[TIMOB-28534] Android: OutOfMemoryError in appcelerator.https (?)

GitHub Issue	n/a
Type	Bug
Priority	High
Status	Closed
Resolution	Invalid
Resolution Date	2021-09-21T15:36:27.000+0000
Affected Version/s	n/a
Fix Version/s	n/a
Components	Android
Labels	n/a
Reporter	Hans Knöchel
Assignee	Gary Mathews
Created	2021-09-14T10:12:29.000+0000
Updated	2021-09-21T15:36:27.000+0000

Description

We just noticed an error while starting up the Android Emulator that we never saw before:

[WARN]  W/com.appc.myapp: Throwing OutOfMemoryError "Failed to allocate a 16 byte allocation with 1653848 free bytes and 1615KB until OOM, target footprint 201326592, growth limit 201326592; giving up on allocation because <1% of heap free after GC." (VmSize 15919188 kB)
[ERROR] TiExceptionHandler: (main) [34332,78554] Failed to allocate a 16 byte allocation with 1653848 free bytes and 1615KB until OOM, target footprint 201326592, growth limit 201326592; giving up on allocation because <1% of heap free after GC.
[ERROR] TiExceptionHandler:
[ERROR] TiExceptionHandler:     sun.security.x509.X509CRLEntryImpl.parse(X509CRLEntryImpl.java:460)
[ERROR] TiExceptionHandler:     sun.security.x509.X509CRLEntryImpl.<init>(X509CRLEntryImpl.java:133)
[ERROR] TiExceptionHandler:     sun.security.x509.X509CRLImpl.parse(X509CRLImpl.java:1161)
[ERROR] TiExceptionHandler:     sun.security.x509.X509CRLImpl.<init>(X509CRLImpl.java:146)
[ERROR] TiExceptionHandler:     sun.security.provider.X509Factory.intern(X509Factory.java:206)
[ERROR] TiExceptionHandler:     sun.security.x509.X509CRLImpl.toImpl(X509CRLImpl.java:1235)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.AlgorithmChecker.check(AlgorithmChecker.java:396)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.DistributionPointFetcher.verifyCRL(DistributionPointFetcher.java:667)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.DistributionPointFetcher.getCRLs(DistributionPointFetcher.java:209)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.DistributionPointFetcher.getCRLs(DistributionPointFetcher.java:121)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.RevocationChecker.checkCRLs(RevocationChecker.java:552)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.RevocationChecker.checkCRLs(RevocationChecker.java:465)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.RevocationChecker.check(RevocationChecker.java:394)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.RevocationChecker.check(RevocationChecker.java:337)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:222)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140)
[ERROR] TiExceptionHandler:     sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79)
[ERROR] TiExceptionHandler:     java.security.cert.CertPathValidator.validate(CertPathValidator.java:301)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:715)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:549)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:570)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:615)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:505)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:425)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:353)
[ERROR] TiExceptionHandler:     android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)
[ERROR] TiExceptionHandler:     android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:163)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:255)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1638)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:569)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:858)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:731)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:241)
[ERROR] TiExceptionHandler:     com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:220)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.RealConnection.connectTls(RealConnection.kt:379)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.kt:337)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:209)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
[ERROR] TiExceptionHandler:     okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
[ERROR] TiExceptionHandler:     okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95)
[ERROR] TiExceptionHandler:     okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
[ERROR] TiExceptionHandler:     okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
[ERROR] TiExceptionHandler:     okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
[ERROR] TiExceptionHandler:     okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
[ERROR] TiExceptionHandler:     okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201)
[ERROR] TiExceptionHandler:     okhttp3.internal.connection.RealCall$AsyncCall.run(RealCall.kt:517)
[ERROR] TiExceptionHandler:     java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
[ERROR] TiExceptionHandler:     java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
[ERROR] TiExceptionHandler:     java.lang.Thread.run(Thread.java:920)

I think it's related to the appcelerator.https module and I'm not sure if maybe one of our certs is actually causing issues, but it should definitely not throw this error, right?

Comments

Gary Mathews 2021-09-20

There's some interesting info here https://github.com/google/conscrypt/issues/520 It looks like the certificate is pointing to a huge CRL, which is being parsed and allocating a lot of memory to do so. It doesn't look like we can do anything about this, since the internal X509 implementation handles this parsing.
Hans Knöchel 2021-09-20

I think I found the issue: It's the arm64 Android 12 Eimulator on the M1 that's using a wrong date (3 days earlier than today), causing a "certificate not valid, yet" error. So I think we can close this - it's definitely no Titanium thing.

JSON Source