Native SIGSEGV crashes in mono_method_to_ir #109111
Comments
|
Could this issue be related to Unity-Technologies/mono#1796? |
|
Additionally, some of the repots include GWP-ASan stacktrace: |
|
@vitek-karas @akoeplinger assigning to you since I have no idea of the current area "owners" in MonoVM :) Please redirect as needed (and possibly move to |
dotnet-issue-labeler
bot
added
the
needs-area-label
dotnet-policy-service
bot
added
the
untriaged
|
Tagging subscribers to 'arch-android': @vitek-karas, @simonrozsival, @steveisok, @akoeplinger |
lambdageek
added
area-Codegen-JIT-mono
and removed
needs-area-label
|
Tagging subscribers to this area: @lambdageek, @steveisok |
|
@steveisok could you please take a look at the crashlogs? |
|
I tried to get some line numbers for this stack trace: and lldb says which is this line runtime/src/mono/mono/mini/method-to-ir.c Line 5709 in 82d4dbf inlined from here runtime/src/mono/mono/mini/method-to-ir.c Line 7132 in 82d4dbf which looks sus because @steveisok next steps here would be to make some kind of test case (I guess try to get an Update2 ok, So I'm not actually sure how to intentionally crash us here. |
|
Ok, after a couple hundred iterations, I got this to crash inside using System;
using System.Collections;
using System.Runtime.CompilerServices;
public class C {
[MethodImpl(MethodImplOptions.AggressiveInlining)]
public string M(int y, int p, int q, int n, int m, int o, int[,] s) {
return (s as IEnumerable).GetEnumerator().ToString();
}
[MethodImpl(MethodImplOptions.NoInlining)]
public string Q(int[,] s) {
return M(0, 0, 0, 0, 0, 0, s);
}
public static void Main()
{
C c = new();
int[,] x = new int[5,10];
Console.WriteLine(c.Q(x));
}
}So there's definitely bad inputs here. I'm not 100% confident that this is the exact same crash as OP is reporting because while the arm64 stack traces makes sense, my lldb is giving me very weird debug info for the arm32 crashes. I suspect I'm not configuring it correctly, but maybe the actual issue is that i'm misinterpreting the arm64 crashes too and I just happened to have found a different issue. But fixing the bug that I found I think the right move is to change |
There exists a possibility where the klass being passed to try_prepare_objaddr_callvirt_optimization is not legit. This can result in unpredictable crashes. To fix, we pass the MonoType and flush out the MonoClass by calling mono_class_from_mono_type_internal. Fixes dotnet#109111
dotnet-policy-service
bot
added
the
in-pr
|
we also hit this crash, our backtrace: |
|
Is there any way to work around this? |
|
It has to be a method that calls an interface or virtual method on one of its own arguments. And the type of the argument has to be something other than a class. I could only get it to happen with a multi-dimensional array. The method IL has to have ldarg+callvirt |
There exists a possibility where the klass being passed to try_prepare_objaddr_callvirt_optimization is not legit. This can result in unpredictable crashes. To fix, we pass the MonoType and flush out the MonoClass by calling mono_class_from_mono_type_internal. Fixes #109111
dotnet-policy-service
bot
removed
the
untriaged
There exists a possibility where the klass being passed to try_prepare_objaddr_callvirt_optimization is not legit. This can result in unpredictable crashes. To fix, we pass the MonoType and flush out the MonoClass by calling mono_class_from_mono_type_internal. Fixes #109111
There exists a possibility where the klass being passed to try_prepare_objaddr_callvirt_optimization is not legit. This can result in unpredictable crashes. To fix, we pass the MonoType and flush out the MonoClass by calling mono_class_from_mono_type_internal. Fixes #109111
There exists a possibility where the klass being passed to try_prepare_objaddr_callvirt_optimization is not legit. This can result in unpredictable crashes. To fix, we pass the MonoType and flush out the MonoClass by calling mono_class_from_mono_type_internal. Fixes dotnet#109111
Android framework version
net8.0-android, net9.0-android
Affected platform version
.NET 8.0.303, .NET 9-rc2
Description
After switching from Xamarin.Android to .Net8 (and later to .Net9) a new native crash group has appeared in the GooglePlay Console, which seems to be related to the Jit compiler optimizations.
Here are some stacktrace examples from .Net8 releases:
and from .Net9 release:
Steps to Reproduce
Unfortunately, we don't have exact steps to reproduce. We can't (at least reliably) reproduce it during testing phase, but we see a crash group in the GooglePlay Console with a noticeable counter every time we try
.net-androidinstead ofXamarin.Android.Did you find any workaround?
No workaround found yet
Relevant log output
No response
The text was updated successfully, but these errors were encountered: