Titanium JIRA Archive
Titanium SDK/CLI (TIMOB)

[TIMOB-25599] Android: V8 crash can occur when attempting to move weak Java ref to strong

GitHub Issuen/a
TypeBug
PriorityHigh
StatusClosed
ResolutionFixed
Resolution Date2018-02-24T01:39:26.000+0000
Affected Version/sRelease 7.0.0
Fix Version/sRelease 7.1.0
ComponentsAndroid
Labelsn/a
ReporterGary Mathews
AssigneeGary Mathews
Created2017-12-12T00:09:11.000+0000
Updated2018-03-06T23:24:20.000+0000

Description

This issue was found by [~jquick] whilst working on another issue. It appears there's an issue when a weak Java reference is GC'd before being moved to a strong reference. *TEST CASE* - Select a couple of large images - Repeatedly view each image until crash 

var window = Ti.UI.createWindow();
var tableView = Ti.UI.createTableView(
{
	width: Ti.UI.FILL,
	height: Ti.UI.FILL,
});
window.add(tableView);
var addButton = Ti.UI.createButton(
{
	title: "Add",
	left: "10dp",
	bottom: "10dp",
});
addButton.addEventListener("click", function(e) {
	var dialog = Ti.UI.createAlertDialog(
	{
		message: "Which media type do you want to open?",
		buttonNames: ["Photo", "Video", "Both"],
	});
	dialog.addEventListener("click", function(e) {
		var mediaTypes;
		if (e.index === 0) {
			mediaTypes = [Ti.Media.MEDIA_TYPE_PHOTO];
		} else if (e.index === 1) {
			mediaTypes = [Ti.Media.MEDIA_TYPE_VIDEO];
		} else if (e.index === 2) {
			mediaTypes = [Ti.Media.MEDIA_TYPE_PHOTO, Ti.Media.MEDIA_TYPE_VIDEO];
		} else {
			Ti.API.info("@@@ Alert was canceled.");
			return;
		}
		Ti.Media.openPhotoGallery(
		{
			allowMultiple: true,
			allowEditing: false,
			autohide: true,
			mediaTypes: mediaTypes,
			success: function(e) {
				Ti.API.info("@@@ success() e: " + JSON.stringify(e));
				var createRowFrom = function(selectionEvent) {
					if (!selectionEvent || !selectionEvent.media) {
						selectionEvent =
						{
							mediaType: "null",
							media:
							{
								file:
								{
									name: "null",
									nativePath: "null"
								},
							},
						};
					}
					var fileName = null;
					if (selectionEvent.media.file) {
						fileName = selectionEvent.media.file.name;
					}
					if (!fileName) {
						if (selectionEvent.mediaType === Ti.Media.MEDIA_TYPE_VIDEO) {
							fileName = "Unknown Video Name";
						} else {
							fileName = "Unknown Image Name";
						}
					}
					var row = Ti.UI.createTableViewRow({ title: fileName });
					row.addEventListener("click", function(e) {
						switch (selectionEvent.mediaType) {
							case Ti.Media.MEDIA_TYPE_PHOTO:
							case Ti.Media.MEDIA_TYPE_LIVEPHOTO:
								var childWindow = Ti.UI.createWindow();
								childWindow.add(Ti.UI.createImageView(
								{
									image: selectionEvent.media,
									width: Ti.UI.FILL,
									height: Ti.UI.FILL,
								}));
								childWindow.open();
								break;
							case Ti.Media.MEDIA_TYPE_VIDEO:
								var childWindow = Ti.UI.createWindow();
								childWindow.add(Ti.Media.createVideoPlayer(
								{
									url: selectionEvent.media.nativePath,
									autoplay: true,
									mediaControlStyle: Ti.Media.VIDEO_CONTROL_DEFAULT,
									scalingMode: Ti.Media.VIDEO_SCALING_ASPECT_FIT,
									width: Ti.UI.FILL,
									height: Ti.UI.FILL,
								}));
								childWindow.open();
								break;
							default:
								alert("Unknown media type selected.");
								break;
						}
					});
					return row;
				};
				if (e.images) {
					for (var index = 0; index < e.images.length; index++) {
						tableView.appendRow(createRowFrom(e.images[index]));
					}
				}
				if (e.videos) {
					for (var index = 0; index < e.videos.length; index++) {
						tableView.appendRow(createRowFrom(e.videos[index]));
					}
				}
			},
			cancel: function() {
				Ti.API.info("@@@ Photo gallery selection canceled.");
			},
			error: function() {
				Ti.API.info("@@@ Photo gallery selection error.");
			},
		});
	});
	dialog.show();
});
window.add(addButton);
var clearButton = Ti.UI.createButton(
{
	title: "Clear",
	right: "10dp",
	bottom: "10dp",
});
clearButton.addEventListener("click", function(e) {
	tableView.data = [];
});
window.add(clearButton);
window.open();

12-07 14:51:42.267  8482  8482 F libc    : Fatal signal 5 (SIGTRAP), code 1 in tid 8482 (lerator.testing)
12-07 14:51:42.322  8579  8579 I crash_dump64: obtaining output fd from tombstoned
12-07 14:51:42.322   745   745 I /system/bin/tombstoned: received crash request for pid 8482
12-07 14:51:42.323  8579  8579 I crash_dump64: performing dump of process 8482 (target tid = 8482)
12-07 14:51:42.323  8579  8579 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
12-07 14:51:42.324  8579  8579 F DEBUG   : Build fingerprint: 'google/marlin/marlin:8.0.0/OPR6.170623.012/4283428:user/release-keys'
12-07 14:51:42.324  8579  8579 F DEBUG   : Revision: '0'
12-07 14:51:42.324  8579  8579 F DEBUG   : ABI: 'arm64'
12-07 14:51:42.324  8579  8579 F DEBUG   : pid: 8482, tid: 8482, name: lerator.testing  >>> com.appcelerator.testing <<<
12-07 14:51:42.324  8579  8579 F DEBUG   : signal 5 (SIGTRAP), code 1 (TRAP_BRKPT), fault addr 0x78b2b4d898
12-07 14:51:42.324  8579  8579 F DEBUG   :     x0   0000000000000001  x1   0000000000000000  x2   0000000000000000  x3   000000000000000c
12-07 14:51:42.324  8579  8579 F DEBUG   :     x4   000000000000007e  x5   000000788ed0e0f1  x6   000000000000000a  x7   000000000000000a
12-07 14:51:42.324  8579  8579 F DEBUG   :     x8   0000000000000000  x9   0000000000000001  x10  0000000000004001  x11  0000000000000000
12-07 14:51:42.324  8579  8579 F DEBUG   :     x12  00000078cd9319b8  x13  0a38353136373532  x14  00000078cd931d14  x15  0000000000000000
12-07 14:51:42.324  8579  8579 F DEBUG   :     x16  00000078cd94f2c0  x17  00000078cd8eed1c  x18  000000001300a780  x19  00000078b2e58000
12-07 14:51:42.324  8579  8579 F DEBUG   :     x20  00000078cd951658  x21  00000078b2bc66a8  x22  00000078b2c1be80  x23  00000078bc7022c8
12-07 14:51:42.324  8579  8579 F DEBUG   :     x24  00000000000000a9  x25  0000000000000003  x26  00000078bc7022b0  x27  00000078bc7022a0
12-07 14:51:42.324  8579  8579 F DEBUG   :     x28  0000007ff2d48bcf  x29  0000007ff2d48ab0  x30  00000078b2b4aff8
12-07 14:51:42.324  8579  8579 F DEBUG   :     sp   0000007ff2d48960  pc   00000078b2b4d898  pstate 0000000080000000
12-07 14:51:42.334  8579  8579 F DEBUG   : 
12-07 14:51:42.334  8579  8579 F DEBUG   : backtrace:
12-07 14:51:42.334  8579  8579 F DEBUG   :     #00 pc 0000000000d56898  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN2v84base2OS5AbortEv+20)
12-07 14:51:42.334  8579  8579 F DEBUG   :     #01 pc 0000000000d53ff4  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_Z8V8_FatalPKciS0_z+232)
12-07 14:51:42.334  8579  8579 F DEBUG   :     #02 pc 00000000009e4e7c  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN2v88internal13GlobalHandles8MakeWeakEPPNS0_6ObjectEPvPFvRKNS_16WeakCallbackInfoIvEEENS_16WeakCallbackTypeE+224)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #03 pc 00000000004580b0  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium10JavaObject10MakeJSWeakEv+36)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #04 pc 0000000000458274  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium10JavaObject13getJavaObjectEv+116)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #05 pc 0000000000461318  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium13TypeConverter19jsValueToJavaObjectEPN2v87IsolateEP7_JNIEnvNS1_5LocalINS1_5ValueEEEPb+640)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #06 pc 00000000004614a0  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium13TypeConverter19jsValueToJavaObjectEPN2v87IsolateEP7_JNIEnvNS1_5LocalINS1_5ValueEEEPb+1032)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #07 pc 00000000004618f0  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium13TypeConverter29jsObjectIndexPropsToJavaArrayEPN2v87IsolateEP7_JNIEnvNS1_5LocalINS1_6ObjectEEEii+164)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #08 pc 000000000045e14c  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium12ProxyFactory15createJavaProxyEP7_jclassN2v85LocalINS3_6ObjectEEERKNS3_20FunctionCallbackInfoINS3_5ValueEEE+680)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #09 pc 000000000045daac  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN8titanium5Proxy16proxyConstructorERKN2v820FunctionCallbackInfoINS1_5ValueEEE+1612)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #10 pc 000000000072ac48  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN2v88internal25FunctionCallbackArguments4CallEPFvRKNS_20FunctionCallbackInfoINS_5ValueEEEE+188)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #11 pc 000000000077e224  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so
12-07 14:51:42.335  8579  8579 F DEBUG   :     #12 pc 000000000077f154  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so
12-07 14:51:42.335  8579  8579 F DEBUG   :     #13 pc 000000000077f40c  /data/app/com.appcelerator.testing-L5fqJNWjxitzyiZdU8-UPg==/lib/arm64/libkroll-v8.so (_ZN2v88internal21Builtin_HandleApiCallEiPPNS0_6ObjectEPNS0_7IsolateE+28)
12-07 14:51:42.335  8579  8579 F DEBUG   :     #14 pc 00000000000000e4  <anonymous:0000007891e84000>
12-07 14:51:42.968   745   745 E /system/bin/tombstoned: Tombstone written to: /data/tombstones//tombstone_07
12-07 14:51:42.972   909   976 I BootReceiver: Copying /data/tombstones/tombstone_07 to DropBox (SYSTEM_TOMBSTONE)
12-07 14:51:42.972   909  8580 W ActivityManager:   Force finishing activity com.appcelerator.testing/org.appcelerator.titanium.TiActivity
12-07 14:51:42.979   909   954 I ActivityManager: Showing crash dialog for package com.appcelerator.testing u0
12-07 14:51:42.992   909  1157 W InputDispatcher: channel '9e40254 com.appcelerator.testing/com.appcelerator.testing.ClassicapptestActivity (server)' ~ Consumer closed input channel or an error occurred.  events=0x9
12-07 14:51:42.992   909  1157 E InputDispatcher: channel '9e40254 com.appcelerator.testing/com.appcelerator.testing.ClassicapptestActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
12-07 14:51:42.992   909  1157 W InputDispatcher: channel '1a8efc0 com.appcelerator.testing/org.appcelerator.titanium.TiActivity (server)' ~ Consumer closed input channel or an error occurred.  events=0x9
12-07 14:51:42.992   909  1157 E InputDispatcher: channel '1a8efc0 com.appcelerator.testing/org.appcelerator.titanium.TiActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
12-07 14:51:42.993   909  3696 I ActivityManager: Process com.appcelerator.testing (pid 8482) has died: fore TOP 
12-07 14:51:42.995   909  1579 I WindowManager: WIN DEATH: Window{1a8efc0 u0 com.appcelerator.testing/org.appcelerator.titanium.TiActivity}
12-07 14:51:42.995   909  1579 W InputDispatcher: Attempted to unregister already unregistered input channel '1a8efc0 com.appcelerator.testing/org.appcelerator.titanium.TiActivity (server)'
12-07 14:51:42.997   909  3698 I WindowManager: WIN DEATH: Window{9e40254 u0 com.appcelerator.testing/com.appcelerator.testing.ClassicapptestActivity}

Comments

  1. Gary Mathews 2018-01-08

    master: https://github.com/appcelerator/titanium_mobile/pull/9675
  2. Gary Mathews 2018-01-08

    7_0_X: https://github.com/appcelerator/titanium_mobile/pull/9705
  3. Gary Mathews 2018-02-15

    7_1_X: https://github.com/appcelerator/titanium_mobile/pull/9829
  4. Lokesh Choudhary 2018-02-24

  5. Lokesh Choudhary 2018-03-06

    Verified the fix in SDK 7.2.0.v20180305152636 & 7.1.0.v20180306061214. Closing. Studio Ver: 5.0.0.201712081732 OS Ver: 10.13.2 Xcode Ver: Xcode 9.2 Appc NPM: 4.2.12 Appc CLI: 7.0.2 Daemon Ver: 1.0.1 Ti CLI Ver: 5.0.14 Alloy Ver: 1.11.0 Node Ver: 8.9.1 NPM Ver: 5.5.1 Java Ver: 1.8.0_101 Devices: ⇨ google Nexus 5 — Android 6.0.1 ⇨ google Nexus 6P — Android 8.0.0

JSON Source