The jvm crashed looks like it was caused by JIT - jvm

I wrote a server application in Java 8 but occasionally crashes.
running it with
java version "1.8.0_251"
Java(TM) SE Runtime Environment (build 1.8.0_251-b08)
Java HotSpot(TM) 64-Bit Server VM (build 25.251-b08, mixed mode)
gdb $JAVA_HOME/bin/java core.53164
(gdb) bt
#0 0x00007f80df3aa493 in Monitor::wait(bool, long, bool) ()
from /data/disk01/hh_process_prod_cube_mpp/jdk1.8.0_251/jre/lib/amd64/server/libjvm.so
#1 0x00007f80def60ed2 in CompileQueue::get() () from /data/disk01/hh_process_prod_cube_mpp/jdk1.8.0_251/jre/lib/amd64/server/libjvm.so
#2 0x00007f80def6977b in CompileBroker::compiler_thread_loop() ()
from /data/disk01/hh_process_prod_cube_mpp/jdk1.8.0_251/jre/lib/amd64/server/libjvm.so
#3 0x00007f80df55d40b in JavaThread::thread_main_inner() ()
from /data/disk01/hh_process_prod_cube_mpp/jdk1.8.0_251/jre/lib/amd64/server/libjvm.so
#4 0x00007f80df55d711 in JavaThread::run() () from /data/disk01/hh_process_prod_cube_mpp/jdk1.8.0_251/jre/lib/amd64/server/libjvm.so
#5 0x00007f80df3eb2e2 in java_start(Thread*) () from /data/disk01/hh_process_prod_cube_mpp/jdk1.8.0_251/jre/lib/amd64/server/libjvm.so
#6 0x00007f80e02bcdd5 in start_thread () from /lib64/libpthread.so.0
#7 0x00007f80dfbc9ead in clone () from /lib64/libc.so.6

Related

Crash on GhostBSD/FreeBSD GNOME

I met an issue with wxWidgets 3.1.2 on GhostBSD 19.04 which is a FreeBSD with GNOME desktop. The build of my App looks OK but it crashed on
initializing globals. The same apps works OK on other Linux dists.
I've no idea so I tried the minimal example of wxWidgets. It crashed at the same point. I tried truss which is the equivalent of strace of F
reeBSD. Has anyone solved the same issue?
I used g++(g++ (FreeBSD Ports Collection) 8.3.0) to build wxWidgets. And it can not be debugged by gdb because it crashed at global init. Below is the call stack. Line 205 is the last line of minimal.cpp.
Core was generated by `./minimal'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000000802a98a38 in vtable for __cxxabiv1::__si_class_type_info () from /lib/libcxxrt.so.1
(gdb) bt
#0 0x0000000802a98a38 in vtable for __cxxabiv1::__si_class_type_info () at /lib/libcxxrt.so.1
#1 0x0000000801a52006 in __dynamic_cast () at /usr/local/lib/gcc8/libstdc++.so.6
#2 0x0000000801ad0620 in bool std::has_facet<std::ctype<char> >(std::locale const&) () at /usr/local/lib/gcc8/libstdc++.so.6
#3 0x0000000801ac3cb4 in std::basic_ios<char, std::char_traits<char> >::_M_cache_locale(std::locale const&) ()
at /usr/local/lib/gcc8/libstdc++.so.6
#4 0x0000000801ac4130 in std::basic_ios<char, std::char_traits<char> >::init(std::basic_streambuf<char, std::char_traits<char> >*) ()
at /usr/local/lib/gcc8/libstdc++.so.6
#5 0x0000000801a65a33 in std::ios_base::Init::Init() () at /usr/local/lib/gcc8/libstdc++.so.6
#6 0x000000000046ec5f in __static_initialization_and_destruction_0(int, int) (__initialize_p=1, __priority=65535)
at /usr/local/lib/gcc8/include/c++/iostream:74
#7 0x000000000046ee86 in _GLOBAL__sub_I_minimal.cpp(void) () at ./minimal.cpp:205
#8 0x0000000800aec3bd in () at /libexec/ld-elf.so.1
#9 0x0000000800b050b0 in () at /libexec/ld-elf.so.1
#10 0x0000000800b09000 in ()
#11 0x00007fffffffe710 in ()
#12 0x00007fffffffeaa2 in ()
#13 0x00007fffffffd830 in ()
#14 0x0000000800af7049 in () at /libexec/ld-elf.so.1
#15 0x00007fffffffd850 in ()
#16 0x0000000800aebf12 in () at /libexec/ld-elf.so.1
#17 0x0000000800b18a20 in ()
#18 0x00007fffffffe710 in ()
#19 0x0000000802ab0ce0 in ()
#20 0x0000000800b1fc00 in ()
#21 0x0000000800b18200 in ()
#22 0x00007fffffffe710 in ()
#23 0x00007fffffffd890 in ()
#24 0x0000000800af06ed in () at /libexec/ld-elf.so.1
#25 0x0000000800b181e0 in ()
#26 0x00007fffffffe710 in ()
SIGNAL 11 (SIGSEGV) code=SEGV_ACCERR trapno=12 by truss

