signal 11 (SIGSEGV), code 1 (SEGV_MAPERR) libjsc.so still occuring on Caterpillar S41 (Android 8.0)

[ebaynaud]

Same as #24261 but still occuring on device Caterpillar S41 (Android 8.0).

React Native version: 0.59.10

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 0 >>> com.myapp <<<

backtrace:
  #00  pc 00000000000f7748  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #01  pc 0000000000143fe8  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #02  pc 000000000012f0a8  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #03  pc 0000000000139484  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #04  pc 000000000013900c  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #05  pc 00000000001fb9c4  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #06  pc 00000000001f8e90  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #07  pc 00000000001f96bc  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #08  pc 00000000001e41a0  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #09  pc 00000000006171ec  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #10  pc 0000000000617950  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #11  pc 000000000060de7c  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #12  pc 000000000061b084  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #13  pc 0000000000646dc8  /data/app/com.myapp-Fgc_pnA5bQP7DCgIn51TQQ==/lib/arm64/libjsc.so
  #14  pc 0000000000066f34  /system/lib64/libc.so (_ZL15__pthread_startPv+36)
  #15  pc 000000000001eb94  /system/lib64/libc.so (__start_thread+68)

[Kudo]

@ebaynaud
Do you have any reproduced steps?
Otherwise, symbolicated backtrace would be helped.

wget https://registry.npmjs.org/jsc-android/-/jsc-android-245459.0.0.tgz
tar xf jsc-android-245459.0.0.tgz
unzip package/dist/org/webkit/android-jsc/r245459/android-jsc-r245459.aar

adb logcat -c
adb logcat | ndk-stack -sym jni/arm64-v8a/libjsc.so

[ebaynaud]

Sorry but no, I cannot reproduce by myself because I don't have this device within easy reach. The crash is coming from Google Play console.

[thomasonweb]

Hi Kudo,

I confirm crash is gone from Samsung devices but after upgrading to 0.59.10 we are still seeing it on a couple of other devices as well (unfortunately also through Google Play - I don't have access to such a device to reproduce).

So far I've seen it on:
Asus X555
Huawei P9 Lite
Huawei y6 2017
Huawei Y7 Prime 2018

Running Android 6.0, 7.0 and 8.0.

I've also seen a couple of devices running Android 9 or Android 8.1:
Huawei p smart 2019
Huawei p30

As you can see, Huawei devices are standing out. I have a Huawei P smart (FIG-LX1) running android 8.0 test device myself but it seems to be running just fine on that one.

pid: 0, tid: 0 >>> live.ablo <<<

backtrace:
#00 pc 00000000000f7748 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#1 pc 0000000000143fe8 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#2 pc 000000000012f0a8 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#3 pc 0000000000139484 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#4 pc 000000000013900c /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#5 pc 00000000001fb9c4 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#6 pc 00000000001f8e90 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#7 pc 00000000001f96bc /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#8 pc 00000000001e41a0 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#9 pc 00000000006171ec /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#10 pc 0000000000617950 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#11 pc 000000000060de7c /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#12 pc 000000000061b084 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#13 pc 0000000000646dc8 /data/app/com.myapp-7flUaqbvABD7Q-kusVtsLw==/lib/arm64/libjsc.so
#14 pc 0000000000082e10 /system/lib64/libc.so (__pthread_start(void*)+36)
#15 pc 0000000000024080 /system/lib64/libc.so (__start_thread+68)

[xanderdeseyn]

I'm experiencing it as well on a Huawei Y5 (2017).

[jsaraiva]

Same here. Asus ZenFone 3 Max, Android 8.1.
The stack trace (via Google Play Console) is almost exactly the same as the other ones in this issue (except for the pc for /system/lib64/libc.so, which would vary according to the device manufacturer or Android version, I guess).

pid: 0, tid: 0 >>> pt.geota.app <<<

backtrace:
  #00  pc 00000000000f7748  /data/data/pt.geota.app/lib-0/libjsc.so
  #01  pc 0000000000143fe8  /data/data/pt.geota.app/lib-0/libjsc.so
  #02  pc 000000000012f0a8  /data/data/pt.geota.app/lib-0/libjsc.so
  #03  pc 0000000000139484  /data/data/pt.geota.app/lib-0/libjsc.so
  #04  pc 000000000013900c  /data/data/pt.geota.app/lib-0/libjsc.so
  #05  pc 00000000001fb9c4  /data/data/pt.geota.app/lib-0/libjsc.so
  #06  pc 00000000001f8e90  /data/data/pt.geota.app/lib-0/libjsc.so
  #07  pc 00000000001f96bc  /data/data/pt.geota.app/lib-0/libjsc.so
  #08  pc 00000000001e41a0  /data/data/pt.geota.app/lib-0/libjsc.so
  #09  pc 00000000006171ec  /data/data/pt.geota.app/lib-0/libjsc.so
  #10  pc 0000000000617950  /data/data/pt.geota.app/lib-0/libjsc.so
  #11  pc 000000000060de7c  /data/data/pt.geota.app/lib-0/libjsc.so
  #12  pc 000000000061b084  /data/data/pt.geota.app/lib-0/libjsc.so
  #13  pc 0000000000646dc8  /data/data/pt.geota.app/lib-0/libjsc.so
  #14  pc 000000000007472c  /system/lib64/libc.so (__pthread_start(void*)+36)
  #15  pc 000000000001fbb4  /system/lib64/libc.so (__start_thread+68)

[mars-lan]

Seeing potentially similar issue for a variety of 64-bit phones running Android 9.
RN: 0.59.10
JSC: 241213.1.0 (with ICU i18n support)

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 0 >>> com.invisatime <<<

backtrace:
  #00  pc 00000000004ae0c0  /data/data/com.invisatime/lib-0/libjsc.so
  #01  pc 00000000004ab608  /data/data/com.invisatime/lib-0/libjsc.so
  #02  pc 00000000004abd90  /data/data/com.invisatime/lib-0/libjsc.so
  #03  pc 0000000000498004  /data/data/com.invisatime/lib-0/libjsc.so
  #04  pc 000000000088ea1c  /data/data/com.invisatime/lib-0/libjsc.so
  #05  pc 000000000088f14c  /data/data/com.invisatime/lib-0/libjsc.so
  #06  pc 000000000088527c  /data/data/com.invisatime/lib-0/libjsc.so
  #07  pc 00000000008929f0  /data/data/com.invisatime/lib-0/libjsc.so
  #08  pc 00000000008a5098  /data/data/com.invisatime/lib-0/libjsc.so
  #09  pc 0000000000081938  /system/lib64/libc.so (__pthread_start(void*)+36)
  #10  pc 0000000000023478  /system/lib64/libc.so (__start_thread+68)

[xanderdeseyn]

I'm seeing this on at least 5 different devices. Anyone came up with a solution?

[j-wang]

@n1ghtly If you have the ability to do so, it might be worth trying to upgrade to 0.60.4 and turn Hermes on. See @Kudo's comment here:

#24261 (comment)

[dhess-zynga]

We're also seeing crashes on our build, w/ JSC r245459... @Kudo i attempted to symbolicate using your instructions from #25494 (comment), and here's what I came up with:

********** Crash dump: **********
pid: 0, tid: 0 >>> APPNAME <<<
Stack frame #00  pc 00000000000f7748  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::AccessCase::propagateTransitions(JSC::SlotVisitor&) const at sfp-exceptions.c:?
Stack frame #01  pc 0000000000143fe8  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::PolymorphicAccess::propagateTransitions(JSC::SlotVisitor&) const at sfp-exceptions.c:?
Stack frame #02  pc 000000000012f0a8  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::CodeBlock::propagateTransitions(JSC::ConcurrentJSLocker const&, JSC::SlotVisitor&) at sfp-exceptions.c:?
Stack frame #03  pc 0000000000139484  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::ExecutableToCodeBlockEdge::runConstraint(JSC::ConcurrentJSLocker const&, JSC::VM&, JSC::SlotVisitor&) at sfp-exceptions.c:?
Stack frame #04  pc 000000000013900c  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::ExecutableToCodeBlockEdge::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) at sfp-exceptions.c:?
Stack frame #05  pc 00000000001fb9c4  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const at sfp-exceptions.c:?
Stack frame #06  pc 00000000001f8e90  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::SlotVisitor::drain(WTF::MonotonicTime) at sfp-exceptions.c:?
Stack frame #07  pc 00000000001f96bc  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime) at sfp-exceptions.c:?
Stack frame #08  pc 00000000001e41a0  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_17>::run() at sfp-exceptions.c:?
Stack frame #09  pc 00000000006171ec  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()>, WTF::DumbPtrTraits<WTF::SharedTask<void ()> > > const&) at sfp-exceptions.c:?
Stack frame #10  pc 0000000000617950  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine WTF::ParallelHelperPool::Thread::work() at sfp-exceptions.c:?
Stack frame #11  pc 000000000060de7c  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call() at sfp-exceptions.c:?
Stack frame #12  pc 000000000061b084  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) at sfp-exceptions.c:?
Stack frame #13  pc 0000000000646dc8  /data/app/APPNAME-7N8FNwyuRgPc5XMrSr_hjQ==/lib/arm64/libjsc.so: Routine WTF::wtfThreadEntryPoint(void*) at sfp-exceptions.c:?
Stack frame #14  pc 0000000000069974  /system/lib64/libc.so (__pthread_start(void*)+36)
Stack frame #15  pc 000000000001f864  /system/lib64/libc.so (__start_thread+68)

[mcuelenaere]

We can confirm that the same issue occurs on beyondx (Samsung Galaxy S10 5G) on Android 9, which has an Exynos 9820 (ARMv8.2):

backtrace:
  #00  pc 00000000000f7748  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::AccessCase::propagateTransitions(JSC::SlotVisitor&) const+16)
  #01  pc 0000000000143fe8  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::PolymorphicAccess::propagateTransitions(JSC::SlotVisitor&) const+48)
  #02  pc 000000000012f0a8  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::CodeBlock::propagateTransitions(JSC::ConcurrentJSLocker const&, JSC::SlotVisitor&)+556)
  #03  pc 0000000000139484  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::ExecutableToCodeBlockEdge::runConstraint(JSC::ConcurrentJSLocker const&, JSC::VM&, JSC::SlotVisitor&)+40)
  #04  pc 000000000013900c  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::ExecutableToCodeBlockEdge::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)+1044)
  #05  pc 00000000001fb9c4  /data/app/{APP_NAME}/lib/arm64/libjsc.so (_ZZN3JSC11SlotVisitor5drainEN3WTF13MonotonicTimeEENK3$_3clERNS_14MarkStackArrayE+324)
  #06  pc 00000000001f8e90  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::SlotVisitor::drain(WTF::MonotonicTime)+132)
  #07  pc 00000000001f96bc  /data/app/{APP_NAME}/lib/arm64/libjsc.so (JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime)+580)
  #08  pc 00000000001e41a0  /data/app/{APP_NAME}/lib/arm64/libjsc.so (_ZN3WTF17SharedTaskFunctorIFvvEZN3JSC4Heap13runBeginPhaseENS2_11GCConductorEE4$_17E3runEv+580)
  #09  pc 00000000006171ec  /data/app/{APP_NAME}/lib/arm64/libjsc.so (WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()>, WTF::DumbPtrTraits<WTF::DumbPtrTraits>> const&)+40)
  #10  pc 0000000000617950  /data/app/{APP_NAME}/lib/arm64/libjsc.so (WTF::ParallelHelperPool::Thread::work()+16)
  #11  pc 000000000060de7c  /data/app/{APP_NAME}/lib/arm64/libjsc.so (_ZN3WTF8FunctionIFvvEE15CallableWrapperIZNS_15AutomaticThread5startERKNS_14AbstractLockerEE3$_0E4callEv+376)
  #12  pc 000000000061b084  /data/app/{APP_NAME}/lib/arm64/libjsc.so (WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)+212)
  #13  pc 0000000000646dc8  /data/app/{APP_NAME}/lib/arm64/libjsc.so (WTF::wtfThreadEntryPoint(void*)+4)
  #14  pc 0000000000084148  /system/lib64/libc.so (__pthread_start(void*)+64)
  #15  pc 0000000000023b28  /system/lib64/libc.so (__start_thread+68)

[Kudo]

Thank you all and especially @dhess-zynga providing symbolicated backtrace.
It looks like the crash point are mostly the same.
However, I am afraid that I am not able to help with this case if there's no reproduced steps.
The crash seems happened at JSC bytecode being GCed during access.
Without the JS source code & reproduce steps, it is hard to troubleshoot such problem for me.
Maybe it is the time to try upgrading RN 0.60.4 and use Hermes engine.
Or if you need a JSC disabled JIT (based on WebKitGTK 2.24), please feel free to let me know.