreen210]

Decoding some more of the backtrace:

1013576 JSC::AccessCase::propagateTransitions(JSC::SlotVisitor&) const
1327084 JSC::PolymorphicAccess::propagateTransitions(JSC::SlotVisitor&) const
.
.
1982884 WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_17>::run()
.
.
6581708 WTF::wtfThreadEntryPoint(void*)

...it's still matching up with what's in this issue's description.

[cristianoccazinsp]

I've seen 1327084 JSC::PolymorphicAccess::propagateTransitions(JSC::SlotVisitor&) const somwhere too. Any chance it is related to react-native-screens or react navigation?

[jgreen210]

This seems to propose a viable fix:

https://bugs.webkit.org/show_bug.cgi?id=200983

This mentions the problem too:

https://bugs.webkit.org/show_bug.cgi?id=202150

[jgreen210]

@Kudo and @kmagiera,

Do you know if there's any chance of react native accepting a new JavaScriptCore build? If so, would it be better to patch the existing WebKit version or move to a version that already has the fix.

I see that most development work has moved to hermes, but we can't use that yet since crashes from its fetch() memory leak cause more (and more serious) crashes than this SEGV.

[cristianoccazinsp]

@jgreen210 isn't it just a matter of upgrading the jsc-android package? React Native uses a version by default, but an updated one can always be installed with npm. We would need to get those updates into the official jsc-android package.

[jgreen210]

This unmerged Draft PR includes the relevant patch:

#124
fbe7e24
https://bugs.webkit.org/attachment.cgi?id=381338&action=prettypatch

[jgreen210]

The fix is also in this fork of this repo:

Kudo#1
https://twitter.com/kudochien/status/1207297218408927232

Published here:

https://github.com/Kudo/jsc-android-buildscripts/releases/tag/v250230.2.0
https://www.npmjs.com/package/@kudo-ci/jsc-android/v/250230.2.0

This explains why published from a fork:

Kudo#3

There was a follow up release fixing some other issue:

https://www.npmjs.com/package/@kudo-ci/jsc-android/v/250230.2.1
https://github.com/Kudo/jsc-android-buildscripts/releases/tag/v250230.2.1

You'll need a yarn/npm version that's new enough to support version aliases.