Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

6.0.3 iOS native crash - Attempted to dereference null pointer. #3112

Closed
cristianoccazinsp opened this issue Aug 6, 2020 · 70 comments
Closed

Comments

@cristianoccazinsp
Copy link

cristianoccazinsp commented Aug 6, 2020

Goals

Regular offline use (no syncing)

Expected Results

No crashes

Actual Results

Random crash due to garbage / null reference.

The following crash was reported from Realm code.

EXC_BAD_ACCESS Attempted to dereference null pointer. 
    Tenant Move-In realm::jsc::ObjectWrap<realm::js::SessionClass<realm::jsc::Types> >::set_readonly_property(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_is_partial_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_is_partial_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::write>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

While I understand this is probably extremely hard to debug/reproduce in a controlled environment, it would be great for Realm to attempt to handle null pointer exceptions in a way that won't crash the whole app, but rather cause a query error or something. This is probably one out of 10 different realm-related native crashes that are reported daily from our crash reporting tool.

Similar crashes:
#3111
#2853
#2828
#2713

Steps to Reproduce

Regular realm usage without any sync/online features.

Code Sample

Regular offline use, no special code required.

Version of Realm and Tooling

  • Realm JS SDK Version: ? 6.0.3
  • Node or React Native: ? React Native 0.61.5
  • Client OS & Version: ? iOS 13.6 / iPhone 8
  • Which debugger for React Native: None - production build
@cristianoccazinsp
Copy link
Author

Another one popped out today... May be related:

EXC_BAD_ACCESS Attempted to dereference garbage pointer 0x10. 
    Frameworks/JavaScriptCore.framework/JavaScriptCore bool JSC::symbolTableGet<JSC::JSGlobalObject>(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::JSObject::get(JSC::JSGlobalObject*, JSC::PropertyName) const
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectGetProperty
    zinspector3 void std::__1::__call_once_proxy<std::__1::tuple<realm::SyncManager& realm::js::syncManagerShared<realm::jsc::Types>(realm::jsc::Types::Context&)::{lambda()#1}&&> >(void*)
    zinspector3 void std::__1::__call_once_proxy<std::__1::tuple<realm::SyncManager& realm::js::syncManagerShared<realm::jsc::Types>(realm::jsc::Types::Context&)::{lambda()#1}&&> >(void*)
    zinspector3 bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    zinspector3 OpaqueJSValue const* realm::js::wrap<&realm::js::ResultsClass<realm::jsc::Types>::get_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const**)
    zinspector3 OpaqueJSValue const* realm::js::wrap<&realm::js::ResultsClass<realm::jsc::Types>::sorted>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

We have been getting a significant amount of crashes ever since 5.0.3 to 6.x migration from Realm.

@brianomchugh
Copy link

@cristianoccazinsp did you not get these errors with 5.03? I just started testing my first app with realm and already ran into these errors (specifically the 2nd one you posted)

@cristianoccazinsp
Copy link
Author

I definitely got various similar errors with 5.0.3, but they have become much more frequent with 6.x, and also look like new errors (and possibly even a memleak).

@cristianoccazinsp
Copy link
Author

Another similar one just popped, yet different:

EXC_BAD_ACCESS Attempted to dereference garbage pointer 0x8. 
    zinspector3 realm::util::EventLoopSignal<realm::util::EventLoopDispatcher<void (std::__1::shared_ptr<realm::SyncSession>, realm::SyncError)>::Callback>::EventLoopSignal(realm::util::EventLoopDispatcher<void (std::__1::shared_ptr<realm::SyncSession>, realm::SyncError)>::Callback&&)::{lambda(void const*)#2}::__invoke(void const*)
    zinspector3 bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    zinspector3 bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    zinspector3 realm::util::EventLoopSignal<realm::util::EventLoopDispatcher<void (realm::ThreadSafeReference<realm::Realm>&&, std::exception_ptr)>::Callback>::EventLoopSignal(realm::util::EventLoopDispatcher<void (realm::ThreadSafeReference<realm::Realm>&&, std::exception_ptr)>::Callback&&)::{lambda(void const*)#2}::__invoke(void const*)
    zinspector3 OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    zinspector3 realm::util::EventLoopSignal<realm::util::EventLoopDispatcher<void (realm::ThreadSafeReference<realm::Realm>&&, std::exception_ptr)>::Callback>::EventLoopSignal(realm::util::EventLoopDispatcher<void (realm::ThreadSafeReference<realm::Realm>&&, std::exception_ptr)>::Callback&&)::{lambda(void const*)#2}::__invoke(void const*)
    zinspector3 OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::write>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

Why would "sync session" even be used if the database is used entirely offline? Either way, there are about 10 crashes / day for an app that's actively used by about 2000 people. The number seem to have increased significantly after the 5 to 6 migration.

Looking at breadcrumbs, this one seemed to happen in a very curious scenario:

  • App was sleeping / background for ~ minutes
  • App resumed, and 2 seconds afterwards crashed with this error.

@cristianoccazinsp
Copy link
Author

Here's another crash stack trace, looks like this is a recurring crash. I wish I could provide more info:

EXC_BAD_ACCESS Attempted to dereference garbage pointer 0x8. 
    Tenant Move-In realm::jsc::ObjectWrap<realm::js::SessionClass<realm::jsc::Types> >::set_readonly_property(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_is_partial_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_is_partial_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::write>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

@cristianoccazinsp
Copy link
Author

Sorry for the spam, here's another one (new) crash, a SIGABRT this time. These crashes are happening too frequently.

SIGABRT
    /usr/lib/system/libsystem_kernel.dylib ___pthread_kill
    /usr/lib/system/libsystem_pthread.dylib _pthread_kill
    /usr/lib/system/libsystem_c.dylib _abort
    Tenant Move-In realm::ObjKey realm::Table::find_first<realm::util::Optional<long long> >(realm::ColKey, realm::util::Optional<long long>) const
    Tenant Move-In realm::ObjKey realm::Table::find_first<realm::util::Optional<long long> >(realm::ColKey, realm::util::Optional<long long>) const
    Tenant Move-In realm::ObjKey realm::Table::find_first<realm::util::Optional<long long> >(realm::ColKey, realm::util::Optional<long long>) const
    Tenant Move-In realm::Obj& realm::Obj::set<realm::Timestamp>(realm::ColKey, realm::Timestamp, bool)
    Tenant Move-In realm::StringData realm::ConstObj::get<realm::StringData>(realm::ColKey) const
    Tenant Move-In void std::__1::__call_once_proxy<std::__1::tuple<void (&)()> >(void*)
    Tenant Move-In void std::__1::__call_once_proxy<std::__1::tuple<void (&)()> >(void*)
    Tenant Move-In void std::__1::__call_once_proxy<std::__1::tuple<void (&)()> >(void*)
    Tenant Move-In realm::Obj& realm::Obj::set<realm::Timestamp>(realm::ColKey, realm::Timestamp, bool)
    Tenant Move-In realm::util::FunctionRef<unsigned long (realm::BPlusTreeNode*, unsigned long)>::FunctionRef<realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&>(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&)::{lambda(void*, realm::BPlusTreeNode*, unsigned long)#1}::__invoke(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&, realm::BPlusTreeNode*, unsigned long)
    Tenant Move-In realm::util::FunctionRef<unsigned long (realm::BPlusTreeNode*, unsigned long)>::FunctionRef<realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&>(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&)::{lambda(void*, realm::BPlusTreeNode*, unsigned long)#1}::__invoke(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&, realm::BPlusTreeNode*, unsigned long)
    Tenant Move-In realm::util::FunctionRef<unsigned long (realm::BPlusTreeNode*, unsigned long)>::FunctionRef<realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&>(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&)::{lambda(void*, realm::BPlusTreeNode*, unsigned long)#1}::__invoke(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&, realm::BPlusTreeNode*, unsigned long)
    Tenant Move-In realm::util::FunctionRef<unsigned long (realm::BPlusTreeNode*, unsigned long)>::FunctionRef<realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&>(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&)::{lambda(void*, realm::BPlusTreeNode*, unsigned long)#1}::__invoke(realm::BPlusTree<realm::Timestamp>::erase(unsigned long)::{lambda(realm::BPlusTreeNode*, unsigned long)#1}&, realm::BPlusTreeNode*, unsigned long)
    Tenant Move-In realm::Obj realm::Results::get<realm::Obj>(unsigned long)
    Tenant Move-In unsigned long realm::Results::index_of<realm::util::Optional<double> >(realm::util::Optional<double> const&)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::ResultsClass<realm::jsc::Types>::get_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::ResultsClass<realm::jsc::Types>::get_length>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::JSCallbackObject<JSC::JSNonFinalObject>::getStaticValue(JSC::JSGlobalObject*, JSC::PropertyName)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::JSCallbackObject<JSC::JSNonFinalObject>::getOwnPropertySlot(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_slow_path_get_by_id
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

@cristianoccazinsp
Copy link
Author

Crash logs from XCode reporting. Interestingly, it says it should be reported here:

Screen Shot 2020-08-11 at 14 51 10

Screen Shot 2020-08-11 at 14 52 36

@kneth I have attached the XCode crash log files, perhaps this can help with diagnosing the problem.
crash files.zip

@cristianoccazinsp
Copy link
Author

This is a new one, also on 6.0.3:

EXC_BAD_ACCESS Attempted to dereference null pointer. 
    Tenant Move-In realm::Obj& realm::Obj::set<realm::Timestamp>(realm::ColKey, realm::Timestamp, bool)
    Tenant Move-In bool realm::Array::find<realm::Less, (realm::Action)0, 64ul>(long long, unsigned long, unsigned long, unsigned long, realm::QueryState<long long>*) const
    Tenant Move-In realm::Obj& realm::Obj::set<realm::Timestamp>(realm::ColKey, realm::Timestamp, bool)
    Tenant Move-In realm::Obj& realm::Obj::set<realm::Timestamp>(realm::ColKey, realm::Timestamp, bool)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmObjectClass<realm::jsc::Types>::get_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmObjectClass<realm::jsc::Types>::get_property>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::JSCallbackObject<JSC::JSNonFinalObject>::call(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_slow_path_get_by_id
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

Perhaps this is caused by having a single global realm instance across the app instead of creating a new one before each query?

@oojikoo oojikoo mentioned this issue Aug 20, 2020
@kneth
Copy link
Contributor

kneth commented Sep 2, 2020

@cristianoccazinsp As we are trying to get a hold on this issue, I would like to know if you see the same error on Android?

@cristianoccazinsp
Copy link
Author

Haven't seen this on Android at all.

@kneth
Copy link
Contributor

kneth commented Sep 3, 2020

@cristianoccazinsp

App was sleeping / background for ~ minutes
App resumed, and 2 seconds afterwards crashed with this error.

Can it be related to #3162?

@cristianoccazinsp
Copy link
Author

@kneth the crash seems different, and I'm not entirely sure how to reproduce that one. Does realm just crash if the app is in background and the phone is locked? I'm sure I have seen the app run just fine in that situation since we use background tasks all the time.

@kneth
Copy link
Contributor

kneth commented Sep 3, 2020

@cristianoccazinsp When an iOS app is suspended (in recent iOS versions), the data and files are encrypted. Once the app is activated, the decryption might happen later than Realm's access to the realm files. Then Realm will believe the file is corrupted. Unfortunately it is easy to solve (a pure Objective C or Swift app can be fixed: realm/realm-swift#5912 (comment)).

I wanted to bring it to your attention and have you verify it is not the same issue.

@cristianoccazinsp
Copy link
Author

@kneth I will try to reproduce the scenario locally to see if it is in fact the same issue. I never noticed any crash when the phone is suspended though, but perhaps I wasn't giving it enough time.

