Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash when GetHashCode is called under specific circumstances #87551

Closed
rolfbjarne opened this issue Jun 14, 2023 · 12 comments · Fixed by #87713
Closed

Crash when GetHashCode is called under specific circumstances #87551

rolfbjarne opened this issue Jun 14, 2023 · 12 comments · Fixed by #87713

Comments

@rolfbjarne
Copy link
Member

From @rdavisau on Tue, 13 Jun 2023 13:46:50 GMT

Steps to Reproduce

(this seems to be a net8 regression, here's my attempt to get close to isolating the specific trigger/s for the issue through trial and error)

  1. Be using .net8 preview, running release builds on a physical device
  2. In c#, define an 'NSObject' subclass that wraps a .net type T and stashes the T instance and a Func<T,?> "identifier-getter" that is called against the wrapped instance whenever objc triggers GetNativeHash
  3. Instantiate wrapper in a specific problematic way over specific problematic types (this I determine from experimentation, see sample project)
  4. Use the wrapper instance in a way that will cause GetNativeHash to be triggered from native code.

Expected Behavior

The wrapper instance can be used with native types in expected ways without issues, as when run under net7 on device, or under net8 on simulator (/debug??) builds.

Actual Behavior

=================================================================
        Basic Fault Address Reporting
=================================================================
Memory around native instruction pointer (0x102d1abb0):0x102d1aba0  5f 03 1f eb 11 00 00 10 a0 01 00 54 40 53 00 91  _..........T@S..
0x102d1abb0  41 13 80 b9 21 78 1f 53 e2 03 03 aa 63 fc 60 d3  A...!x.S....c.`.
0x102d1abc0  e3 03 03 aa b9 0f 09 94 00 7c 40 93 ba 0b 40 f9  .........|@...@.
0x102d1abd0  bf 03 00 91 fd 7b c2 a8 c0 03 5f d6 a0 14 80 d2  .....{...._.....

=================================================================
        Managed Stacktrace:
=================================================================
          at System.String:GetHashCode <0x00060>
          at FuncHash.Identifier`2:GetNativeHash <0x00167>
          at System.Object:runtime_invoke_dynamic <0x00127>
          at <unknown> <0xffffffff>
          at ObjCRuntime.Messaging:NativeHandle_objc_msgSend_NativeHandle <0x00007>
          at Foundation.NSOrderedSet:.ctor <0x00097>
          at Foundation.NSOrderedSet:.ctor <0x0003b>
          at FuncHash.AppDelegate:FinishedLaunching <0x002db>
          at System.Object:runtime_invoke_dynamic <0x00127>
          at <unknown> <0xffffffff>
          at UIKit.UIApplication:xamarin_UIApplicationMain <0x00007>
          at UIKit.UIApplication:UIApplicationMain <0x00063>
          at UIKit.UIApplication:Main <0x0013b>
          at Program:<Main>$ <0x0003b>
          at System.Object:runtime_invoke_dynamic <0x00127>
=================================================================

=================================================================
        Native Crash Reporting
=================================================================
Got a SIGSEGV while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries 
used by your application.
=================================================================

An error has occurred in the native fault reporting. Some diagnostic information will be unavailable.

=================================================================
        Native stacktrace:
=================================================================
        0x10321d9f8 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x103208984 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1031ecd64 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1dbea4a90 - /usr/lib/system/libsystem_platform.dylib : <redacted>
        0x102c53b58 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102c53b58 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f17a68 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x1031efc30 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10319fce0 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1031a29d4 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10325a164 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10325a020 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x18deb6878 - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : <redacted>
        0x18dedc9b8 - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : <redacted>
        0x102fb18f8 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f8ca88 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f8c74c - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102c5335c - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f17a68 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x1031efc30 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10319fce0 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1031a29d4 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10325ba8c - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10325b7d0 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1903d6c54 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x1903d6378 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x1903d5354 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x1903d4fa0 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19011b20c - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : _UIScenePerformActionsWithLifecycleActionMask
        0x19045ce98 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19030dce0 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19030db08 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19030d6b8 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19030d584 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x1909f12b8 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x190a8aa8c - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : _UISceneSettingsDiffActionPerformChangesWithTransitionContextAndCompletion
        0x1901b958c - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19062c184 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19028bbb8 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19028ba28 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19028af7c - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19028ad08 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x1a3bd8e90 - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x1a3c188f8 - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x1a3bdcc24 - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x1a3c18530 - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x1954c4fdc - /usr/lib/system/libdispatch.dylib : <redacted>
        0x1954c8a5c - /usr/lib/system/libdispatch.dylib : <redacted>
        0x1a3be6d40 - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x1a3be68dc - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x1a3be9184 - /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices : <redacted>
        0x18df7df34 - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : <redacted>
        0x18df8a30c - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : <redacted>
        0x18df0e230 - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : <redacted>
        0x18df23b8c - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : <redacted>
        0x18df28ec0 - /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation : CFRunLoopRunSpecific
        0x1c7f7f368 - /System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices : GSEventRunModal
        0x19041e86c - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : <redacted>
        0x19041e4d0 - /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore : UIApplicationMain
        0x102fbd908 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : xamarin_UIApplicationMain
        0x102fafff0 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f905c4 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f907dc - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102c52fcc - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x102f17a68 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : 
        0x1031efc30 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x10319eef0 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1031a5b9c - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1031f4cc8 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x102fc87d4 - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : xamarin_log
        0x103259e1c - /private/var/containers/Bundle/Application/208BA0BB-13B8-42F4-880D-13657947E056/PublicStaging.app/FuncHash : _ZNK3icu6number23NumberFormatterSettingsINS0_24LocalizedNumberFormatterEE10toSkeletonER10UErrorCode
        0x1ac74a960 - /usr/lib/dyld : <redacted>

Exiting early due to double fault.
  Application '..' terminated (with exit code '255' and/or crashing signal ').

Environment

Version information
.NET SDK:
 Version:   8.0.100-preview.5.23303.2
 Commit:    3fe444af72

Runtime Environment:
 OS Name:     Mac OS X
 OS Version:  13.3
 OS Platform: Darwin
 RID:         osx.13-arm64
 Base Path:   /usr/local/share/dotnet/sdk/8.0.100-preview.5.23303.2/

.NET workloads installed:
 [ios]
   Installation Source: SDK 8.0.100-preview.5
   Manifest Version:    16.4.8525-net8-p5/8.0.100-preview.5
   Manifest Path:       /usr/local/share/dotnet/sdk-manifests/8.0.100-preview.5/microsoft.net.sdk.ios/WorkloadManifest.json
   Install Type:        FileBased

Host:
  Version:      8.0.0-preview.5.23280.8
  Architecture: arm64
  Commit:       bc78804f5d

Build Logs

msbuild.binlog.zip

Example Project

https://github.com/rdavisau/ios-net8-funchash-repro

Run on net7 (works)
./net7.sh [DEVICE UDID]

Run on net8 (crashes)
./net8.sh [DEVICE UDID]

All relevant code is in AppDelegate.cs. The commented out instantiations (1 - 4) all work on both net7 and net8. The final instantiation causes the crash when the NSSet is being created.

This has easy workarounds (use the 'not problematic' instantiation, or calculate and stash the identifier in the constructor), but since it 'used to work' in net7 I figure it is worth raising.

Copied from original issue dotnet/macios#18442

@rolfbjarne
Copy link
Member Author

From @rdavisau on Tue, 13 Jun 2023 21:37:34 GMT

(Confirmed this still reproduces on p5 and updated the Environment details)

@rolfbjarne
Copy link
Member Author

From @rolfbjarne on Wed, 14 Jun 2023 10:11:59 GMT

I can reproduce the crash.

It only happens when LLVM is enabled.

lldb session on device: https://gist.github.com/rolfbjarne/bb24af32b545371d4ff314391e6abd6f

Output without lldb: https://gist.github.com/rolfbjarne/dc0ec66a78140d49c523eecf81705a19

I have a few local changes to make it clearer that the crash happens when calling GetHashCode: https://gist.github.com/rolfbjarne/e3bdaaba00fe0e55d7c74b27e0a75242

I build like this:

dotnet build FuncHash.csproj /p:RuntimeIdentifier=ios-arm64

I'm moving to dotnet/runtime since this seems like a regression with our LLVM support.

@dotnet-issue-labeler dotnet-issue-labeler bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jun 14, 2023
@ghost ghost added the untriaged New issue has not been triaged by the area owner label Jun 14, 2023
@rolfbjarne
Copy link
Member Author

CC @vargaz

@vcsjones vcsjones added area-Codegen-LLVM-mono and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jun 14, 2023
@vargaz vargaz self-assigned this Jun 14, 2023
@rolfbjarne
Copy link
Member Author

It only happens when LLVM is enabled.

This might be an incorrect conclusion, because I didn't see that the test project does this:

https://github.com/rdavisau/ios-net8-funchash-repro/blob/1f2c8085a65a7eb15bd05abc23211f70eee7344a/FuncHash.csproj#L19

@vargaz
Copy link
Contributor

vargaz commented Jun 14, 2023

Can't reproduce this with the test repo.

@rolfbjarne
Copy link
Member Author

@vargaz which .NET versions do you have installed?

This is mine:

$ dotnet --info
.NET SDK:
 Version:   8.0.100-preview.5.23303.2
 Commit:    3fe444af72

Runtime Environment:
 OS Name:     Mac OS X
 OS Version:  13.4
 OS Platform: Darwin
 RID:         osx.13-x64
 Base Path:   /usr/local/share/dotnet/sdk/8.0.100-preview.5.23303.2/

.NET workloads installed:
 [ios]
   Installation Source: SDK 8.0.100-preview.5
   Manifest Version:    16.4.8525-net8-p5/8.0.100-preview.5
   Manifest Path:       /usr/local/share/dotnet/sdk-manifests/8.0.100-preview.5/microsoft.net.sdk.ios/WorkloadManifest.json
   Install Type:        FileBased

Host:
  Version:      8.0.0-preview.5.23280.8
  Architecture: x64
  Commit:       bc78804f5d

.NET SDKs installed:
  7.0.302 [/usr/local/share/dotnet/sdk]
  8.0.100-preview.5.23303.2 [/usr/local/share/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 7.0.5 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 8.0.0-preview.5.23302.2 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 7.0.5 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.0-preview.5.23280.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
  None

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

@vargaz
Copy link
Contributor

vargaz commented Jun 15, 2023

Same here.

@rolfbjarne
Copy link
Member Author

@vargaz that's weird. Can you get a binlog?

@vargaz
Copy link
Contributor

vargaz commented Jun 15, 2023

Attached.
binlog1.binlog.gz
binlog2.binlog.gz

The first is from:
dotnet build FuncHash.csproj /bl /p:RuntimeIdentifier=ios-arm64
And the second is from:
dotnet run /bl /p:RuntimeIdentifier=ios-arm64

@rdavisau
Copy link

I guess these all produce debug builds, but for me the issue only reproduces on a release build.

For me, this crashes:
rm -rf bin obj && dotnet restore FuncHash.csproj && dotnet run -v:n --project FuncHash.csproj -f net8.0-ios -c Release -r:ios-arm64 /p:_DeviceName=

This doesn't (removed -c Release):
rm -rf bin obj && dotnet restore FuncHash.csproj && dotnet run -v:n --project FuncHash.csproj -f net8.0-ios -r:ios-arm64 /p:_DeviceName=

@vargaz
Copy link
Contributor

vargaz commented Jun 16, 2023

I can reproduce in release config.

@vargaz
Copy link
Contributor

vargaz commented Jun 16, 2023

A reduced testcase:

using System;
using System.Runtime.CompilerServices;

namespace FuncHash;

[Register ("AppDelegate")]
public class AppDelegate : UIApplicationDelegate
{
	public override UIWindow? Window { get; set; }

	public override bool FinishedLaunching (UIApplication application, NSDictionary launchOptions)
	{
		Window = new UIWindow { RootViewController = new UIViewController { View = { BackgroundColor = UIColor.Green } }};
		Window.MakeKeyAndVisible();

		var t = typeof (Identifier<,>).MakeGenericType (new Type [] { typeof (int), typeof (string) });
		var a = Activator.CreateInstance (t, new object [] { delegate () { return "2"; } });
		return true;
	}
}

public class Identifier<T,U>
{
	public Identifier(Func<U> identifierFunc)
	{
		Console.WriteLine ("B: " + identifierFunc());
	}
}

vargaz added a commit to vargaz/runtime that referenced this issue Jun 16, 2023
…ables.

Ldaddr requires the emission of dummy uses for
gsharedvt_info_var/gsharedvt_locals_var and the copy wouldn't have these,
leading to register allocation problems.

Fixes dotnet#87551.
@ghost ghost added the in-pr There is an active PR which will close this issue when it is merged label Jun 16, 2023
vargaz added a commit that referenced this issue Jun 21, 2023
…ables. (#87713)

Ldaddr requires the emission of dummy uses for
gsharedvt_info_var/gsharedvt_locals_var and the copy wouldn't have these,
leading to register allocation problems.

Fixes #87551.
@ghost ghost removed untriaged New issue has not been triaged by the area owner in-pr There is an active PR which will close this issue when it is merged labels Jun 21, 2023
@ghost ghost locked as resolved and limited conversation to collaborators Jul 21, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants