Crash in arm x64

[DanielZlotin]

Running on a custom compiled react-native based on 0.51.0 version for x64 Android.

Once the bundle is loaded about 50% of times crashes with:

                  libc  F  Fatal signal 11 (SIGSEGV), code 1, fault addr 0x100000008 in tid 2215 (mqt_js), pid 2168 (wix.android.dev)
                  DEBUG  F  *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
                         F  Build fingerprint: 
                         F  Revision: '0'
                         F  ABI: 'arm64'
                         F  pid: 2168, tid: 2215, name: mqt_js  >>> com.wix.android.dev <<<
                         F  signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x100000008
                         F      x0   0000007c6789c0a0  x1   0000007c68000000  x2   0000007c678cb258  x3   0000007c6caf7ee8
                         F      x4   0000000000000000  x5   0000000000000000  x6   0000000000000000  x7   0000000000000000
                         F      x8   0000000000000530  x9   0000000000000006  x10  0000000100000000  x11  0000000000000001
                         F      x12  00000000cf1841c8  x13  0000000000000005  x14  000000000000007c  x15  0000000000000001
                         F      x16  0000000003010069  x17  0000000000000000  x18  0000000000000002  x19  0000007c6caf7ee8
                         F      x20  0000007c68000000  x21  0000000000000000  x22  0000007c6789c0a0  x23  000000000301006a
                         F      x24  000000000000007c  x25  00000000cf1841c9  x26  0000000300000000  x27  0000007c61c27008
                         F      x28  0000000000000002  x29  0000007c6caf8480  x30  0000007c6db57938
                         F      sp   0000007c6caf7d80  pc   0000007c6db83294  pstate 0000000020000000
                         F  backtrace:
                         F  #00 pc 0000000000102294  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so
                         F  #01 pc 00000000000d6934  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so
                         F  #02 pc 00000000004e4474  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so
                         F  #03 pc 00000000004e4890  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so
                         F  #04 pc 00000000001d2fe4  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so
                         F  #05 pc 00000000003ac8bc  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so
                         F  #06 pc 000000000006601c  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libjsc.so (JSEvaluateScript+480)
                         F  #07 pc 0000000000071f84  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so (facebook::react::evaluateScript(OpaqueJSContext const*, OpaqueJS
                            String*, OpaqueJSString*)+56)
                         F  #08 pc 0000000000063a58  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so (facebook::react::JSCExecutor::loadApplicationScript(std::__ndk1:
                            :unique_ptr<facebook::react::JSBigString const, std::__ndk1::default_delete<facebook::react::JSBigString const>>, std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>
                            , std::__ndk1::allocator<char>>)+632)
                         F  #09 pc 000000000006dd00  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so
                         F  #10 pc 000000000006eea0  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so
                         F  #11 pc 0000000000034368  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so
                         F  #12 pc 00000000000216cc  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so
                         F  #13 pc 0000000000021648  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/lib/arm64/libreactnativejni.so
                         F  #14 pc 000000000003fa9c  /data/app/com.wix.android.dev-mImsHlIhdjuBhFAgfqjh4g==/oat/arm64/base.odex (offset 0x39000)

I can't seem to reproduce it in our measure app, just in the Wix app (which is very big)

[DanielZlotin]

I reproduced it in the measure app. When running the benchmarks over and over again, once in about 20 runs I'm getting:

libc  F  Fatal signal 11 (SIGSEGV), code 1, fault addr 0xbbadbeef in tid 5920 (mqt_js), pid 5892 (ptcore.profiler)
                  DEBUG  F  *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
                         F  Build fingerprint: 'google/marlin/marlin:8.1.0/OPM4.171019.021.P1/4820305:user/release-keys'
                         F  Revision: '0'
                         F  ABI: 'arm64'
                         F  pid: 5892, tid: 5920, name: mqt_js  >>> com.javascriptcore.profiler <<<
                         F  signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xbbadbeef
                         F      x0   0000007c6dcf80b8  x1   0000007c6dcf80b8  x2   0000000000000000  x3   0000007c6dcf71f8
                         F      x4   0000007c6efd9707  x5   0000007c6dcf79c1  x6   000000000000000a  x7   000000000000000a
                         F      x8   00000000bbadbeef  x9   0000007c6efd9b56  x10  0000000000004001  x11  0000000000000000
                         F      x12  0000007d06d0abe0  x13  0000000000000001  x14  0000000000000000  x15  0000000000000000
                         F      x16  0000007d06d292c8  x17  0000007d06cc5a4c  x18  0000000000000000  x19  0000007c6dcf81c0
                         F      x20  0000007c6efd9706  x21  0000007c67c847a0  x22  0000007c660a6ad0  x23  0000007c67c84808
                         F      x24  0000007c66e6ab00  x25  0000007c6dcf8180  x26  0000000000000000  x27  0000000000000001
                         F      x28  ffff000000000002  x29  0000007c6dcf83c0  x30  0000007c6ef94530
                         F      sp   0000007c6dcf80f0  pc   0000007c6ef94538  pstate 00000000a0000000
                         F  backtrace:
                         F  #00 pc 0000000000593538  /data/app/com.javascriptcore.profiler-MUBWpSsr4k51nt8yrR_9hA==/lib/arm64/libjsc.so
                         F  #01 pc 0000000000504d88  /data/app/com.javascriptcore.profiler-MUBWpSsr4k51nt8yrR_9hA==/lib/arm64/libjsc.so
                         F  #02 pc 0000000000505500  /data/app/com.javascriptcore.profiler-MUBWpSsr4k51nt8yrR_9hA==/lib/arm64/libjsc.so
                         F  #03 pc 00000000005007f8  /data/app/com.javascriptcore.profiler-MUBWpSsr4k51nt8yrR_9hA==/lib/arm64/libjsc.so
                         F  #04 pc 0000000000211b24  /data/app/com.javascriptcore.profiler-MUBWpSsr4k51nt8yrR_9hA==/lib/arm64/libjsc.so
                         F  #05 pc 00000000000468fc  <anonymous:0000007c697ff000>

[DanielZlotin]

This branch has the custom RN and configured app:
https://github.com/react-community/jsc-android-buildscripts/tree/RN51x64

[DanielZlotin]

Confirmed does not reproduce in arm x32 devices.
Also able to reproduce it in any clean RN app, just happens very rarely.
The device I used to run the test app without crashes is a Samsung Galaxy S2 (an ancient device with very low memory), so that sort of eliminates any concerns for out of memory errors. (the x64 device is a PixelXL)

[DanielZlotin]

Interesting to note: lowering the size of the bundle (by commenting out imports) makes the crash happen more rarely. Greatly lowering the bundle size (like in a clean new RN project) makes the crash onLoad about 1-5% of app starts.

[mrueger42]

Another possible factor could be differences between Android 7 and 8. Unfortunately I only have arm32 devices on 7 and arm64 on 8, so no cross validation. IIRC Android introduced different garbage collection algorithms and I wonder if this causes race conditions between Java and Javascript.
Another scenario for provoking a crash is creating large numbers of strings from Java into Javascript via JNI (using code based on https://github.com/ericwlange/AndroidJSCore), mainly stable on arm32/7, crashes reproducibly on arm64/8.

[DanielZlotin]

@mrueger42 Correct me if I'm wrong but I don't see how it relates to the Java GC. They don't share address space.

2 things I want to try:

• compile the same version of webkit as used in iOS 11.x (proved to be stable) - 2.19.2
• compile with symbols to better understand the cause of the crash

[Kmakinator]

@DanielZlotin
I was building JSC with debug symbols using this patch https://gist.github.com/Kmakinator/9c6d23ab6c07b200ba9cf133fe5cbbba
It's month old now so it may not work on current master, it is also required to add doNotStrip not only to air building gradle but apk script. This allowed me to attach and set breakpoint using LLDB in android studio.

[mrueger42]

@DanielZlotin
Not sure about Java GC, it is just a hunch.
Also quite a bit out of my depth looking at the WebKit code base.

But, having said that, there is a lot of low level memory stuff going on in the context of strings. Java GC deciding to throw away something, WebKit code thinking it is still there, voila, null pointer exception.
Apologies for not being of much help on a technical level here.
A test on a non-arm64 device with Android 8 would help to prove/disprove that hunch.
And, thank you for maintaining this library btw!

[DanielZlotin]

Finding a phone with armv7a and android 8 is harder than I thought 😆

[pmlocek]

Hi, I've built JSC with debug symbols, and that's what I've got (Android 8.0):

Stack frame #00 pc 000000000076fed0  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (WTFCrash+48): Routine WTFCrash at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/Assertions.cpp:278
Stack frame #01 pc 000000000053d3b0  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZNK3WTF22HashTableConstIteratorINS_6RefPtrINS_17UniquedStringImplEEENS_12KeyValue: Routine WTF::HashTableConstIterator<WTF::RefPtr<WTF::UniquedStringImpl>, WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> >, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> > >::checkValidity() const at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/HashTable.h:212
Stack frame #02 pc 000000000053d308  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF22HashTableConstIteratorINS_6RefPtrINS_17UniquedStringImplEEENS_12KeyValueP: Routine WTF::HashTableConstIterator<WTF::RefPtr<WTF::UniquedStringImpl>, WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> >, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> > >::operator++() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/HashTable.h:179
Stack frame #03 pc 000000000053d2d8  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF17HashTableIteratorINS_6RefPtrINS_17UniquedStringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_12InferredTypeEEEEENS_24KeyValuePairKeyExtractorIS9_EENS5_17IdentifierRepHashENS_7HashMapIS3_S8_SC_NS_10HashTraitsIS3_EENSE_IS8_EEE18KeyValuePairTraitsESF_EppEv+20): Routine WTF::HashTableIterator<WTF::RefPtr<WTF::UniquedStringImpl>, WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> >, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> > >::operator++() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/HashTable.h:265
Stack frame #04 pc 000000000053b72c  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF24HashTableIteratorAdapterINS_9HashTableINS_6RefPtrINS_17UniquedStringImplEEENS_12KeyValuePairIS4_N3JSC12WriteBarrierINS6_12InferredTypeEEEEENS_24KeyValuePairKeyExtractorISA_EENS6_17IdentifierRepHashENS_7HashMapIS4_S9_SD_NS_10HashTraitsIS4_EENSF_IS9_EEE18KeyValuePairTraitsESG_EESA_EppEv+28): Routine WTF::HashTableIteratorAdapter<WTF::HashTable<WTF::RefPtr<WTF::UniquedStringImpl>, WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> >, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl> > >, WTF::KeyValuePair<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType> > >::operator++() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/HashIterators.h:74
Stack frame #05 pc 000000000053b308  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3JSC17InferredTypeTable13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE+240): Routine JSC::InferredTypeTable::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/JavaScriptCore/runtime/InferredTypeTable.cpp:59
Stack frame #06 pc 00000000002a8eac  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3JSC11SlotVisitor13visitChildrenEPKNS_6JSCellE+292): Routine JSC::SlotVisitor::visitChildren(JSC::JSCell const*) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/JavaScriptCore/heap/SlotVisitor.cpp:385
Stack frame #07 pc 00000000002aea8c  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZZN3JSC11SlotVisitor5drainEN3WTF13MonotonicTimeEENK3$_3clERNS_14MarkStackArrayE+188): Routine operator() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/JavaScriptCore/heap/SlotVisitor.cpp:484
Stack frame #08 pc 00000000002a936c  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3JSC11SlotVisitor16forEachMarkStackIZNS0_5drainEN3WTF13MonotonicTimeEE3$_3EENS_15IterationStatusERKT_+36): Routine JSC::IterationStatus JSC::SlotVisitor::forEachMarkStack<JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3>(JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3 const&) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/JavaScriptCore/heap/SlotVisitorInlines.h:173
Stack frame #09 pc 00000000002a92d8  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3JSC11SlotVisitor5drainEN3WTF13MonotonicTimeE+164): Routine JSC::SlotVisitor::drain(WTF::MonotonicTime) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/JavaScriptCore/heap/SlotVisitor.cpp:474
Stack frame #10 pc 00000000002a9c5c  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3JSC11SlotVisitor15drainFromSharedENS0_15SharedDrainModeEN3WTF13MonotonicTimeE+840): Routine JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/JavaScriptCore/heap/SlotVisitor.cpp:653
Stack frame #11 pc 0000000000278164  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZZN3JSC4Heap13runBeginPhaseENS_11GCConductorEENK4$_10clEv+664): Routine operator() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/JavaScriptCore/heap/Heap.cpp:1223
Stack frame #12 pc 0000000000277ebc  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF17SharedTaskFunctorIFvvEZN3JSC4Heap13runBeginPhaseENS2_11GCConductorEE4$_10E3runEv+20): Routine WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_10>::run() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/SharedTask.h:90
Stack frame #13 pc 0000000000783be4  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF20ParallelHelperClient7runTaskENS_6RefPtrINS_10SharedTaskIFvvEEEEE+148): Routine WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()> >) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/ParallelHelperPool.cpp:112
Stack frame #14 pc 0000000000784754  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF18ParallelHelperPool6Thread4workEv+52): Routine WTF::ParallelHelperPool::Thread::work() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/ParallelHelperPool.cpp:194
Stack frame #15 pc 0000000000772110  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZZN3WTF15AutomaticThread5startERKNS_14AbstractLockerEENK3$_0clEv+548): Routine operator() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/AutomaticThread.cpp:222
Stack frame #16 pc 0000000000771e54  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF8FunctionIFvvEE15CallableWrapperIZNS_15AutomaticThread5startERKNS_14AbstractLockerEE3$_0E4callEv+20): Routine WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/Function.h:101
Stack frame #17 pc 0000000000779d50  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZNK3WTF8FunctionIFvvEEclEv+140): Routine WTF::Function<void ()>::operator()() const at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Debug/../../Source/WTF/wtf/Function.h:56
Stack frame #18 pc 000000000078ff70  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTF6Thread10entryPointEPNS0_16NewThreadContextE+312): Routine WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/Threading.cpp:129
Stack frame #19 pc 00000000007b8048  /data/app/com.javascriptcore.profiler-TDTbnfycx4q0a_uzxFtyKw==/lib/arm64/libjsc.so (_ZN3WTFL19wtfThreadEntryPointEPv+16): Routine WTF::wtfThreadEntryPoint(void*) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/ThreadingPthreads.cpp:228
Stack frame #20 pc 00000000000667d0  /system/lib64/libc.so (_ZL15__pthread_startPv+36)
Stack frame #21 pc 000000000001f2a4  /system/lib64/libc.so (__start_thread+68)

[pmlocek]

After some digging, it looks like some kind of race condition: some iterators get invalidated while they're being used. Looking further, we have ENABLE_DFG_JIT=0, which (according to Platform.h) makes ENABLE_CONCURRENT_JS=0, which in turn makes everything use dymmy NoLock implementation for locking. We still have no idea why JSC without DFG would require locking, but after patching Platform.h to set ENABLE_CONCURRENT_JS=1 for all 64bit builds apparently fixes the crash. We also are not sure why 32bit build is fine and 64bit has this crash, however there are some JIT-specific files that have significant amount of code depend on architecture.

I'll submit a pull request after I do some more tests. So far after ~100 runs no crashes.
Edit: release build crashes still.

[pmlocek]

After adding debug symbols to release build, I get this stacktrace for the crash:

********** Crash dump: **********
Build fingerprint: 'Sony/G8441/G8441:8.0.0/47.1.A.12.270/1908755578:user/release-keys'
pid: 1999, tid: 2027, name: mqt_js  >>> com.javascriptcore.profiler <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xbbadbeef
Stack frame #00 pc 00000000004fb3dc  /data/app/com.javascriptcore.profiler-BdcsWroJ55AherG3x0OehQ==/lib/arm64/libjsc.so (WTFCrash+32): Routine WTFCrash at /home/pm/git/jsc-android-buildscripts/build/target/webkit/Source/WTF/wtf/Assertions.cpp:278
Stack frame #01 pc 00000000004ae37c  /data/app/com.javascriptcore.profiler-BdcsWroJ55AherG3x0OehQ==/lib/arm64/libjsc.so (_ZL24UNREACHABLE_FOR_PLATFORMv+4): Routine UNREACHABLE_FOR_PLATFORM() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Release/../../Source/WTF/wtf/Assertions.h:473
Stack frame #02 pc 00000000004aeaf4  /data/app/com.javascriptcore.profiler-BdcsWroJ55AherG3x0OehQ==/lib/arm64/libjsc.so (_ZZNK3JSC9Structure22checkOffsetConsistencyIZNS0_24materializePropertyTableERNS_2V: Routine operator() at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Release/../../Source/JavaScriptCore/runtime/StructureInlines.h:270
Stack frame #03 pc 00000000004a9fcc  /data/app/com.javascriptcore.profiler-BdcsWroJ55AherG3x0OehQ==/lib/arm64/libjsc.so (_ZN3JSC9Structure24materializePropertyTableERNS_2VMEb+1020): Routine bool JSC::Structure::checkOffsetConsistency<JSC::Structure::materializePropertyTable(JSC::VM&, bool)::$_0>(JSC::PropertyTable*, JSC::Structure::materializePropertyTable(JSC::VM&, bool)::$_0 const&) const at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Release/../../Source/JavaScriptCore/runtime/StructureInlines.h:274
Stack frame #04 pc 00000000001eb664  /data/app/com.javascriptcore.profiler-BdcsWroJ55AherG3x0OehQ==/lib/arm64/libjsc.so (operationGetById+472): Routine JSC::Structure::ensurePropertyTableIfNotEmpty(JSC::VM&) at /home/pm/git/jsc-android-buildscripts/build/target/webkit/WebKitBuild/Release/../../Source/JavaScriptCore/runtime/Structure.h:677
Stack frame #05 pc 00000000000458e0  <anonymous:000000709a1ff000>

[DanielZlotin]

Great work @pmlocek thank you.
Is this the same crash? doesn't look like it...

[pmlocek]

Another update: I've disabled concurrent GC and it seems to be stable again. I'll also try disabling concurrent JIT, as it might have less impact than disabling concurrent GC.

[kmagiera]

@DanielZlotin Note that the options we now are trying to disable (concurrentGC and concurrentJIT) are OFF on 32bit builds and only configured to be ON by default on 64bit platforms.