On the other hand, the crash / stack trace message seems different, doesn't it?

@kneth
Copy link
Contributor

kneth commented Sep 4, 2020

@cristianoccazinsp Thanks for the update.

On the other hand, the crash / stack trace message seems different, doesn't it?

Indeed but corruption (true or due to an encrypted file) will turn up is many random ways.

You mention that you are not using sync, but the original stack trace hints otherwise:

realm::jsc::ObjectWrap<realm::js::SessionClass<realm::jsc::Types> >::set_readonly_property(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const*, OpaqueJSValue const**)

@cristianoccazinsp
Copy link
Author

Hmm, I'm definitely not using sync, at least not on purpose. Having said this, I have never been able to reproduce the crash myself, not even locking the device.

Would it be too complex to add some extra defensive programming here and there to add null checks and prevent crashes? It would be great to have just the query crash rather than the whole app, even if we don't know why the object was suddenly garbage collected / null.

@kneth
Copy link
Contributor

kneth commented Sep 7, 2020

@cristianoccazinsp

Would it be too complex to add some extra defensive programming here and there to add null checks and prevent crashes?

It is possible, and a JavaScript exception will be better in many cases. I'll add it to the backlog and get it prioritized.

@cristianoccazinsp
Copy link
Author

I keep seeing iOS crashes with similar stack traces, and they all seem to happen with very little free memory (~45mb reported by the crash analytics tool). Not sure how easy it would be to debug a possible memory leak within the C++ or Objective C Realm's code, or even in the non Realm code. I've tried to profile the app for a while and didn't observe any memory leak or anything that would cause the app to end up with so little memory.

Here's another stack trace:

EXC_BAD_ACCESS Attempted to dereference garbage pointer 0x8. 
    Tenant Move-In realm::jsc::ObjectWrap<realm::js::ObservableClass<realm::jsc::Types> >::set_readonly_property(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_is_partial_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_is_partial_realm>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**)
    Tenant Move-In OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::write>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    Tenant Move-In facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

@steffenagger
Copy link
Contributor

@cristianoccazinsp We have released v6.1.1 with core fixes which addresses these issues. Could I ask you to upgrade & test this out?

@cristianoccazinsp
Copy link
Author

I will, it may take some days or a few weeks until the release is live and we get enough testing, but I will keep you posted.

@steffenagger
Copy link
Contributor

@cristianoccazinsp any update on this?

@cristianoccazinsp
Copy link
Author

@steffenagger I'm still seeing crashes. See the following stack trace (different app but updated Realm (6.1.2) with the same code):

EXC_BAD_ACCESS Attempted to dereference garbage pointer 0x10. 
    Frameworks/JavaScriptCore.framework/JavaScriptCore bool JSC::symbolTableGet<JSC::JSGlobalObject>(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::JSObject::get(JSC::JSGlobalObject*, JSC::PropertyName) const
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectGetProperty
    zinspector3 realm::js::SSLVerifyCallbackSyncThreadFunctor<realm::jsc::Types>::main_loop_handler(realm::js::SSLVerifyCallbackSyncThreadFunctor<realm::jsc::Types>*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned short, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, int)
    zinspector3 realm::js::SSLVerifyCallbackSyncThreadFunctor<realm::jsc::Types>::main_loop_handler(realm::js::SSLVerifyCallbackSyncThreadFunctor<realm::jsc::Types>*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned short, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, int)
    zinspector3 realm::NodeHeader::get_byte_size_from_header(char const*)
    zinspector3 OpaqueJSValue const* realm::js::wrap<&realm::js::ResultsClass<realm::jsc::Types>::get_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const**)
    zinspector3 OpaqueJSValue const* realm::js::wrap<&realm::js::ResultsClass<realm::jsc::Types>::sorted>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
    Frameworks/JavaScriptCore.framework/JavaScriptCore long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _llint_entry
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToJavaScript
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _vmEntryToNative
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
    Frameworks/JavaScriptCore.framework/JavaScriptCore _JSObjectCallAsFunction
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopDoBlocks
    Frameworks/CoreFoundation.framework/CoreFoundation ___CFRunLoopRun
    Frameworks/CoreFoundation.framework/CoreFoundation _CFRunLoopRunSpecific
    zinspector3 facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)
    Frameworks/Foundation.framework/Foundation ___NSThread__start__
    /usr/lib/system/libsystem_pthread.dylib __pthread_start

@kneth
Copy link
Contributor

kneth commented Oct 5, 2020

@cristianoccazinsp

realm::js::wrap<&realm::js::ResultsClassrealm::jsc::Types::sorted>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)

Does it also happen when you don't sort?

@cristianoccazinsp
Copy link
Author

I will need to go through the various stack traces to see if there are other similar crashes with realm in it, but it's impossible to tell since it happens randomly and only in production (i.e., can't reproduce locally).

@cristianoccazinsp
Copy link
Author

Here's another crash report, this time from XCode (seems more comprehensive than the above):

Thread 2 name:
Thread 2 Crashed:
0   zinspector3                   	0x00000001006dc85c std::__1::__hash_const_iterator<std::__1::__hash_node<std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unordered_map<std:... + 116 (__hash_table:2494)
1   zinspector3                   	0x00000001006dc814 std::__1::__unordered_map_hasher<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_trait... + 4 (unordered_map:445)
2   zinspector3                   	0x00000001006dc814 std::__1::__hash_const_iterator<std::__1::__hash_node<std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unordered_map<std:... + 44 (__hash_table:2489)
3   zinspector3                   	0x000000010070dc60 unsigned long std::__1::__hash_table<std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unordered_map<std::__1::basic_strin... + 20 (__hash_table:2718)
4   zinspector3                   	0x000000010070dc60 std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std:... + 20 (unordered_map:1282)
5   zinspector3                   	0x000000010070dc60 realm::jsc::ObjectWrap<realm::js::RealmObjectClass<realm::jsc::Types> >::create_instance_by_schema(OpaqueJSContext const*, OpaqueJSValue*&, realm::ObjectSchema const&, realm::js::RealmObject<realm:... + 388 (jsc_class.hpp:679)
6   zinspector3                   	0x000000010070d914 OpaqueJSValue* realm::js::Object<realm::jsc::Types>::create_instance_by_schema<realm::js::RealmObjectClass<realm::jsc::Types> >(OpaqueJSContext const*, OpaqueJSValue*&, realm::ObjectSchema const&, ... + 20 (jsc_object.hpp:125)
7   zinspector3                   	0x000000010070d914 realm::jsc::Types::Object realm::js::create_instance_by_schema<realm::jsc::Types, realm::js::RealmObjectClass<realm::jsc::Types> >(realm::jsc::Types::Context, realm::jsc::Types::Function&, realm::O... + 20 (js_types.hpp:369)
8   zinspector3                   	0x000000010070d914 realm::js::RealmObjectClass<realm::jsc::Types>::create_instance(OpaqueJSContext const*, realm::js::RealmObject<realm::jsc::Types>) + 220 (js_realm_object.hpp:146)
9   zinspector3                   	0x0000000100725ffc realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key(OpaqueJSContext const*, OpaqueJSValue*, realm::js::Arguments<realm::jsc::Types>&, realm::js::ReturnValue<realm::jsc::Types>&) + 272 (js_realm.hpp:935)
10  zinspector3                   	0x0000000100721484 OpaqueJSValue const* realm::js::wrap<&(realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key(OpaqueJSContext const*, OpaqueJSValue*, realm::js::Arguments<realm::jsc::Types>&, realm::js::... + 56 (jsc_class.hpp:989)
11  JavaScriptCore                	0x00000001bf843a0c long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*) + 420 (APICallbackFunction.h:63)
12  JavaScriptCore                	0x00000001bf7f8a88 llint_entry + 135240
13  JavaScriptCore                	0x00000001bf7f6118 llint_entry + 124632
14  JavaScriptCore                	0x00000001bf7f61c0 llint_entry + 124800
15  JavaScriptCore                	0x00000001bf7d77f8 vmEntryToJavaScript + 248
16  JavaScriptCore                	0x00000001bfd868c8 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 444 (JITCodeInlines.h:38)
17  JavaScriptCore                	0x00000001bff6c348 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 168 (CallData.cpp:59)
18  JavaScriptCore                	0x00000001bf858690 JSObjectCallAsFunction + 504 (JSObjectRef.cpp:738)
19  zinspector3                   	0x000000010072725c realm::js::Function<realm::jsc::Types>::call(OpaqueJSContext const*, OpaqueJSValue* const&, OpaqueJSValue* const&, unsigned long, OpaqueJSValue const* const*) + 32 (jsc_function.hpp:29)
20  zinspector3                   	0x000000010072725c realm::js::RealmClass<realm::jsc::Types>::write(OpaqueJSContext const*, OpaqueJSValue*, realm::js::Arguments<realm::jsc::Types>&, realm::js::ReturnValue<realm::jsc::Types>&) + 164 (js_realm.hpp:1078)
21  zinspector3                   	0x00000001007216e4 OpaqueJSValue const* realm::js::wrap<&(realm::js::RealmClass<realm::jsc::Types>::write(OpaqueJSContext const*, OpaqueJSValue*, realm::js::Arguments<realm::jsc::Types>&, realm::js::ReturnValue<realm... + 56 (jsc_class.hpp:989)
22  JavaScriptCore                	0x00000001bf843a0c long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*) + 420 (APICallbackFunction.h:63)
23  JavaScriptCore                	0x00000001bf7f8a88 llint_entry + 135240
24  JavaScriptCore                	0x00000001bf7f6118 llint_entry + 124632
25  JavaScriptCore                	0x00000001bf7f61c0 llint_entry + 124800
26  JavaScriptCore                	0x00000001bf7f6118 llint_entry + 124632
27  JavaScriptCore                	0x00000001bf7f75f4 llint_entry + 129972
28  JavaScriptCore                	0x00000001bf7f6118 llint_entry + 124632
29  JavaScriptCore                	0x00000001bf7f61c0 llint_entry + 124800
30  JavaScriptCore                	0x00000001bf7f6118 llint_entry + 124632
31  JavaScriptCore                	0x00000001bf7d77f8 vmEntryToJavaScript + 248
32  JavaScriptCore                	0x00000001bfd868c8 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 444 (JITCodeInlines.h:38)
33  JavaScriptCore                	0x00000001c0005158 JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*) + 712 (JSBoundFunction.cpp:63)
34  JavaScriptCore                	0x00000001bf7d7974 vmEntryToNative + 260
35  JavaScriptCore                	0x00000001bfd8691c JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 528 (Interpreter.cpp:900)
36  JavaScriptCore                	0x00000001bff6c348 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 168 (CallData.cpp:59)
37  JavaScriptCore                	0x00000001bf858690 JSObjectCallAsFunction + 504 (JSObjectRef.cpp:738)
38  zinspector3                   	0x00000001006af6a8 facebook::jsc::JSCRuntime::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long) + 172 (JSCRuntime.cpp:1208)
39  zinspector3                   	0x00000001006b79e0 facebook::jsi::Function::call(facebook::jsi::Runtime&, facebook::jsi::Value const*, unsigned long) const + 44 (jsi-inl.h:224)
40  zinspector3                   	0x00000001006b79e0 facebook::jsi::Function::call(facebook::jsi::Runtime&, std::initializer_list<facebook::jsi::Value>) const + 44 (jsi-inl.h:229)
41  zinspector3                   	0x00000001006b79e0 facebook::jsi::Value facebook::jsi::Function::call<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<c... + 244 (jsi-inl.h:237)
42  zinspector3                   	0x00000001006b7840 facebook::react::JSIExecutor::callFunction(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, st... + 68 (JSIExecutor.cpp:217)
43  zinspector3                   	0x00000001006b7840 decltype(std::__1::forward<facebook::react::JSIExecutor::callFunction(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std:... + 68 (type_traits:3545)
44  zinspector3                   	0x00000001006b7840 void std::__1::__invoke_void_return_wrapper<void>::__call<facebook::react::JSIExecutor::callFunction(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, st... + 68 (__functional_base:348)
45  zinspector3                   	0x00000001006b7840 std::__1::__function::__alloc_func<facebook::react::JSIExecutor::callFunction(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<ch... + 68 (functional:1546)
46  zinspector3                   	0x00000001006b7840 std::__1::__function::__func<facebook::react::JSIExecutor::callFunction(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, st... + 96 (functional:1720)
47  zinspector3                   	0x00000001005e1108 decltype(std::__1::forward<void (*&)(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)>(fp)(std::__1:... + 32 (type_traits:3545)
48  zinspector3                   	0x00000001005e1108 void std::__1::__invoke_void_return_wrapper<void>::__call<void (*&)(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::alloca... + 72 (__functional_base:348)
49  zinspector3                   	0x00000001006b5900 std::__1::__function::__value_func<void (std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)>::operator... + 32 (functional:1873)
50  zinspector3                   	0x00000001006b5900 std::__1::function<void (std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>)>::operator()(std::__1::fun... + 32 (functional:2548)
51  zinspector3                   	0x00000001006b5900 facebook::react::JSIExecutor::callFunction(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, st... + 356 (JSIExecutor.cpp:215)
52  zinspector3                   	0x00000001006abca4 std::__1::__function::__value_func<void (facebook::react::JSExecutor*)>::operator()(facebook::react::JSExecutor*&&) const + 24 (functional:1873)
53  zinspector3                   	0x00000001006abca4 std::__1::function<void (facebook::react::JSExecutor*)>::operator()(facebook::react::JSExecutor*) const + 24 (functional:2548)
54  zinspector3                   	0x00000001006abca4 facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>)::$_7::operator()() const + 48 (NativeToJsBridge.cpp:290)
55  zinspector3                   	0x00000001006abca4 decltype(std::__1::forward<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>)::$_7&>(fp)()) std::__1::__invoke<facebook::react::NativeToJ... + 48 (type_traits:3545)
56  zinspector3                   	0x00000001006abca4 void std::__1::__invoke_void_return_wrapper<void>::__call<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>)::$_7&>(facebook::react::Nati... + 48 (__functional_base:348)
57  zinspector3                   	0x00000001006abca4 std::__1::__function::__alloc_func<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>)::$_7, std::__1::allocator<facebook::react::NativeTo... + 48 (functional:1546)
58  zinspector3                   	0x00000001006abca4 std::__1::__function::__func<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>)::$_7, std::__1::allocator<facebook::react::NativeToJsBrid... + 60 (functional:1720)
59  zinspector3                   	0x00000001005fd1f8 std::__1::__function::__value_func<void ()>::operator()() const + 20 (functional:1873)
60  zinspector3                   	0x00000001005fd1f8 std::__1::function<void ()>::operator()() const + 20 (functional:2548)
61  zinspector3                   	0x00000001005fd1f8 facebook::react::tryAndReturnError(std::__1::function<void ()> const&) + 40 (RCTCxxUtils.mm:72)
62  zinspector3                   	0x0000000100609944 facebook::react::RCTMessageThread::tryFunc(std::__1::function<void ()> const&) + 24 (RCTMessageThread.mm:59)
63  CoreFoundation                	0x00000001b06aba4c __CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__ + 20 (CFRunLoop.c:1774)
64  CoreFoundation                	0x00000001b06ab1d8 __CFRunLoopDoBlocks + 264 (CFRunLoop.c:1815)
65  CoreFoundation                	0x00000001b06a6318 __CFRunLoopRun + 772 (CFRunLoop.c:2880)
66  CoreFoundation                	0x00000001b06a5ce8 CFRunLoopRunSpecific + 424 (CFRunLoop.c:3192)
67  zinspector3                   	0x00000001005f28e0 +[RCTCxxBridge runRunLoop] + 264 (RCTCxxBridge.mm:269)
68  Foundation                    	0x00000001b0b17e20 __NSThread__start__ + 848 (NSThread.m:724)
69  libsystem_pthread.dylib       	0x00000001b0443d98 _pthread_start + 156 (pthread.c:896)
70  libsystem_pthread.dylib       	0x00000001b044774c thread_start + 8

@steffenagger
Copy link
Contributor

steffenagger commented Oct 12, 2020

Seeing that all previous stack-traces springs from defaultTimeoutInvoker, combined with the declared React Native version: v0.61.5.
I'm asking myself if this could be related to this RN fix ("apps crashing on iOS 13.x when running timer in the background"), listed under iOS specific (for RN v0.62.0 changelog)?

@cristianoccazinsp It could be that the errors we're seeing here, happens when the app is closed/goes to the background AND is terminated prematurely (in context of RN).
I hate to recommend "just" updating RN, as it's usually not a trivial task - but in this case, perhaps an update would resolve the issue(s)?
We'll continue investigating, but are there a chance you could try updating RN to v0.62.0+?

@cristianoccazinsp
Copy link
Author

@steffenagger I have updated to RN 0.62 a while ago and some of these crashes still happen (like the one from the most recent stack trace I've uploaded).

@kneth
Copy link
Contributor

kneth commented Feb 5, 2021

@cristianoccazinsp

The stacktrace is a bit confusing since it looks like you are using sync: realm::jsc::ObjectWrap<realm::js::SessionClass<realm::jsc::Types> >, and as I recall, you are not using sync.

Moreover, do you observe the crashes on Android?

@cristianoccazinsp
Copy link
Author

@kneth I'm definitely not using sync. Also, no, I am only seeing this on iOS. Lastly, the same crash occurred to the same user twice already in less than 1 day, so it is also that happens "frequently".

I'm sorry I can't get a more detailed stack trace.

@ryanbourneuk
Copy link

Hey @kneth, just to dive in here, I'm also seeing crash logs similar to @cristianoccazinsp's most recent one - only on iOS and not using sync. Would it help for me to also upload an example? Another note, is that Sentry (and our own internal logging systems) show that the user has put the app in the background prior to the crash occurring. Might be related?

@kneth
Copy link
Contributor

kneth commented Feb 17, 2021

put the app in the background

I think it is actually an important observation. When you bring back an app from the background, the (encrypted) file system might not be ready so quickly. And since Realm instances are tied to Realm files (using mmap()), you might be accessing something not ready.

@ryanbourneuk
Copy link

@kneth Interesting! We had a suspicion internally that something like that would be the cause. We’ve been trying to guard against it at the JS layer by observing app state changes (and we only access realm from a wrapper, rather than multiple points in the codebase, so there's only one point to guard against), but I presume this is something that’ll need to be handled within Realm itself? Would you be able to advice on any potential remedies, for until a fix for this is released?

@cristianoccazinsp
Copy link
Author

@kneth if that was the case, shouldn't the errors be much more "friendlier" or reveal such issue? Also, shouldn't the crash be much more reproducible?

Reading from here https://developer.apple.com/documentation/uikit/protecting_the_user_s_privacy/encrypting_your_app_s_files?language=objc , which encryption level do you think Realm files use? My app works in background, and realm works in background just fine (most of the time at least), so it is either Complete unless open or Complete until first user authentication.

@cristianoccazinsp
Copy link
Author

Here's another one, no background it seems, or right after getting into background.

CrashReporter Key:  d2b05f2a7bddad8344d79bca0c228496c066504b
Hardware Model:     iPhone10,1
Process:            tmi3
Identifier:         com.tenantmovein.tmi3
Version:            3.0.32
Role:               Background
OS Version:         iOS 14.4
Exception Type:     EXC_BAD_ACCESS 
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference null pointer.

0   tmi3                    realm::jsc::ObjectWrap<realm::js::ObservableClass<realm::jsc::Types> >::set_readonly_property(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const*, OpaqueJSValue const**) (tmi3)
1   tmi3                    bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**) (tmi3)
2   tmi3                    bool realm::js::wrap<&realm::js::ListClass<realm::jsc::Types>::set_index>(OpaqueJSContext const*, OpaqueJSValue*, unsigned int, OpaqueJSValue const*, OpaqueJSValue const**) (tmi3)
3   tmi3                    OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_sync_session>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**) (tmi3)
4   tmi3                    OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::object_for_primary_key>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) (tmi3)
5   JavaScriptCore          long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
6   JavaScriptCore          _llint_entry
7   JavaScriptCore          _llint_entry
8   JavaScriptCore          _llint_entry
9   JavaScriptCore          _vmEntryToJavaScript
10  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
11  JavaScriptCore          JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
12  JavaScriptCore          _JSObjectCallAsFunction
13  tmi3                    OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::get_sync_session>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**) (tmi3)
14  tmi3                    OpaqueJSValue const* realm::js::wrap<&realm::js::RealmClass<realm::jsc::Types>::write>(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) (tmi3)
15  JavaScriptCore          long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
16  JavaScriptCore          _llint_entry
17  JavaScriptCore          _llint_entry
18  JavaScriptCore          _llint_entry
19  JavaScriptCore          _llint_entry
20  JavaScriptCore          _llint_entry
21  JavaScriptCore          _llint_entry
22  JavaScriptCore          _llint_entry
23  JavaScriptCore          _llint_entry
24  JavaScriptCore          _llint_entry
25  JavaScriptCore          _llint_entry
26  JavaScriptCore          _llint_entry
27  JavaScriptCore          _llint_entry
28  JavaScriptCore          _llint_entry
29  JavaScriptCore          _llint_entry
30  JavaScriptCore          _llint_entry
31  JavaScriptCore          _llint_entry
32  JavaScriptCore          _llint_entry
33  JavaScriptCore          _llint_entry
34  JavaScriptCore          _llint_entry
35  JavaScriptCore          _llint_entry
36  JavaScriptCore          _llint_entry
37  JavaScriptCore          _llint_entry
38  JavaScriptCore          _llint_entry
39  JavaScriptCore          _llint_entry
40  JavaScriptCore          _llint_entry
41  JavaScriptCore          _llint_entry
42  JavaScriptCore          _llint_entry
43  JavaScriptCore          _llint_entry
44  JavaScriptCore          _llint_entry
45  JavaScriptCore          _llint_entry
46  JavaScriptCore          _llint_entry
47  JavaScriptCore          _llint_entry
48  JavaScriptCore          _llint_entry
49  JavaScriptCore          _llint_entry
50  JavaScriptCore          _llint_entry
51  JavaScriptCore          _vmEntryToJavaScript
52  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
53  JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
54  JavaScriptCore          _llint_entry
55  JavaScriptCore          _llint_entry
56  JavaScriptCore          _llint_entry
57  JavaScriptCore          _llint_entry
58  JavaScriptCore          _vmEntryToJavaScript
59  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
60  JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
61  JavaScriptCore          _llint_entry
62  JavaScriptCore          _llint_entry
63  JavaScriptCore          _llint_entry
64  JavaScriptCore          _llint_entry
65  JavaScriptCore          _llint_entry
66  JavaScriptCore          _llint_entry
67  JavaScriptCore          _llint_entry
68  JavaScriptCore          _llint_entry
69  JavaScriptCore          _llint_entry
70  JavaScriptCore          _llint_entry
71  JavaScriptCore          _llint_entry
72  JavaScriptCore          _llint_entry
73  JavaScriptCore          _llint_entry
74  JavaScriptCore          _llint_entry
75  JavaScriptCore          _llint_entry
76  JavaScriptCore          _vmEntryToJavaScript
77  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
78  JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
79  JavaScriptCore          _llint_entry
80  JavaScriptCore          _llint_entry
81  JavaScriptCore          _llint_entry
82  JavaScriptCore          _llint_entry
83  JavaScriptCore          _llint_entry
84  JavaScriptCore          _vmEntryToJavaScript
85  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
86  JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
87  JavaScriptCore          _llint_entry
88  JavaScriptCore          _vmEntryToJavaScript
89  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
90  JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
91  JavaScriptCore          _vmEntryToNative
92  JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
93  JavaScriptCore          JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
94  JavaScriptCore          _JSObjectCallAsFunction
95  tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
96  tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
97  tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
98  tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
99  tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
100 tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
101 tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
102 tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
103 CoreFoundation          ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
104 CoreFoundation          ___CFRunLoopDoBlocks
105 CoreFoundation          ___CFRunLoopRun
106 CoreFoundation          _CFRunLoopRunSpecific
107 tmi3                    facebook::react::JSIExecutor::defaultTimeoutInvoker(std::__1::function<void ()> const&, std::__1::function<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > ()>) (tmi3)
108 Foundation              ___NSThread__start__
109 libsystem_pthread.dylib __pthread_start

image

@cristianoccazinsp
Copy link
Author

@kneth I've just got this kind of crash during debugging. The crash seemed to happen right after "swiping out" the app (killing it) and while realm was doing something. Here's a capture of the debugger stack trace, hopefully it helps a bit.

Screen Shot 2021-02-23 at 23 47 17

@kneth
Copy link
Contributor

kneth commented Feb 24, 2021

@cristianoccazinsp Thank you for sharing. We will create a simple app and try to reproduce it by killing the app while doing some Realm operations.

@kraenhansen
Copy link
Member

@kneth I've just got this kind of crash during debugging. The crash seemed to happen right after "swiping out" the app (killing it) and while realm was doing something. Here's a capture of the debugger stack trace, hopefully it helps a bit.

I created an app that can reproduce this latest reported crash: https://github.com/kraenhansen/realm-js-issue-3112 .. perhaps that will provide us a hint to eventually solve some of the shutdown related crashes.

@Frans-L
Copy link

Frans-L commented Mar 3, 2021

I'm facing the same error "Attempted to deference garbage pointer ..." daily with our production app. Fortunately, no users have noticed the crashes, which would indicate that the crash probably happens only when the app is closing / inactive.

The realm DB is encrypted and the version is 6.1.X. Regular offline use without syncing.

@JonasWho
Copy link

JonasWho commented Mar 3, 2021

We're also seeing these in our production app which uses Realm v.10.2.0

@ryanbourneuk
Copy link

@kneth just checking in, has this been resolved or is it still under investigation? Happy to provide more details / logs if required. Thanks! :)

@kneth
Copy link
Contributor

kneth commented May 17, 2021

Unfortunately we haven't been able to find the root cause yet.

@ryanbourneuk Do you see the same pattern as described earlier (that it happens when the app is killed/swiped out)?

@projuljustin
Copy link

I've seen this pretty consistently, a few a week. Always seems to be in the background. Not sure if it's being backgrounded, or coming out.

image

@khadorkin
Copy link

khadorkin commented Sep 3, 2021

@kneth i see this in 100% background (swiped out), 100% iOS 14.
It is reproduced consistently: storing the data in realm / swipe out / crash. In foreground it works as expected.

Realm: 10.2.0
React Native: 0.63.4

@oleliabo
Copy link

We also see similar crashes in one app (realm 10.8.0 / RN: 0.66.1):

Thread 2 Crashed:
0   App                             0x202f95e2c         std::__1::__hash_table<T>::find<T>
1   App                             0x202f95938         realm::jsc::get_cached_property_name
2   App                             0x202f9e840         realm::jsc::ObjectWrap<T>::get_internal
3   App                             0x20300d538         realm::js::RealmObjectClass<T>::remove_listener
4   App                             0x20300adcc         realm::js::wrap<T>
5   JavaScriptCore                  0x331832048         JSC::APICallbackFunction::callImpl<T>
6   JavaScriptCore                  0x3317aa2ec         llint_entry
7   JavaScriptCore                  0x3317a791c         [inlined] llint_entry
8   JavaScriptCore                  0x3317a791c         llint_entry
9   JavaScriptCore                  0x3317a7874         [inlined] llint_entry
10  JavaScriptCore                  0x3317a7874         llint_entry
11  JavaScriptCore                  0x3317a791c         llint_entry
12  JavaScriptCore                  0x3317a7874         llint_entry
13  JavaScriptCore                  0x3317a8e70         llint_entry
14  JavaScriptCore                  0x3317a791c         llint_entry
15  JavaScriptCore                  0x3317a7874         llint_entry
16  JavaScriptCore                  0x3317a8e70         llint_entry
17  JavaScriptCore                  0x3317a7874         llint_entry
...

I think also thread 0 from same crash report is interesting, but dont know enough iOS to tell if this is related:

Thread 0
0   SiriTTS                         0x37960672c         boost::filesystem::directory_iterator::~directory_iterator
1   libsystem_c.dylib               0x331458cf4         __cxa_finalize_ranges
2   libsystem_c.dylib               0x331459004         exit
3   UIKitCore                       0x3242a1898         -[UIApplication _terminateWithStatus:]
4   UIKitCore                       0x32396cf68         -[_UISceneLifecycleMultiplexer _evalTransitionToSettings:fromSettings:forceExit:withTransitionStore:]
5   UIKitCore                       0x32396cbec         -[_UISceneLifecycleMultiplexer forceExitWithTransitionContext:scene:]
6   UIKitCore                       0x3242977d0         -[UIApplication workspaceShouldExit:withTransitionContext:]
7   FrontBoardServices              0x33d233518         -[FBSUIApplicationWorkspaceShim workspaceShouldExit:withTransitionContext:]
8   FrontBoardServices              0x33d25dc40         __63-[FBSWorkspaceScenesClient willTerminateWithTransitionContext:]_block_invoke_2
9   FrontBoardServices              0x33d24441c         -[FBSWorkspace _calloutQueue_executeCalloutFromSource:withBlock:]
10  FrontBoardServices              0x33d25dbdc         __63-[FBSWorkspaceScenesClient willTerminateWithTransitionContext:]_block_invoke
11  libdispatch.dylib               0x31f489294         _dispatch_client_callout
12  libdispatch.dylib               0x31f461ff4         _dispatch_block_invoke_direct$VARIANT$armv81
13  FrontBoardServices              0x33d282e00         __FBSSERIALQUEUE_IS_CALLING_OUT_TO_A_BLOCK__
14  FrontBoardServices              0x33d282ac8         -[FBSSerialQueue _targetQueue_performNextIfPossible]
15  FrontBoardServices              0x33d282f9c         -[FBSSerialQueue _performNextFromRunLoopSource]
16  CoreFoundation                  0x31fadefa4         __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
17  CoreFoundation                  0x31fadeea4         __CFRunLoopDoSource0
18  CoreFoundation                  0x31fade1f8         __CFRunLoopDoSources0
19  CoreFoundation                  0x31fad8714         __CFRunLoopRun
20  CoreFoundation                  0x31fad7ecc         CFRunLoopRunSpecific
21  GraphicsServices                0x34c9fb56c         GSEventRunModal
22  UIKitCore                       0x3242962cc         -[UIApplication _run]
23  UIKitCore                       0x32429b848         UIApplicationMain
24  App                             0x202c6f0d4         main (main.m:7)
25  libdyld.dylib                   0x31f52713c         start

@gabrielbull
Copy link

gabrielbull commented Mar 4, 2022

FYI, still getting multiple of those crashes daily in version 10.20.0 and RN 0.67.3.

@cristianoccazinsp
Copy link
Author

Looks like this is still happening on 10.20.0-beta.2 and iOS 15.3. The crash happened with the app in background right after swiping it out (to fully terminate it). Normally invisible to the user, but makes a mess with crash statistics.

@kneth was there another bug report for this kind of crash or is this the right place? I feel like I've opened way too many similar crashes, but this is the one that has the most comments.

Hardware Model:     iPhone9,1
Role:               Background
OS Version:         iOS 15.3
Exception Type:     EXC_BAD_ACCESS 
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference garbage pointer 0x8.

0  zinspector3             0x10033f404 (0x10033f370 + 148) (zinspector3)
7  JavaScriptCore          JSC::JSCallbackObject<JSC::JSNonFinalObject>::callImpl(JSC::JSGlobalObject*, JSC::CallFrame*)
8  JavaScriptCore          JSC::LLInt::setUpCall(JSC::CallFrame*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*)
9  JavaScriptCore          _llint_entry
10 JavaScriptCore          _llint_entry
11 JavaScriptCore          _vmEntryToJavaScript
12 JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
13 JavaScriptCore          JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
14 JavaScriptCore          _JSObjectCallAsFunction
15 zinspector3             0x10023bd4c (0x10023bcac + 160) (zinspector3)
21 JavaScriptCore          JSC::JSCallbackObject<JSC::JSNonFinalObject>::callImpl(JSC::JSGlobalObject*, JSC::CallFrame*)
22 JavaScriptCore          JSC::LLInt::setUpCall(JSC::CallFrame*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*)
23 JavaScriptCore          _llint_entry
24 JavaScriptCore          _llint_entry
59 JavaScriptCore          _vmEntryToJavaScript
60 JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
61 JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
62 JavaScriptCore          _llint_entry
76 JavaScriptCore          _vmEntryToJavaScript
77 JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
78 JavaScriptCore          JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*)
79 JavaScriptCore          _vmEntryToNative
80 JavaScriptCore          JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
81 JavaScriptCore          JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
82 JavaScriptCore          _JSObjectCallAsFunction
92 CoreFoundation          ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
93 CoreFoundation          ___CFRunLoopDoBlocks
94 CoreFoundation          ___CFRunLoopRun
95 CoreFoundation          _CFRunLoopRunSpecific
96 zinspector3             0x100178ca0 (0x100178b9c + 260) (zinspector3)
97 Foundation              ___NSThread__start__
98 libsystem_pthread.dylib __pthread_start

@kneth
Copy link
Contributor

kneth commented Mar 15, 2022

@cristianoccazinsp My best guess is that there is a race condition when you swipe out an app - and it indicates that we hang on for too long.

Since you experience it with 10.20.0-beta.2, a fresh issue is better.

@cristianoccazinsp
Copy link
Author

@kneth it's not really an app hang, but rather a crash right after the app is being terminated. Somewhere in the code trying to use resources that have been already released.

@kneth
Copy link
Contributor

kneth commented Mar 16, 2022

@cristianoccazinsp Yes, I agree that it must the order of events but I am not sure if it is deterministic.

@cristianoccazinsp
Copy link
Author

@kneth I've opened a new issue with as much detail as I could gather, including multiple stack traces (#4473)

One thing I've discovered when building Objective-C/Swift code for other native modules, memory exceptions will not be handled by any try/catch block, they will always crash the app, no matter what, so proper cleanup/access of pointers is required.

@kneth
Copy link
Contributor

kneth commented Aug 7, 2023

Since v12 will be a complete rewrite, we assume that the bug has been fixed. Try outer latest release candidate: npm install realm@next

If the issue is still observed, please create a new issue.

@sync-by-unito sync-by-unito bot closed this as completed Aug 7, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 15, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests