Crash in RN debug mode about hermes

[dulinriley]

This crash ("Too many handles allocated in GCScope") is an assert we have enabled in the native code of Hermes, and its purpose is to find problems where Handles are allocated in loops:

for (int i = 0; i < something; i++) {
  runtime->makeHandle(HermesValue::encodeNumberValue(i));
}

Native code is supposed to either make a new GCScope, or use a "marker" and flush it every loop iteration, like so:

for (int i = 0; i < something; i++) {
  GCScopeMarkerRAII marker{gcScope};
  runtime->makeHandle(HermesValue::encodeNumberValue(i));
}

In order to fix this, we need to know what the native stack looks like.
It should be possible to attach a native debugger (gdb or lldb) to Hermes running on Android and
get the backtrace.
It is usually a trivial fix for these types of crashes, once we know what native function it is happening in.

[HeribertoAlves]

@HeribertoAlves that’s actually a different crash (due to a non-ASCII character in a string that says it should be ASCII). Can you file a separate issue for that and include that stack trace?

#47 done!

[chubillkelvin]

Encountered same problem here, using RN 0.60.3. The app crashes after showing the splash screen, and shows:

/Users/willholen/intern/hermes/include/hermes/VM/HandleRootOwner.h:413: hermes::vm::PinnedHermesValue *hermes::vm::GCScope::newHandle(hermes::vm::HermesValue): assertion "getHandleCountDbg() < handlesLimit_ && "Too many handles allocated in GCScope"" failed
Fatal signal 6 (SIGABRT), code -6 in tid 25145 (mqt_js)

[dulinriley]

@RageBill, @mjmasn since you can reproduce the problem, can you try to attach a debugger and get a native (C++) stack trace? Android Studio has lldb support (for example).

Once we have that stack it will probably be a trivial fix.

[HeribertoAlves]

Hello @dulinriley.
For me the error is:
A/libc: /Users/willholen/intern/hermes/API/hermes/hermes.cpp:1378: auto facebook::hermes::HermesRuntimeImpl::createStringFromAscii(const char *, size_t)::(anonymous class)::operator()() const: assertion "static_cast(str[i]) < 128 && "non-ASCII character in string"" failed
Fatal signal 6 (SIGABRT), code -6 in tid 22378 (mqt_js)

I hope the stack trace below helps you.

tgkill 0x0000007fb2680838
abort 0x0000007fb2632ed4
__libc_fatal 0x0000007fb263aee0
__assert2 0x0000007fb2633624
facebook::hermes::HermesRuntimeImpl::createStringFromAscii(char const*, unsigned long) 0x0000007f8e129914
void facebook::jsi::Object::setPropertyfacebook::jsi::Value&(facebook::jsi::Runtime&, char const*, facebook::jsi::Value&&&) 0x0000007f9030b458
facebook::jsi::valueFromDynamic(facebook::jsi::Runtime&, folly::dynamic const&) 0x0000007f9030b198
facebook::jsi::valueFromDynamic(facebook::jsi::Runtime&, folly::dynamic const&) 0x0000007f9030b154
facebook::jsi::valueFromDynamic(facebook::jsi::Runtime&, folly::dynamic const&) 0x0000007f9030b154
facebook::jsi::valueFromDynamic(facebook::jsi::Runtime&, folly::dynamic const&) 0x0000007f9030b0cc
facebook::react::JSIExecutor::invokeCallback(double, folly::dynamic const&) 0x0000007f902fe01c
___lldb_unnamed_symbol185$$libreactnativejni.so 0x0000007f90ba7dc4
___lldb_unnamed_symbol228$$libreactnativejni.so 0x0000007f90ba8de4
___lldb_unnamed_symbol42$$libreactnativejni.so 0x0000007f90b6b8c0
facebook::jni::detail::MethodWrapper<void (facebook::react::JNativeRunnable::)(), &(facebook::react::JNativeRunnable::run()), facebook::react::JNativeRunnable, void>::dispatch(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<facebook::react::JNativeRunnable, facebook::react::Runnable>::JavaPart, facebook::react::Runnable, void>::_javaobject>) 0x0000007f90b5ac78
facebook::jni::detail::FunctionWrapper<void ()(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<facebook::react::JNativeRunnable, facebook::react::Runnable>::JavaPart, facebook::react::Runnable, void>::_javaobject>), &(facebook::jni::detail::MethodWrapper<void (facebook::react::JNativeRunnable::)(), &(facebook::react::JNativeRunnable::run()), facebook::react::JNativeRunnable, void>::dispatch(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<facebook::react::JNativeRunnable, facebook::react::Runnable>::JavaPart, facebook::react::Runnable, void>::_javaobject>)), facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<facebook::react::JNativeRunnable, facebook::react::Runnable>::JavaPart, facebook::react::Runnable, void>::_javaobject*, void>::call(_JNIEnv*, _jobject*) 0x0000007f90b5abf4
art_quick_generic_jni_trampoline 0x0000007fae2bc504
0x00000000996d5bd8
art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*) 0x0000007fade82da4
art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*) 0x0000007fae02d488
bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*) 0x0000007fae027b50
bool art::interpreter::DoInvoke<(art::InvokeType)0, false, false>(art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*) 0x0000007fae054a64
art::JValue art::interpreter::ExecuteSwitchImpl<false, false>(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool) 0x0000007fae04c040
art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool) 0x0000007fae008930
art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*) 0x0000007fae00efcc
bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*) 0x0000007fae027b30
bool art::interpreter::DoInvoke<(art::InvokeType)3, false, false>(art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*) 0x0000007fae05280c
art::JValue art::interpreter::ExecuteSwitchImpl<false, false>(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool) 0x0000007fae04fbec
art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool) 0x0000007fae008930
artQuickToInterpreterBridge 0x0000007fae28e958
art_quick_to_interpreter_bridge 0x0000007fae2bc620
0x00000000996983e0

[dulinriley]

@HeribertoAlves that’s actually a different crash (due to a non-ASCII character in a string that says it should be ASCII). Can you file a separate issue for that and include that stack trace?

[chubillkelvin]

After I have removed usage of ram-bundle and inline-requires, my RN app works with Hermes partially. The exact same error (app crashes) now occurs whenever I enter a screen with a FlatList
/ Carousel component. The error messages are still the same. I hope this provides a little more information to debug this.

[dulinriley]

@RageBill unfortunately I'm still not sure of what native function in Hermes the assert happens in.
If you could make the app that demonstrates the issue available (or make a test app that does something similar), I can clone it and debug it.

Also,

The exact same error (app crashes)

To be clear, is this the same assert? "Too many handles allocated in GCScope"
That assert can fire in a lot of places of the VM, so it might be a separate place that also needs fixing.

One thing you can try is the tool ndk-stack, detailed here: https://developer.android.com/ndk/guides/ndk-stack.html.
If we can get the names of the functions in that stack trace posted, it will be obvious where the problem is.

[chubillkelvin]

@dulinriley I tried looking at the link you provide me, but I could not locate this part in my React Native project: "-sym $PROJECT_PATH/obj/local/armeabi-v7a".

Could you suggest in which folder should I be looking? I have searched through my project directories and I don't find anything similar to /obj/local/armeabi-v7a.

[dulinriley]

Does $PROJECT_PATH/obj/local/ exist? If you built for an emulator, the binaries might by in x86 instead of armeabi-v7a. The example from the website assumed it was coming from a real device.

I'm not sure where $PROJECT_PATH is located, but if you are using Android Studio + ndk-build there should probably be something wherever Android Studio builds in.

However, I bet what Android is looking for is some .so files and DWARF info in those libraries. You can try given it the libhermes.so directly since the debug version (when asserts are on) should include the right DWARF info.

[robertying]

Hi @dulinriley!

I'm also facing a crash only when hermes is enabled in React Native 0.62.rc-2

However, I can only see one error log and there's no other stacktrace:

2020-02-25 16:25:43.258 9101-9158/com.rn062 A/libc: Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 9158 (mqt_js), pid 9101 (com.rn062)

How could I debug what went wrong concerning this? Thanks!

Related issue: wix/react-native-navigation#5964

[Johnnie-C]

+1 same error here in RN 0.62.2 .
Android app crashes when startup only with Hermes enabled.
The only error I got is:
A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x441a0008 in tid 3334 (mqt_js)

[dulinriley]

Unfortunately we don't have a good way (yet) to symbolicate our crashes in native code without building Hermes from source.

We have an open issue for figuring out how to make that work: #119.
Once we have that issue fixed, and we can get a symbolicated stack trace for each crash,
we have a better chance of diagnosing these.

[nikonhub]

I experience the same kind of errors
react-native: 0.63.2
hermes: 0.5.0

Only happens on release build type. When data is loading the first time in a FlatList. Relaunching after a crash works fine.

A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x7900000000 in tid 19702 (mqt_js), pid 19630 (android.staging)

With this associated ndk-stack. Does it help ?

********** Crash dump: **********
Build fingerprint: 'Sony/H3113/H3113:8.0.0/50.1.A.4.76/2209478692:user/release-keys'
#00 0x00000000000cd600 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
llvh::SmallVectorBase::SmallVectorBase(void*, unsigned long)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/SmallVector.h:42:12
llvh::SmallVectorTemplateCommon<char, void>::SmallVectorTemplateCommon(unsigned long)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/SmallVector.h:96:0
llvh::SmallVectorTemplateBase<char, true>::SmallVectorTemplateBase(unsigned long)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/SmallVector.h:269:0
llvh::SmallVectorImpl<char>::SmallVectorImpl(unsigned int)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/SmallVector.h:334:0
llvh::SmallVector<char, 32u>::SmallVector()
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/SmallVector.h:849:0
llvh::SmallString<32u>::SmallString()
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/SmallString.h:30:0
hermes::vm::dateConstructor(void*, hermes::vm::Runtime*, hermes::vm::NativeArgs)
$HERMES_DIR/hermes/lib/VM/JSLib/Date.cpp:479:0
#01 0x00000000000eac18 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::ChromeTraceSerializer::serialize(llvh::raw_ostream&) const
$HERMES_DIR/hermes/lib/VM/Profiler/ChromeTraceSerializerPosix.cpp:333:3
#02 0x00000000000eab98 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::ChromeTraceSerializer::serialize(llvh::raw_ostream&) const
$HERMES_DIR/hermes/lib/VM/Profiler/ChromeTraceSerializerPosix.cpp:321:3
#03 0x00000000000ea3ec /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::ChromeTraceSerializer::serializeThreads(hermes::JSONEmitter&) const
$HERMES_DIR/hermes/lib/VM/Profiler/ChromeTraceSerializerPosix.cpp:136:10
#04 0x00000000000d8a84 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::GCSegmentRange::Consumable<hermes::vm::AlignedHeapSegment*>::next()
$HERMES_DIR/hermes/include/hermes/VM/GCSegmentRange.h:157:3
#05 0x00000000000ce9e8 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::JSObject::directProps()
$HERMES_DIR/hermes/include/hermes/VM/JSObject.h:1402:55
void hermes::vm::JSObject::setNamedSlotValue<(hermes::vm::ArrayStorage::Inline)1>(hermes::vm::JSObject*, hermes::vm::Runtime*, unsigned int, hermes::vm::HermesValue)
$HERMES_DIR/hermes/include/hermes/VM/JSObject.h:1620:0
hermes::vm::JSObject::setInternalProperty(hermes::vm::JSObject*, hermes::vm::Runtime*, unsigned int, hermes::vm::HermesValue)
$HERMES_DIR/hermes/include/hermes/VM/JSObject.h:522:0
hermes::vm::JSDate::setPrimitiveValue(hermes::vm::JSObject*, hermes::vm::Runtime*, hermes::vm::HermesValue)
$HERMES_DIR/hermes/include/hermes/VM/JSDate.h:49:0
hermes::vm::datePrototypeSetYear(void*, hermes::vm::Runtime*, hermes::vm::NativeArgs)
$HERMES_DIR/hermes/lib/VM/JSLib/Date.cpp:1070:0
#06 0x00000000000ce3fc /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::datePrototypeSetDate(void*, hermes::vm::Runtime*, hermes::vm::NativeArgs)
$HERMES_DIR/hermes/lib/VM/JSLib/Date.cpp:940:7
#07 0x00000000000dd21c /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::CardTable::findNextDirtyCard(unsigned long, unsigned long) const
$HERMES_DIR/hermes/include/hermes/VM/CardTableNC.h:329:10
hermes::vm::OldGen::markYoungGenPointers(hermes::vm::OldGen::Location)
$HERMES_DIR/hermes/lib/VM/gcs/OldGenNC.cpp:424:0
#08 0x00000000000dce28 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::OldGen::markYoungGenPointers(hermes::vm::OldGen::Location)::OldGenObjEvacAcceptor::OldGenObjEvacAcceptor(hermes::vm::GenGC&)
$HERMES_DIR/hermes/lib/VM/gcs/OldGenNC.cpp:371:32
hermes::vm::OldGen::markYoungGenPointers(hermes::vm::OldGen::Location)
$HERMES_DIR/hermes/lib/VM/gcs/OldGenNC.cpp:396:0
#09 0x00000000000d19e0 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::unescape(void*, hermes::vm::Runtime*, hermes::vm::NativeArgs)
$HERMES_DIR/hermes/lib/VM/JSLib/escape.cpp:94:0
#10 0x000000000003f054 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::Callable::executeConstruct1(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*, hermes::vm::Handle<hermes::vm::HermesValue>)
$HERMES_DIR/hermes/lib/VM/Callable.cpp:415:1
#11 0x00000000000500a8 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::operator<<(llvh::raw_ostream&, hermes::vm::SymbolID)
$HERMES_DIR/hermes/lib/VM/IdentifierTable.cpp:0:0
#12 0x000000000004e678 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::CallResult<hermes::vm::SymbolID, (hermes::vm::detail::CallResultSpecialize)0> hermes::vm::IdentifierTable::getOrCreateIdentifier<char>(hermes::vm::Runtime*, llvh::ArrayRef<char>, hermes::vm::Handle<hermes::vm::StringPrimitive>, unsigned int)
$HERMES_DIR/hermes/lib/VM/IdentifierTable.cpp:351:0
#13 0x000000000003db64 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >::basic_string(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >&&)
/usr/local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/c++/v1/string:1868:7
facebook::jsi::JSIException::JSIException(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >)
$HERMES_DIR/hermes/API/jsi/jsi/../jsi/jsi.h:1209:0
facebook::jsi::JSINativeException::JSINativeException(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >)
$HERMES_DIR/hermes/API/jsi/jsi/../jsi/jsi.h:1226:0
facebook::jsi::Runtime::instrumentation()::NoInstrumentation::createSnapshotToStream(std::__ndk1::basic_ostream<char, std::__ndk1::char_traits<char> >&)
$HERMES_DIR/hermes/API/jsi/jsi/jsi.cpp:111:0
#14 0x00000000000bf89c /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::createStringConstructor(hermes::vm::Runtime*)
$HERMES_DIR/hermes/lib/VM/JSLib/String.cpp:0:0
#15 0x000000000003ece8 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::Callable::executeCall(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::Handle<hermes::vm::JSObject>)
$HERMES_DIR/hermes/include/hermes/VM/ArrayLike.h:0:0
#16 0x000000000004d72c /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
bool llvh::DenseMapBase<llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >, hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::LookupBucketFor<hermes::vm::detail::Transition>(hermes::vm::detail::Transition const&, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> >*&)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:0:9
llvh::DenseMapBase<llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >, hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::find(hermes::vm::detail::Transition const&)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:148:0
#17 0x0000000000050b70 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::Interpreter::getArgumentsPropByValSlowPath_RJS(hermes::vm::Runtime*, hermes::vm::PinnedHermesValue*, hermes::vm::PinnedHermesValue*, hermes::vm::Handle<hermes::vm::Callable>, bool)
$HERMES_DIR/hermes/lib/VM/Interpreter.cpp:260:18
#18 0x000000000004e678 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::CallResult<hermes::vm::SymbolID, (hermes::vm::detail::CallResultSpecialize)0> hermes::vm::IdentifierTable::getOrCreateIdentifier<char>(hermes::vm::Runtime*, llvh::ArrayRef<char>, hermes::vm::Handle<hermes::vm::StringPrimitive>, unsigned int)
$HERMES_DIR/hermes/lib/VM/IdentifierTable.cpp:351:0
#19 0x000000000003e848 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::HermesValueTraits<hermes::vm::Callable, true>::arrow(hermes::vm::HermesValue const&)
$HERMES_DIR/hermes/include/hermes/VM/HermesValueTraits.h:224:24
hermes::vm::Handle<hermes::vm::Callable>::operator->() const
$HERMES_DIR/hermes/include/hermes/VM/Handle.h:367:0
hermes::vm::Callable::call(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*)
$HERMES_DIR/hermes/include/hermes/VM/Callable.h:273:0
hermes::vm::Callable::executeCall2(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::HermesValue, hermes::vm::HermesValue, bool)
$HERMES_DIR/hermes/lib/VM/Callable.cpp:287:0
#20 0x000000000004d744 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::getBuckets() const
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:1077:12
llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::getBuckets()
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:1082:0
llvh::DenseMapBase<llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >, hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::getBuckets()
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:486:0
llvh::DenseMapBase<llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >, hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::getBucketsEnd()
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:494:0
llvh::DenseMapBase<llvh::SmallDenseMap<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, 8u, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >, hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass>, llvh::DenseMapInfo<hermes::vm::detail::Transition>, llvh::detail::DenseMapPair<hermes::vm::detail::Transition, hermes::vm::WeakRef<hermes::vm::HiddenClass> > >::find(hermes::vm::detail::Transition const&)
$HERMES_DIR/hermes/external/llvh/include/llvh/ADT/DenseMap.h:149:0
#21 0x0000000000050b70 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::Interpreter::getArgumentsPropByValSlowPath_RJS(hermes::vm::Runtime*, hermes::vm::PinnedHermesValue*, hermes::vm::PinnedHermesValue*, hermes::vm::Handle<hermes::vm::Callable>, bool)
$HERMES_DIR/hermes/lib/VM/Interpreter.cpp:260:18
#22 0x000000000004e678 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::CallResult<hermes::vm::SymbolID, (hermes::vm::detail::CallResultSpecialize)0> hermes::vm::IdentifierTable::getOrCreateIdentifier<char>(hermes::vm::Runtime*, llvh::ArrayRef<char>, hermes::vm::Handle<hermes::vm::StringPrimitive>, unsigned int)
$HERMES_DIR/hermes/lib/VM/IdentifierTable.cpp:351:0
#23 0x000000000003e848 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::HermesValueTraits<hermes::vm::Callable, true>::arrow(hermes::vm::HermesValue const&)
$HERMES_DIR/hermes/include/hermes/VM/HermesValueTraits.h:224:24
hermes::vm::Handle<hermes::vm::Callable>::operator->() const
$HERMES_DIR/hermes/include/hermes/VM/Handle.h:367:0
hermes::vm::Callable::call(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*)
$HERMES_DIR/hermes/include/hermes/VM/Callable.h:273:0
hermes::vm::Callable::executeCall2(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::HermesValue, hermes::vm::HermesValue, bool)
$HERMES_DIR/hermes/lib/VM/Callable.cpp:287:0
#24 0x000000000002eeb8 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so (facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+444)
                                                                                                            facebook::hermes::HermesRuntimeImpl::getLength(hermes::vm::Handle<hermes::vm::ArrayImpl>)
                                                                                                            $HERMES_DIR/hermes/API/hermes/hermes.cpp:2077:0
#25 0x0000000000027800 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes-executor-release.so (_ZNK8facebook3jsi8Function4callIJRKdNS0_5ValueEEEES5_RNS0_7RuntimeEDpOT_+120)
#26 0x0000000000027638 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes-executor-release.so (facebook::react::JSIExecutor::invokeCallback(double, folly::dynamic const&)+164)
#27 0x00000000000a1370 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libreactnativejni.so
#28 0x00000000000a2350 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libreactnativejni.so
#29 0x0000000000068d48 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libreactnativejni.so
#30 0x0000000000059a70 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libreactnativejni.so (_ZN8facebook3jni6detail13MethodWrapperIMNS_5react15JNativeRunnableEFvvEXadL_ZNS4_3runEvEES4_vJEE8dispatchENS0_9alias_refIPNS1_8JTypeForINS0_11HybridClassIS4_NS3_8RunnableEE8JavaPartESB_vE11_javaobjectEEE+32)
#31 0x00000000000599ec /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libreactnativejni.so (_ZN8facebook3jni6detail15FunctionWrapperIPFvNS0_9alias_refIPNS1_8JTypeForINS0_11HybridClassINS_5react15JNativeRunnableENS6_8RunnableEE8JavaPartES8_vE11_javaobjectEEEEXadL_ZNS1_13MethodWrapperIMS7_FvvEXadL_ZNS7_3runEvEES7_vJEE8dispatchESE_EESD_vJEE4callEP7_JNIEnvP8_jobject+52)
#32 0x00000000000593fc /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/oat/arm64/base.odex (offset 0x53000) (com.facebook.jni.NativeRunnable.run [DEDUPED]+124)
#33 0x0000000000a8bb9c /system/framework/arm64/boot-framework.oat (offset 0x39f000) (android.os.Handler.dispatchMessage+76)
#34 0x000000000000c480 /dev/ashmem/dalvik-jit-code-cache (deleted)
Crash dump is completed