Running Gendarme after copying Mono.Cecil.Mdb.dll into mono/lib/gendarme/ causes an error

The Gendarme installation (v3.10.0.0) on my machine CentOS (release 6.5 Final) was unable to report line numbers. Upon some searching I found that Mono.Cecil.Mdb.dll was missing in the installation as suggested in the FAQs
After doing some search on resolving this, I came across this link. Therefore, I copied the dll from MonoDevelop installation directory as suggested in the link.
Now, when I run Gendarme, I get the following trace:
Gendarme v3.10.0.0
Copyright (C) 2005-2011 Novell, Inc. and contributors
InitializationUnhandled loader error: 8, (null) Mono.Cecil, Version=0.9.5.12082, Culture=neutral, PublicKeyToken=0738eb9f132ed756 (null)
* Assertion: should not be reached at loader.c:299
Stacktrace:
at <unknown> <0xffffffff>
at (wrapper managed-to-native) System.Type.internal_from_name (string,bool,bool) <0x00069>
at System.Type.GetType (string) <0x00023>
at Gendarme.Framework.Rocks.ModuleRocks.LoadDebuggingSymbols (Mono.Cecil.ModuleDefinition) <0x000a6>
at Gendarme.Framework.Runner.Initialize () <0x00124>
at Gendarme.ConsoleRunner.Initialize () <0x00075>
at Gendarme.ConsoleRunner.Execute (string[]) <0x00422>
at Gendarme.ConsoleRunner.Main (string[]) <0x00049>
at (wrapper runtime-invoke) <Module>.runtime_invoke_int_object (object,intptr,intptr,intptr) <0x00103>
Native stacktrace:
/opt/mono/bin/mono() [0x5f28e8]
/lib64/libpthread.so.0(+0xf7e0) [0x7f1f91d497e0]
/lib64/libc.so.6(gsignal+0x35) [0x7f1f917c25e5]
/lib64/libc.so.6(abort+0x175) [0x7f1f917c3dc5]
/opt/mono/bin/mono() [0x79b58e]
/opt/mono/bin/mono() [0x79b37b]
/opt/mono/bin/mono() [0x79b4dc]
/opt/mono/bin/mono() [0x6a74da]
/opt/mono/bin/mono() [0x68811d]
/opt/mono/bin/mono() [0x68802d]
/opt/mono/bin/mono() [0x689221]
/opt/mono/bin/mono() [0x68948a]
/opt/mono/bin/mono(mono_class_from_name+0x10) [0x689910]
/opt/mono/bin/mono() [0x71f535]
/opt/mono/bin/mono() [0x71f813]
/opt/mono/bin/mono() [0x696141]
[0x40f14c2a]
Debug info from gdb:
warning: File "/opt/mono/bin/mono-sgen-gdb.py" auto-loading has been declined by your `auto-load safe-path' set to "/usr/share/gdb/auto-load:/usr/lib/debug:/usr/bin/mono-gdb.py".
To enable execution of this file add
add-auto-load-safe-path /opt/mono/bin/mono-sgen-gdb.py
line to your configuration file "/home/msehgal/.gdbinit".
To completely disable this security protection add
set auto-load safe-path /
line to your configuration file "/home/msehgal/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual. E.g., run from the shell:
info "(gdb)Auto-loading safe path"
[New LWP 7645]
[New LWP 7644]
[Thread debugging using libthread_db enabled]
0x00007f1f91d4937d in waitpid () from /lib64/libpthread.so.0
3 Thread 0x7f1f90fff700 (LWP 7644) 0x00007f1f91d4568c in pthread_cond_wait##GLIBC_2.3.2 () from /lib64/libpthread.so.0
2 Thread 0x7f1f9178f700 (LWP 7645) 0x00007f1f91d47a00 in sem_wait () from /lib64/libpthread.so.0
* 1 Thread 0x7f1f92aea780 (LWP 7643) 0x00007f1f91d4937d in waitpid () from /lib64/libpthread.so.0
Thread 3 (Thread 0x7f1f90fff700 (LWP 7644)):
#0 0x00007f1f91d4568c in pthread_cond_wait##GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1 0x0000000000763edc in ?? ()
#2 0x00007f1f91d41aa1 in start_thread () from /lib64/libpthread.so.0
#3 0x00007f1f91878aad in clone () from /lib64/libc.so.6
Thread 2 (Thread 0x7f1f9178f700 (LWP 7645)):
#0 0x00007f1f91d47a00 in sem_wait () from /lib64/libpthread.so.0
#1 0x000000000070a1a7 in ?? ()
#2 0x00000000006eb761 in ?? ()
#3 0x0000000000792e1a in ?? ()
#4 0x00007f1f91d41aa1 in start_thread () from /lib64/libpthread.so.0
#5 0x00007f1f91878aad in clone () from /lib64/libc.so.6
Thread 1 (Thread 0x7f1f92aea780 (LWP 7643)):
#0 0x00007f1f91d4937d in waitpid () from /lib64/libpthread.so.0
#1 0x00000000005f2970 in ?? ()
#2 <signal handler called>
#3 0x00007f1f917c25e5 in raise () from /lib64/libc.so.6
#4 0x00007f1f917c3dc5 in abort () from /lib64/libc.so.6
#5 0x000000000079b58e in ?? ()
#6 0x000000000079b37b in ?? ()
#7 0x000000000079b4dc in ?? ()
#8 0x00000000006a74da in ?? ()
#9 0x000000000068811d in ?? ()
#10 0x000000000068802d in ?? ()
#11 0x0000000000689221 in ?? ()
#12 0x000000000068948a in ?? ()
#13 0x0000000000689910 in mono_class_from_name ()
#14 0x000000000071f535 in ?? ()
#15 0x000000000071f813 in ?? ()
#16 0x0000000000696141 in ?? ()
#17 0x0000000040f14c2a in ?? ()
#18 0x000000000288d6b0 in ?? ()
#19 0x0000000000000000 in ?? ()
=================================================================
Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries
used by your application.
=================================================================
What should I do to get line numbers in the report?
I was missing another dependency Mono.Cecil.dll. I got it from here and copied it to /mono/lib/gendarme along with Mono.Cecil.Mdb.dll from the installation of MonoDevelop as mentioned in the question.

