[Tiramisu] Bug-41: ART Crashed with JNI Error: Global Reference Table Overflow (Exit Code: 134) [229134124]

Fixed

Bug

Platform

adexe s nau

Status Update

No update yet.

Description

an...@gmail.com

created issue #1

Apr 14, 2022 11:15AM

The Test.java in the enclosed archive crashed ART with the following log:

04-14 13:02:36.774   756   756 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 756 (main), pid 756 (main)
04-14 13:02:37.357  1706  1706 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-14 13:02:37.357  1706  1706 F DEBUG   : Build fingerprint: 'google/sdk_gphone64_x86_64/emu64xa:Tiramisu/TPP2.220218.008/8250781:userdebug/dev-keys'
04-14 13:02:37.357  1706  1706 F DEBUG   : Revision: '0'
04-14 13:02:37.357  1706  1706 F DEBUG   : ABI: 'x86_64'
04-14 13:02:37.357  1706  1706 F DEBUG   : Timestamp: 2022-04-14 13:02:36.853176746+0200
04-14 13:02:37.357  1706  1706 F DEBUG   : Process uptime: 36s
04-14 13:02:37.357  1706  1706 F DEBUG   : Cmdline: dalvikvm -cp /data/local/tmp/test.jar Test
04-14 13:02:37.357  1706  1706 F DEBUG   : pid: 756, tid: 756, name: main  >>> dalvikvm <<<
04-14 13:02:37.357  1706  1706 F DEBUG   : uid: 2000
04-14 13:02:37.358  1706  1706 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
04-14 13:02:37.358  1706  1706 F DEBUG   : Abort message: 'JNI ERROR (app bug): global reference table overflow (max=51200)global reference table dump:
04-14 13:02:37.358  1706  1706 F DEBUG   :   Last 10 entries (of 51200):
04-14 13:02:37.358  1706  1706 F DEBUG   :     51199: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51198: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51197: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51196: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51195: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51194: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51193: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51192: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51191: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :     51190: 0x12e40348 java.lang.Class<Test>
04-14 13:02:37.358  1706  1706 F DEBUG   :   Summary:
04-14 13:02:37.358  1706  1706 F DEBUG   :     51196 of java.lang.Class (84 unique instances)
04-14 13:02:37.358  1706  1706 F DEBUG   :         2 of dalvik.system.PathClassLoader (1 unique instances)
04-14 13:02:37.358  1706  1706 F DEBUG   :         2 of java.lang.ThreadGroup (2 unique instances)'
04-14 13:02:37.358  1706  1706 F DEBUG   :     rax 0000000000000000  rbx 00000000000002f4  rcx 00007b45962e4cef  rdx 0000000000000006
04-14 13:02:37.358  1706  1706 F DEBUG   :     r8  00007b43a60fb391  r9  00007b43a60fb391  r10 00007ffc27eed710  r11 0000000000000217
04-14 13:02:37.358  1706  1706 F DEBUG   :     r12 000000000000000b  r13 000000005a000000  r14 00007ffc27eed708  r15 00000000000002f4
04-14 13:02:37.358  1706  1706 F DEBUG   :     rdi 00000000000002f4  rsi 00000000000002f4
04-14 13:02:37.358  1706  1706 F DEBUG   :     rbp 00007b44460d0010  rsp 00007ffc27eed700  rip 00007b45962e4cef
04-14 13:02:37.358  1706  1706 F DEBUG   : backtrace:
04-14 13:02:37.358  1706  1706 F DEBUG   :       #00 pc 000000000005ecef  /apex/com.android.runtime/lib64/bionic/libc.so (abort+191) (BuildId: 4a49f5f713524c798c22bb88f57b4576)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #01 pc 00000000007ed1c4  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort(char const*)+1124) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #02 pc 0000000000019a8c  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter(std::__1::function<void (char const*)>&&)::$_3::__invoke(char const*)+60) (BuildId: 9ef8d511e84bdefdffb4d4d405625b31)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #03 pc 0000000000018fde  /apex/com.android.art/lib64/libbase.so (android::base::LogMessage::~LogMessage()+350) (BuildId: 9ef8d511e84bdefdffb4d4d405625b31)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #04 pc 00000000005fa8d2  /apex/com.android.art/lib64/libart.so (art::JavaVMExt::AddGlobalRef(art::Thread*, art::ObjPtr<art::mirror::Object>)+322) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #05 pc 00000000005adf3b  /apex/com.android.art/lib64/libart.so (art::jit::JitCompileTask::JitCompileTask(art::ArtMethod*, art::jit::JitCompileTask::TaskKind, art::CompilationKind)+875) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #06 pc 00000000005b1ad5  /apex/com.android.art/lib64/libart.so (art::jit::Jit::EnqueueCompilation(art::ArtMethod*, art::Thread*)+277) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #07 pc 000000000093c124  /apex/com.android.art/lib64/libart.so (NterpHotMethod+244) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #08 pc 000000000036f499  /apex/com.android.art/lib64/libart.so (nterp_hot_method+73) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #09 pc 000000000036e34b  /apex/com.android.art/lib64/libart.so (nterp_helper+24411) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #10 pc 0000000000000dec  [anon:dalvik-classes.dex extracted in memory from /data/local/tmp/test.jar] (Test.testMethod+80)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #11 pc 0000000000369288  /apex/com.android.art/lib64/libart.so (nterp_helper+3736) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #12 pc 0000000000007014  [anon:dalvik-classes.dex extracted in memory from /data/local/tmp/test.jar] (Test.main+148)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #13 pc 0000000000372016  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+806) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #14 pc 00000000003f1a49  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+265) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #15 pc 00000000007e4fc1  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, __va_list_tag*)+465) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #16 pc 0000000000644a74  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, __va_list_tag*)+676) (BuildId: f9c22944c82b378b175059614f9891e8)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #17 pc 0000000000002a84  /apex/com.android.art/bin/dalvikvm64 (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+164) (BuildId: c4b9abdc3d0244c2262af6c81d3213d5)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #18 pc 000000000000271c  /apex/com.android.art/bin/dalvikvm64 (art::dalvikvm(int, char**)+2060) (BuildId: c4b9abdc3d0244c2262af6c81d3213d5)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #19 pc 0000000000001ef5  /apex/com.android.art/bin/dalvikvm64 (main+5) (BuildId: c4b9abdc3d0244c2262af6c81d3213d5)
04-14 13:02:37.358  1706  1706 F DEBUG   :       #20 pc 00000000000505f9  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+89) (BuildId: 4a49f5f713524c798c22bb88f57b4576)

Please also check the following link for the bugreport (of adb bugreport): https://drive.google.com/file/d/19nXs2GzqsG8UlxRZ_9rJ5BnOxYRFyxWq/view?usp=sharing

We have already shared the above bugreport with android-bugreport@google.com.

Environment to reproduce the problem

Android Build: Tiramisu; TPP2.220218.008

$ adb shell getprop ro.system.build.id
TPP2.220218.008

Android Build Tools: bulid-tools;33.0.0-rc2

$ ./build-tools/33.0.0-rc2/d8 --version
D8 3.3.11-dev (build 5d015d7a69cc8b662b4f28a71ff2a4dfd5adc1bb from go/r8bot (luci-r8-custom-ci-xenial-13-fsvv))

HotSpot and OpenJDK: java-11-openjdk-amd64

$ java -version
openjdk version "11.0.14" 2022-01-18
OpenJDK Runtime Environment (build 11.0.14+9-Ubuntu-0ubuntu2.20.04)
OpenJDK 64-Bit Server VM (build 11.0.14+9-Ubuntu-0ubuntu2.20.04, mixed mode, sharing)
$ javac -version
javac 11.0.14

Steps to reproduce the problem (including sample code if appropriate)

Note, Test.class and test.jar are precompiled using javac and d8 as aforementioned

Push test.jar to the emulator

$ adb push test.jar /data/local/tmp/

Run in dalvikvm

$ adb shell dalvikvm -cp /data/local/tmp/test.jar Test

Check the return code

$ echo $?

What happened

ART crashed with return code 134

What you think the correct behavior should be

ART does not crash

deleted

Restricted

0 B

Comments

an...@gmail.com <an...@gmail.com> #2Apr 14, 2022 11:17AM

Thanks for filling this, HiltViewModelFactory wraps around a SavedStateViewModelFactory which is also the default one for non Hilt injected Fragments and Activities, it seems there is some key conflicts, I'll investigate and comer back with more info soon, thanks for the sample app!

ve...@google.com <ve...@google.com> Apr 14, 2022 12:34PM

Assigned to ve...@google.com.

ve...@google.com <ve...@google.com> Apr 14, 2022 05:45PM

Status: Assigned (reopened)

ve...@google.com <ve...@google.com> #3May 4, 2022 05:18PM

Marked as fixed.

Project: platform/frameworks/support
Branch: androidx-master-dev

commit d76172ec45a778efe5f46b6ad1a50ae24241d14d
Author: Daniel Santiago Rivera <danysantiago@google.com>
Date: Tue Jun 16 14:50:23 2020

Avoid SavedStateHandle key conflict in HiltViewModelFactory.

When delegating to the SavedStateViewModelFactory to create
ViewModels that are not Hilt injected, the factory will attempt
to retrieve a SavedStateHandler using a controller with the same
key as the SavedStateHandle passed into the abstract create() method
of AbstractSavedStateViewModelFactory for which the
HiltViewModelFactory implements. Therefore causing a key conflict.

In this change we avoid the key conflict collision by prefixing the
before delegating to SavedStateViewModelFactory. Since ViewModels
will be either create by one or the other factory, it is safe to
mangle the key. Meanwhile, even though the key is also used to
add a tag to the ViewModel for cleanup, the tag is only added
if the key used is not present. When SavedStateViewModelFactory
tags the ViewModel and then a second time in once
AbstractSavedStateViewModelFactory#create() returns, the tag
is not overridden (lucky us).

This fixes a bug when mixing vanilla ViewModels and Hilt injected
ones.

Bug: 158737069
Test: ViewModelApp Integration Tests
Change-Id: I86ae254c2f26795c900317d42041319fd279e545

M buildSrc/src/main/kotlin/androidx/build/LibraryVersions.kt
M hilt/hilt-lifecycle-viewmodel/src/main/java/androidx/hilt/lifecycle/HiltViewModelFactory.java
M hilt/integration-tests/viewmodelapp/build.gradle
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/ActivityInjectionTest.kt
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/BaseActivityInjectionTest.kt
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/BaseFragmentInjectionTest.kt
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/Bindings.kt
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/FragmentInjectionTest.kt
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/MyViewModels.kt
A hilt/integration-tests/viewmodelapp/src/androidTest/java/androidx/hilt/integration/viewmodelapp/TestRunner.kt
A hilt/integration-tests/viewmodelapp/src/debug/AndroidManifest.xml

https://android-review.googlesource.com/1339862

Issue 229134124

Description

Issue summary

Comments

an...@gmail.com <an...@gmail.com> #2Apr 14, 2022 11:17AM

ve...@google.com <ve...@google.com> Apr 14, 2022 12:34PM

ve...@google.com <ve...@google.com> Apr 14, 2022 05:45PM

ve...@google.com <ve...@google.com> #3May 4, 2022 05:18PM

Add comment

Issue metadata