[dulinriley]

@nikosmonaut unfortunately I don't think that stack is symbolicated correctly.

These three frames:

#03 0x00000000000ea3ec /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::ChromeTraceSerializer::serializeThreads(hermes::JSONEmitter&) const
$HERMES_DIR/hermes/lib/VM/Profiler/ChromeTraceSerializerPosix.cpp:136:10
#04 0x00000000000d8a84 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::GCSegmentRange::Consumable<hermes::vm::AlignedHeapSegment*>::next()
$HERMES_DIR/hermes/include/hermes/VM/GCSegmentRange.h:157:3
#05 0x00000000000ce9e8 /data/app/com.app.staging-t1S9th8kHBQjfIiUt3W6pQ==/lib/arm64/libhermes.so
hermes::vm::JSObject::directProps()

Can't possibly be in this order. This is the body of JSObject::directProps():

GCHermesValue *JSObject::directProps() {
  return static_cast<JSObjectAndDirectProps *>(this)->directProps_;
}

There's no way for that to call any function.

This may have been symbolicated with the wrong version of Hermes, since the functions are all from Hermes, just maybe slightly offset from the true functions.

[nikonhub]

I builded hermes from sources and found these unstripped libs under $HERMES_WS_DIR/hermes/npm/android/unstripped-($BUILD_TYPE)/0/lib/($ABI)/libhermes.so to use with ndk-stack. But I'm not really sure if these ones are the correct to use

[dulinriley]

@nikosmonaut if you built from source, and used those same artifacts to run the app, it should work to symbolicate.
You can try modifying the installed app's libraries.
Try adb pushing the unstripped libhermes.so to the device, and replace the libhermes.so where the app is installed. Or alternatively replace it in the APK before installing.

At that point the logs should be completely symbolicated without needing to use ndk-stack.

[nikonhub]

@dulinriley thank you for your explanations. It all became clearer now.

Last time I tried an unstripped lib from master with a v0.5.0 version on app. So it obviously couldn't match.

I think the build is broken on 0.5.x versions. I had to include a lib here to make it work

#include <cstdint>

I tried two versions v0.5.0 and v0.5.1 and have the same error.

A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x7900000000 in tid 31706 (mqt_js), pid 31624 (android.staging)

ndk crash dump

********** Crash dump: **********
Build fingerprint: 'Sony/H3113/H3113:8.0.0/50.1.A.4.76/2209478692:user/release-keys'
#00 0x00000000000ce2e4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::AlignedHeapSegment::segmentIndexFromStart(void const*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/AlignedHeapSegment.h:530:48
hermes::vm::BasedPointer::computeSegmentAndOffset(void const*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/PointerBase-inline.h:49:0
hermes::vm::BasedPointer::BasedPointer(void*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/PointerBase-inline.h:35:0
hermes::vm::PointerBase::pointerToBasedNonNull(void*) const
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/PointerBase-inline.h:83:0
hermes::vm::PointerBase::pointerToBased(void*) const
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/PointerBase-inline.h:78:0
hermes::vm::SlotAcceptorDefault::accept(hermes::vm::BasedPointer&)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/SlotAcceptorDefault-inline.h:29:0
#01 0x00000000000ec190 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::SlotAcceptorDefault::accept(hermes::vm::GCPointerBase&)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/SlotAcceptorDefault.h:31:5
void hermes::vm::SlotVisitor<hermes::vm::FullMSCUpdateAcceptor>::visitSlots<hermes::vm::GCPointerBase>(char*, llvm::ArrayRef<unsigned short>)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/SlotVisitor.h:150:0
hermes::vm::SlotVisitor<hermes::vm::FullMSCUpdateAcceptor>::visitFields(char*, hermes::vm::Metadata const&)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/SlotVisitor.h:176:0
#02 0x00000000000ec110 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::SlotVisitor<hermes::vm::FullMSCUpdateAcceptor>::visit(hermes::vm::GCCell*, hermes::vm::Metadata const&)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/SlotVisitor.h:119:5
#03 0x00000000000eb7e8 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
void hermes::vm::GCBase::markCell<hermes::vm::FullMSCUpdateAcceptor>(hermes::vm::SlotVisitor<hermes::vm::FullMSCUpdateAcceptor>&, hermes::vm::GCCell*, hermes::vm::VTable const*, hermes::vm::GenGC*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/GCBase-inline.h:49:11
void hermes::vm::GCBase::markCell<hermes::vm::FullMSCUpdateAcceptor>(hermes::vm::GCCell*, hermes::vm::VTable const*, hermes::vm::GenGC*, hermes::vm::FullMSCUpdateAcceptor&)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/GCBase-inline.h:40:0
hermes::vm::AlignedHeapSegment::updateReferences(hermes::vm::GenGC*, hermes::vm::FullMSCUpdateAcceptor*, hermes::ConsumableRange<std::__ndk1::__wrap_iter<hermes::vm::VTable const* const*> >&)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/AlignedHeapSegment.cpp:355:0
#04 0x00000000000d9ef4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::OldGen::updateReferences(hermes::vm::GenGC*, hermes::ConsumableRange<std::__ndk1::__wrap_iter<hermes::vm::VTable const* const*> >&)::$_3::operator()(hermes::vm::AlignedHeapSegment&) const
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/OldGenNC.cpp:576:13
void hermes::vm::OldGen::forUsedSegments<hermes::vm::OldGen::updateReferences(hermes::vm::GenGC*, hermes::ConsumableRange<std::__ndk1::__wrap_iter<hermes::vm::VTable const* const*> >&)::$_3>(hermes::vm::OldGen::updateReferences(hermes::vm::GenGC*, hermes::ConsumableRange<std::__ndk1::__wrap_iter<hermes::vm::VTable const* const*> >&)::$_3)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/OldGenNC.h:544:0
hermes::vm::OldGen::updateReferences(hermes::vm::GenGC*, hermes::ConsumableRange<std::__ndk1::__wrap_iter<hermes::vm::VTable const* const*> >&)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/OldGenNC.cpp:575:0
#05 0x00000000000cf7e0 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::GenGC::updateReferences(hermes::vm::SweepResult const&)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/GenGCNC.cpp:713:11
#06 0x00000000000cf03c /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::GenGC::collect(bool)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/GenGCNC.cpp:363:5
#07 0x00000000000de3a8 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::YoungGen::fullCollectThenAlloc(unsigned int, hermes::vm::HasFinalizer, bool)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/YoungGenNC.cpp:257:8
#08 0x00000000000ddfbc /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::YoungGen::allocSlow(unsigned int, hermes::vm::HasFinalizer, bool)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/YoungGenNC.cpp:250:10
#09 0x00000000000d288c /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::GenGC::allocSlow(unsigned int, bool, hermes::vm::HasFinalizer)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/gcs/GenGCNC.cpp:2483:21
#10 0x000000000003e8f4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
void* hermes::vm::GenGC::allocImpl<false, (hermes::vm::HasFinalizer)0>(unsigned int)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/GenGCNC.h:983:10
void* hermes::vm::GenGC::alloc<false, (hermes::vm::HasFinalizer)0>(unsigned int)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/GenGCNC.h:931:0
void* hermes::vm::Runtime::alloc<false, (hermes::vm::HasFinalizer)0>(unsigned int)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/Runtime.h:1576:0
hermes::vm::ArrayStorage::create(hermes::vm::Runtime*, unsigned int)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/ArrayStorage.h:71:0
#11 0x00000000000df220 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::ArrayStorage::reallocateToLarger(hermes::vm::MutableHandle<hermes::vm::ArrayStorage>&, hermes::vm::Runtime*, unsigned int, unsigned int, unsigned int, unsigned int)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/ArrayStorage.cpp:107:17
#12 0x0000000000059a78 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::ArrayStorage::resize(hermes::vm::MutableHandle<hermes::vm::ArrayStorage>&, hermes::vm::Runtime*, unsigned int)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/ArrayStorage.h:168:12
hermes::vm::JSObject::allocateNewSlotStorage(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime*, unsigned int, hermes::vm::Handle<hermes::vm::HermesValue>)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/JSObject.cpp:310:0
#13 0x000000000005ef9c /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::JSObject::addOwnPropertyImpl(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime*, hermes::vm::SymbolID, hermes::vm::PropertyFlags, hermes::vm::Handle<hermes::vm::HermesValue>)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/JSObject.cpp:2683:3
#14 0x000000000005d468 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::JSObject::addOwnProperty(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime*, hermes::vm::SymbolID, hermes::vm::DefinePropertyFlags, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::PropOpFlags)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/JSObject.cpp:2654:7
#15 0x000000000005c71c /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::JSObject::putNamedWithReceiver_RJS(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime*, hermes::vm::SymbolID, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::PropOpFlags)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/JSObject.cpp:1477:10
#16 0x00000000000505f4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::JSObject::putNamed_RJS(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime*, hermes::vm::SymbolID, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::PropOpFlags)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/JSObject.h:1726:10
hermes::vm::CallResult<hermes::vm::HermesValue, (hermes::vm::detail::CallResultSpecialize)2> hermes::vm::Interpreter::interpretFunction<false>(hermes::vm::Runtime*, hermes::vm::InterpreterState&)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:2542:0
#17 0x000000000004e7a4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Runtime::interpretFunctionImpl(hermes::vm::CodeBlock*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:862:10
#18 0x000000000003ecb0 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Callable::call(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/Callable.h:270:12
hermes::vm::BoundFunction::_boundCall(hermes::vm::BoundFunction*, hermes::inst::Inst const*, hermes::vm::Runtime*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Callable.cpp:846:0
#19 0x000000000004d6cc /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Interpreter::handleCallSlowPath(hermes::vm::Runtime*, hermes::vm::PinnedHermesValue*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:325:12
#20 0x000000000004efc0 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::CallResult<hermes::vm::HermesValue, (hermes::vm::detail::CallResultSpecialize)2> hermes::vm::Interpreter::interpretFunction<false>(hermes::vm::Runtime*, hermes::vm::InterpreterState&)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:1676:7
#21 0x000000000004e7a4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Runtime::interpretFunctionImpl(hermes::vm::CodeBlock*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:862:10
#22 0x000000000003dfc8 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Callable::call(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/Callable.h:270:12
hermes::vm::Callable::executeCall(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::Handle<hermes::vm::JSObject>)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Callable.cpp:378:0
#23 0x00000000000c0a08 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::functionPrototypeApply(void*, hermes::vm::Runtime*, hermes::vm::NativeArgs)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/JSLib/Function.cpp:211:10
#24 0x000000000003f138 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::NativeFunction::_nativeCall(hermes::vm::NativeFunction*, hermes::vm::Runtime*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/Callable.h:534:9
#25 0x000000000004d6b0 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Interpreter::handleCallSlowPath(hermes::vm::Runtime*, hermes::vm::PinnedHermesValue*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:321:12
#26 0x000000000004efc0 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::CallResult<hermes::vm::HermesValue, (hermes::vm::detail::CallResultSpecialize)2> hermes::vm::Interpreter::interpretFunction<false>(hermes::vm::Runtime*, hermes::vm::InterpreterState&)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:1676:7
#27 0x000000000004e7a4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Runtime::interpretFunctionImpl(hermes::vm::CodeBlock*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Interpreter.cpp:862:10
#28 0x000000000003ecb0 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so
hermes::vm::Callable::call(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*)
/myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/Callable.h:270:12
hermes::vm::BoundFunction::_boundCall(hermes::vm::BoundFunction*, hermes::inst::Inst const*, hermes::vm::Runtime*)
/myworkspacehermesWorkspace0.5.0/hermes/lib/VM/Callable.cpp:846:0
#29 0x000000000002ebcc /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes.so (facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+292)
                                                                                                            hermes::vm::Callable::call(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime*)
                                                                                                            /myworkspacehermesWorkspace0.5.0/hermes/include/hermes/VM/Callable.h:270:12
                                                                                                            facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)::$_21::operator()() const
                                                                                                            /myworkspacehermesWorkspace0.5.0/hermes/API/hermes/hermes.cpp:1833:0
                                                                                                            decltype(fp()) (anonymous namespace)::maybeRethrow<facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)::$_21>(facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)::$_21 const&)
                                                                                                            /myworkspacehermesWorkspace0.5.0/hermes/API/hermes/hermes.cpp:100:0
                                                                                                            facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)
                                                                                                            /myworkspacehermesWorkspace0.5.0/hermes/API/hermes/hermes.cpp:1807:0
#30 0x000000000002a334 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes-executor-release.so (_ZNK8facebook3jsi8Function4callIJRKNSt6__ndk112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEESB_NS0_5ValueEEEESC_RNS0_7RuntimeEDpOT_+240)
#31 0x000000000002a190 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes-executor-release.so
#32 0x00000000000245e4 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes-executor-release.so (_ZNSt6__ndk128__invoke_void_return_wrapperIvE6__callIJRPFvRKNS_8functionIFvvEEENS3_IFNS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEvEEEES7_SF_EEEvDpOT_+116)
#33 0x0000000000027034 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libhermes-executor-release.so (facebook::react::JSIExecutor::callFunction(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char>> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char>> const&, folly::dynamic const&)+1156)
#34 0x00000000000a0d58 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libreactnativejni.so
#35 0x00000000000a2350 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libreactnativejni.so
#36 0x0000000000068d48 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libreactnativejni.so
#37 0x0000000000059a70 /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libreactnativejni.so (_ZN8facebook3jni6detail13MethodWrapperIMNS_5react15JNativeRunnableEFvvEXadL_ZNS4_3runEvEES4_vJEE8dispatchENS0_9alias_refIPNS1_8JTypeForINS0_11HybridClassIS4_NS3_8RunnableEE8JavaPartESB_vE11_javaobjectEEE+32)
#38 0x00000000000599ec /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/lib/arm64/libreactnativejni.so (_ZN8facebook3jni6detail15FunctionWrapperIPFvNS0_9alias_refIPNS1_8JTypeForINS0_11HybridClassINS_5react15JNativeRunnableENS6_8RunnableEE8JavaPartES8_vE11_javaobjectEEEEXadL_ZNS1_13MethodWrapperIMS7_FvvEXadL_ZNS7_3runEvEES7_vJEE8dispatchESE_EESD_vJEE4callEP7_JNIEnvP8_jobject+52)
#39 0x00000000001368dc /dev/ashmem/dalvik-jit-code-cache (deleted) (com.facebook.react.bridge.queue.NativeRunnable.run+124)
#40 0x000000000002adf8 /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.Handler.handleCallback+56)
#41 0x000000000003e29c /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.Handler.dispatchMessage+60)
#42 0x0000000000083a14 /dev/ashmem/dalvik-jit-code-cache (deleted) (com.facebook.react.bridge.queue.MessageQueueThreadHandler.dispatchMessage+52)
#43 0x0000000000554988 /system/lib64/libart.so (art_quick_invoke_stub+584)
#44 0x00000000000cf6c8 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
#45 0x000000000027f2f8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
#46 0x0000000000279300 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+968)
#47 0x0000000000524794 /system/lib64/libart.so (MterpInvokeVirtual+588)
#48 0x0000000000547094 /system/lib64/libart.so (ExecuteMterpImpl+14228)
#49 0x0000000000a30e72 /system/framework/boot-framework.vdex (android.os.Looper.loop+414)
#50 0x0000000000253004 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.3326130167+488)
#51 0x0000000000258af8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
#52 0x00000000002792e4 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+940)
#53 0x0000000000525c98 /system/lib64/libart.so (MterpInvokeStatic+204)
#54 0x0000000000547214 /system/lib64/libart.so (ExecuteMterpImpl+14612)
#55 0x00000000003ac6de /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/com.app.android.staging-GzSuw3Hw-QF-ioy6Xfu51w==/base.apk (deleted) (com.facebook.react.bridge.queue.MessageQueueThreadImpl$4.run+74)
#56 0x0000000000253004 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.3326130167+488)
#57 0x0000000000258af8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
#58 0x00000000002792e4 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+940)
#59 0x0000000000525710 /system/lib64/libart.so (MterpInvokeInterface+1392)
#60 0x0000000000547294 /system/lib64/libart.so (ExecuteMterpImpl+14740)
#61 0x00000000000c4afa /system/framework/boot.vdex (java.lang.Thread.run+12)
#62 0x0000000000253004 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.3326130167+488)

[dulinriley]

I think the build is broken on 0.5.x versions. I had to include a lib here to make it work

Thanks for pointing that out, I believe it's an issue with using the GNU STL as opposed to the libc++ STL. We'll make a patch for that.

As for the SIGSEGV, looks like it's happening here:

/* static */ unsigned AlignedHeapSegment::segmentIndexFromStart(
    const void *ptr) {
  assert(ptr == AlignedStorage::start(ptr) && "Precondition.");
  return AlignedHeapSegment::segmentInfo(ptr)->index;
}

and column 48 is the "i" in "index". So getting the start of a heap segment from a pointer in the heap is giving us a wild address. Even more interesting, this stack trace is the constructor path for a BasedPointer, and is coming from a FullMSCUpdateAcceptor pass.

Is this easily reproducible? We're going to need to debug this and find out exactly where the bad pointer is coming from.

[nikonhub]

Yes it is easily reproducible yet I'm trying to narrow the code but no luck.

Edit: Finally I found what caused the fatal. But can't reproduce it on a test repository. It is a little similar to this one.

Somehow scrolling a flatlist after calling a async function crashes the app. If it's a normal function everyting is ok. And no crash with JSC.

[dulinriley]

I'm going to close this issue, because I believe multiple distinct crashes have become aggregated here.
I'm going to make a separate issue for the AlignedHeapSegment::segmentIndexFromStart problem, as that's also been reported here: #298 (comment)

I'm also going to lock this issue, to encourage users seeing crashes to make a new issue with fresh information, and avoid aggregating multiple crashes here.

[dulinriley]

See #383 for further information on the segmentIndexFromStart crash