Crashing bug in iOS8 with UICollectionview, related to UIApplicationAccessibility

I have an app that displays a UICollectionView on a page, this works fine in iOS7 but crashes hard in iOS8 with a tracelog that points to UICollectionViewAccessibility and UIApplicationAccessibility, even though I have no code that touches Accessibility at all.
I have managed to isolate the problem and put up a small app that reproduces the crash here.
http://github.com/beno/ios8bug
I find it hard to comprehend that code with this kind of glaring bug would ship, but it looks like it did. I have filed a bug with Apple, but no response so far. Any help with more info or a workaround would be greatly appreciated.
Sample trace:
Thread 1Queue : com.apple.main-thread (serial)
#0 0x0343d385 in CFHash ()
#1 0x0109c264 in NSKeyValueAccessorHash ()
#2 0x03436373 in CFBasicHashFindBucket ()
#3 0x0346294b in CFSetGetValue ()
#4 0x0109f316 in -[NSObject(NSKeyValueCoding) valueForKey:] ()
#5 0x10ba246e in -[NSObject(UIAccessibilitySafeCategory) safeValueForKey:] ()
#6 0x10d1f359 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#7 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#8 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#9 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#10 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#11 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#12 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#13 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#14 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#15 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
#16 0x10d1f376 in -[UICollectionViewAccessibility _accessibilityDescendantElementAtIndexPathIsValid:] ()
....
For anyone finding this, the bug is a regression flaw in Accessibility which acts up this way when the view is it's own delegate (like I had it configured). So use a different delegate is the answer.

Debugging a stripped ARM binary

I've disassembled a stripped ARM binary with Hopper and found the address of a method I'm interested in, 0x00065414. However, when connecting to the running app with gdb all addresses start from a base address that I cannot figure out. How can I determine my running applications base address (Entry Point?) in gdb?
Notes
The binary's FairPlay DRM was removed using Clutch
ASLR was removed by clearing the PIE header flag using a python script
Verified changes using otool
GDB setup
$ gdb ./MyApplication
(gdb) attach -waitfor MyApplication
Start App and it pauses immediately at launch.
(gdb) where
#0 0x3bbcdb88 in <redacted> ()
#1 0x3bbbc8fc in <redacted> ()
#2 0x3bbc4130 in <redacted> ()
#3 0x3bbc4014 in ccpbkdf2_hmac ()
#4 0x3bb9f9d0 in CCKeyDerivationPBKDF ()
#5 0x0015b750 in dyld_stub_pthread_key_create ()
#6 0x0015ca46 in dyld_stub_pthread_key_create ()
#7 0x0015c69c in dyld_stub_pthread_key_create ()
#8 0x0015b4d0 in dyld_stub_pthread_key_create ()
#9 0x0015c110 in dyld_stub_pthread_key_create ()
#10 0x0001695a in dyld_stub_pthread_key_create ()
#11 0x000ba256 in dyld_stub_pthread_key_create ()
#12 0x00017bde in dyld_stub_pthread_key_create ()
#13 0x33b9eaac in <redacted> ()
#14 0x33b9e4f2 in <redacted> ()
#15 0x33b98b40 in <redacted> ()
#16 0x33b33a06 in <redacted> ()
#17 0x33b32cfc in <redacted> ()
#18 0x33b98320 in <redacted> ()
#19 0x3601876c in <redacted> ()
#20 0x36018356 in <redacted> ()
#21 0x31374776 in <redacted> ()
#22 0x31374712 in <redacted> ()
#23 0x31372ede in <redacted> ()
#24 0x312dd470 in CFRunLoopRunSpecific ()
#25 0x312dd252 in CFRunLoopRunInMode ()
#26 0x33b975c2 in <redacted> ()
#27 0x33b92844 in UIApplicationMain ()
#28 0x0001aaf2 in dyld_stub_pthread_key_create ()
#29 0x00009028 in dyld_stub_pthread_key_create ()
Checking various locations for expected instructions so I can set a breakpoint:
(gdb) disas 0x65414
No function contains specified address.
I assume that the correct location is some + 0x65414. So I tried 0x33b92844 which is UIApplicationMain as the base.
(gdb) disas 0x33BF7C58
Dump of assembler code for function <redacted>:
0x33bf7934 <<redacted>+0>: f0 b5 push {r4, r5, r6, r7, lr}
This address is definitely in the land of redacted or symbol stripped code, but the address doesn't land you on a procedure boundary. So it isn't the right place.
You can try a :
starti
It let you enter in your dynamic linker (if your binary id dynamically linked) which will call the __libc_start_main function and as argument of this function, it gives a pointer toward the main function. So you have to set a breakpoint on this address (b*<addr_of_main>) and to continue the execution by using the continue command.
Now that your are in the main function, wait that your programm call your method, if you can't enter in this function, you can modify your registers with :
set $<register>=<value>
Your binary might be loaded with ASLR which is a security feature to make addresses to code and data unpredictable.
Try disabling ASLR when you're in GDB - before loading the executable.
(gdb) set disable-randomization off
(gdb) start
Use info file and/or info shared to figure out the executable's load address or the actual entrypoint address.
(gdb) info file
Mac OS X executable:
<...>/test, file type mach-o-le.
Entry point: 0x00002104
0x00001000 - 0x0002b000 is <...>/test
<...>

iOS iPad GUI deadlock on startup. Hung on splash screen

My iPad app hangs on startup sometimes. It looks like the main thread is getting deadlocked with another thread but not sure why. Any ideas on what's causing this and how to debug this?
FYI my app starts as a splitview controller with a listview on the left and a webview on the right. If I start in portrait mode with the list view hidden the problem doesn't occur. Also, if I disable renderig of my cell when not on the main thread the app doesn't hang but the cells appear as black rectangles.
Thanks!
Here's my main thread. All of the code on this stack is Apple framework...
#0 0x971c0142 in semaphore_wait_signal_trap ()
#1 0x971c5c06 in pthread_mutex_lock ()
#2 0x02685903 in CGFontCacheLock ()
#3 0x02685869 in CGGlyphLockLockGlyphBitmaps ()
#4 0x0a90bb5b in ripc_RenderGlyphs ()
#5 0x0a9199f8 in ripc_DrawGlyphs ()
#6 0x0268464c in draw_glyphs ()
#7 0x02683e97 in CGContextShowGlyphsWithAdvances ()
#8 0x035aafba in WebCore::Font::drawGlyphs ()
#9 0x035aaaf5 in WebCore::Font::drawGlyphBuffer ()
#10 0x035aa81a in WebCore::Font::drawSimpleText ()
#11 0x035aa4c0 in drawAtPoint ()
#12 0x035a9d5c in -[NSString(WebStringDrawing) _web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:] ()
#13 0x0043f632 in -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:letterSpacing:includeEmoji:] ()
#14 0x0043f325 in -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:] ()
#15 0x0055ba70 in -[UILabel _drawTextInRect:baselineCalculationOnly:] ()
#16 0x00559178 in -[UILabel drawTextInRect:] ()
#17 0x0045418f in -[UIView(CALayerDelegate) drawLayer:inContext:] ()
#18 0x02a708d2 in -[CALayer drawInContext:] ()
#19 0x02a704b0 in backing_callback ()
#20 0x02a6fd52 in CABackingStoreUpdate ()
#21 0x02a6f01d in -[CALayer _display] ()
#22 0x02a6eac7 in CALayerDisplayIfNeeded ()
#23 0x02a609e1 in CA::Context::commit_transaction ()
#24 0x02a60732 in CA::Transaction::commit ()
#25 0x00427556 in -[UIApplication _reportAppLaunchFinished] ()
#26 0x0042dd3e in -[UIApplication handleEvent:withNewEvent:] ()
#27 0x004294f7 in -[UIApplication sendEvent:] ()
#28 0x004311d8 in _UIApplicationHandleEvent ()
#29 0x033f817c in PurpleEventCallback ()
#30 0x02bec89c in CFRunLoopRunSpecific ()
#31 0x02beb8a8 in CFRunLoopRunInMode ()
#32 0x00427221 in -[UIApplication _run] ()
#33 0x0042f372 in UIApplicationMain ()
And another thread rendering a cell in my list view. MyFancyPantsCell & ABTableViewCellView are my classes.
#0 0x971c0142 in semaphore_wait_signal_trap ()
#1 0x971c5c06 in pthread_mutex_lock ()
#2 0x02685903 in CGFontCacheLock ()
#3 0x02685869 in CGGlyphLockLockGlyphBitmaps ()
#4 0x0a90bb5b in ripc_RenderGlyphs ()
#5 0x0a9199f8 in ripc_DrawGlyphs ()
#6 0x0268464c in draw_glyphs ()
#7 0x02683e97 in CGContextShowGlyphsWithAdvances ()
#8 0x035aafba in WebCore::Font::drawGlyphs ()
#9 0x035aaaf5 in WebCore::Font::drawGlyphBuffer ()
#10 0x035aa81a in WebCore::Font::drawSimpleText ()
#11 0x035aa4c0 in drawAtPoint ()
#12 0x035a9d5c in -[NSString(WebStringDrawing) _web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:] ()
#13 0x0043f632 in -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:letterSpacing:includeEmoji:] ()
#14 0x0043f381 in -[NSString(UIStringDrawing) drawAtPoint:withFont:] ()
#15 0x000635ec in -[SymbolCellPainter drawContentView:selected:editing:frame:]
#16 0x000452d0 in -[MyFancyPantsCell drawContentView:]
#17 0x00044624 in -[ABTableViewCellView drawRect:]
#18 0x0045418f in -[UIView(CALayerDelegate) drawLayer:inContext:] ()
#19 0x02a708d2 in -[CALayer drawInContext:] ()
#20 0x02a704b0 in backing_callback ()
#21 0x02a6fd52 in CABackingStoreUpdate ()
#22 0x02a6f01d in -[CALayer _display] ()
#23 0x02a6eac7 in CALayerDisplayIfNeeded ()
#24 0x02a609e1 in CA::Context::commit_transaction ()
#25 0x02a60732 in CA::Transaction::commit ()
#26 0x02a9e04f in CA::Transaction::release_thread ()
#27 0x971f61e3 in _pthread_tsd_cleanup ()
#28 0x971f5df6 in _pthread_exit ()
#29 0x00183bf2 in +[NSThread exit] ()
#30 0x00183b5b in __NSThread__main__ ()
#31 0x971ed81d in _pthread_start ()
#32 0x971ed6a2 in thread_start ()
I looks like you've created another thread, e.g. via [object performSelectorInBackground:#selector(foo) withObject:bar]. And in that thread you call GUI methods. You should call the GUI methods with [object performSelectorOnMainThread:#selector(alpha) withObject:beta waitUntilDone:YES] (maybe create another method that just contains the GUI methods and call that one this way instead of doing 20 performSelectorOnMainThreads).
All GUI methods should run on the main thread.
Are you using CATransitions somewhere in your code ?
Core Animation supports two types of transactions: implicit transactions and explicit transactions. Implicit transactions are created automatically when the layer tree is modified by a thread without an active transaction and are committed automatically when the thread's run-loop next iterates. Explicit transactions occur when the the application sends the CATransaction class a begin message before modifying the layer tree, and a commit message afterwards.
It seems that implicit transactions can fire in background threads calling drawRect from there.
If there's some drawing going on in the main thread at the same time - you're in trouble.
In this case, [CATransaction begin] / [CATransaction commit] MAY help.