Realm-cocoa: Assertion failure in realm::SlabAlloc::do_free

Created on 29 Nov 2016  路  9Comments  路  Source: realm/realm-cocoa

Goals

No more crashing.

Expected Results

Not seeing this crash.

Actual Results

Crash exists.

Steps to Reproduce

Getting the following in Crashlytics, not sure what steps exactly to reproduce:

com.apple.main-thread
0  Realm                          0x101545824 realm::Table::bump_version(bool) const + 132
1  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
2  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
3  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
4  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
5  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
6  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
7  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
8  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
9  Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
10 Realm                          0x10154582c realm::Table::bump_version(bool) const + 140
11 Realm                          0x1015c6da0 realm::Table::set_string(unsigned long, unsigned long, realm::StringData, bool) + 136
12 Realm                          0x10138a8cc RLMSetValue(RLMObjectBase*, unsigned long, NSString*, bool) + 136
13 Realm                          0x10138a808 ___ZL13RLMMakeSetterIU8__strongP8NSStringS2_EPFvvEP11RLMProperty_block_invoke_2 + 248
14 Remind101                      0x1000db958 -[RDConvoMessage updateReadStateWithPriority:] (RDConvoMessage.m:273)
15 Remind101                      0x1002066b8 -[RLMRealm(RDRealmUtilities) safeWriteWithBlock:] (RDRealmUtilities.m:23)
16 Remind101                      0x100207c48 -[RLMObject(RDRealmUtilities) safeMutate:] (RDRealmUtilities.m:206)
17 Remind101                      0x1000b795c -[RDReadMarkerPusherHandler updateChatReadMarkerWithUUID:marker:] (RDReadMarkerPusherHandler.m:76)
18 Remind101                      0x1000b76e0 -[RDReadMarkerPusherHandler handlePusherEvent:] (RDReadMarkerPusherHandler.m:50)
19 Remind101                      0x1000cd58c __43-[RDPusher subscribeToObject:withHandlers:]_block_invoke (RDPusher.m:98)
20 libdispatch.dylib              0x18048d4bc _dispatch_call_block_and_release + 24
21 libdispatch.dylib              0x18048d47c _dispatch_client_callout + 16
22 libdispatch.dylib              0x180492b84 _dispatch_main_queue_callback_4CF + 1844
23 CoreFoundation                 0x1809f8d50 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
24 CoreFoundation                 0x1809f6bb8 __CFRunLoopRun + 1628
25 CoreFoundation                 0x180920c50 CFRunLoopRunSpecific + 384
26 GraphicsServices               0x182208088 GSEventRunModal + 180
27 UIKit                          0x185c02088 UIApplicationMain + 204
28 Remind101                      0x100193558 main (main.m:16)
29 libdispatch.dylib              0x1804be8b8 (Missing)

Crashed: RLMRealm notification listener
0  libsystem_kernel.dylib         0x1805dc11c __pthread_kill + 8
1  libsystem_pthread.dylib        0x1806a8ef8 pthread_kill + 112
2  libsystem_c.dylib              0x18054ddac abort + 140
3  Realm                          0x1014964d4 please_report_this_error_to_help_at_realm_dot_io + 10
4  Realm                          0x101496794 realm::util::terminate_internal(std::__1::basic_stringstream<char, std::__1::char_traits<char>, std::__1::allocator<char> >&) + 232
5  libsystem_pthread.dylib        0x1806a8ef8 pthread_kill + 112
6  Realm                          0x101496920 realm::util::terminate(char const*, char const*, long, std::initializer_list<realm::util::Printable>&&) + 368
7  libsystem_pthread.dylib        0x1806a8ef8 pthread_kill + 112
8  Realm                          0x101438b54 void realm::util::terminate<char*, char const*>(char const*, char const*, long, char*, char const*) + 50
9  Realm                          0x1014993f8 realm::SlabAlloc::do_free(unsigned long, char const*) + 704
10 libsystem_pthread.dylib        0x1806a8ef8 pthread_kill + 112
11 Realm                          0x10149c09c realm::Array::copy_on_write() + 284
12 Realm                          0x10149cc90 realm::Array::set(unsigned long, long long) + 48
13 Realm                          0x10149c084 realm::Array::copy_on_write() + 260
14 Realm                          0x10149cc90 realm::Array::set(unsigned long, long long) + 48
15 Realm                          0x10149c084 realm::Array::copy_on_write() + 260
16 Realm                          0x10149cc90 realm::Array::set(unsigned long, long long) + 48
17 Realm                          0x101519c58 realm::BpTreeBase::replace_root(std::__1::unique_ptr<realm::Array, std::__1::default_delete<realm::Array> >) + 72
18 Realm                          0x10152c1f0 realm::LinkView::LinkView(realm::LinkView::ctor_cookie const&, realm::Table*, realm::LinkListColumn&, unsigned long) + 208
19 Realm                          0x101529b50 realm::LinkListColumn::get_ptr(unsigned long) const + 500
20 Realm                          0x1015c8cd4 realm::Table::get_linklist(unsigned long, unsigned long) const + 120
21 Realm                          0x10135ee80 realm::_impl::DeepChangeChecker::check_outgoing_links(unsigned long, realm::Table const&, unsigned long, unsigned long) + 340
22 Realm                          0x10135f0dc realm::_impl::DeepChangeChecker::check_row(realm::Table const&, unsigned long, unsigned long) + 252
23 Realm                          0x10135f1dc realm::_impl::DeepChangeChecker::operator()(unsigned long) + 68
24 Realm                          0x101359068 std::__1::function<bool (unsigned long)>::operator()(unsigned long) const + 40
25 Realm                          0x1013586dc realm::_impl::CollectionChangeBuilder::calculate(std::__1::vector<unsigned long, std::__1::allocator<unsigned long> > const&, std::__1::vector<unsigned long, std::__1::allocator<unsigned long> > const&, std::__1::function<bool (unsigned long)>, realm::util::Optional<realm::IndexSet> const&) + 1356
26 Realm                          0x101384854 realm::_impl::ResultsNotifier::calculate_changes() + 516
27 Realm                          0x101384d60 realm::_impl::ResultsNotifier::run() + 180
28 Realm                          0x10137902c realm::_impl::RealmCoordinator::run_async_notifiers() + 1192
29 Realm                          0x101378b30 realm::_impl::RealmCoordinator::on_change() + 24
30 Realm                          0x101362120 realm::_impl::ExternalCommitHelper::listen() + 172
31 Realm                          0x1013631fc std::__1::__async_func<realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0>::operator()() + 28
32 Realm                          0x101363184 std::__1::__async_assoc_state<void, std::__1::__async_func<realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0> >::__execute() + 28
33 Realm                          0x10136334c std::__1::__thread_proxy<std::__1::tuple<void (std::__1::__async_assoc_state<void, std::__1::__async_func<realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0> >*> >(void*, void*) + 84
34 libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
35 libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
36 libsystem_pthread.dylib        0x1806a5028 thread_start + 4

com.facebook.react.JavaScript
0  libsystem_kernel.dylib         0x1805c0fd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x1805c0e54 mach_msg + 72
2  CoreFoundation                 0x1809f8c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1809f6964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x180920c50 CFRunLoopRunSpecific + 384
5  React                          0x101188d00 +[RCTJSCExecutor runRunLoopThread] + 264
6  Foundation                     0x181417e4c __NSThread__start__ + 1000
7  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
8  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
9  libsystem_pthread.dylib        0x1806a5028 thread_start + 4

JavaScriptCore::Marking
0  libsystem_kernel.dylib         0x1805dbf24 __psynch_cvwait + 8
1  libsystem_pthread.dylib        0x1806a6ce8 _pthread_cond_wait + 648
2  libc++.1.dylib                 0x18003342c std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 56
3  JavaScriptCore                 0x1843ed2cc JSC::GCThread::waitForNextPhase() + 144
4  JavaScriptCore                 0x1843ed364 JSC::GCThread::gcThreadMain() + 84
5  JavaScriptCore                 0x1840c2f14 WTF::threadEntryPoint(void*) + 212
6  JavaScriptCore                 0x1840c2e24 WTF::wtfThreadEntryPoint(void*) + 24
7  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
8  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
9  libsystem_pthread.dylib        0x1806a5028 thread_start + 4

com.twitter.crashlytics.ios.MachExceptionServer
0  libsystem_kernel.dylib         0x1805c0fd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x1805c0e54 mach_msg + 72
2  Remind101                      0x1005c0ae4 CLSMachExceptionServer + 4301196004
3  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
4  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
5  libsystem_pthread.dylib        0x1806a5028 thread_start + 4

com.apple.NSURLConnectionLoader
0  libsystem_kernel.dylib         0x1805c0fd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x1805c0e54 mach_msg + 72
2  CoreFoundation                 0x1809f8c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1809f6964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x180920c50 CFRunLoopRunSpecific + 384
5  CFNetwork                      0x1810a1c68 +[NSURLConnection(Loader) _resourceLoadLoop:] + 412
6  Foundation                     0x181417e4c __NSThread__start__ + 1000
7  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
8  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
9  libsystem_pthread.dylib        0x1806a5028 thread_start + 4

com.apple.CFSocket.private
0  libsystem_kernel.dylib         0x1805dc344 __select + 8
1  CoreFoundation                 0x1809ff1c8 __CFSocketManager + 648
2  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
3  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
4  libsystem_pthread.dylib        0x1806a5028 thread_start + 4

com.squareup.SocketRocket.NetworkThread
0  libsystem_kernel.dylib         0x1805c0fd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x1805c0e54 mach_msg + 72
2  CoreFoundation                 0x1809f8c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1809f6964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x180920c50 CFRunLoopRunSpecific + 384
5  Foundation                     0x181330cfc -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 308
6  SocketRocket                   0x10190ee70 -[_SRRunLoopThread main] + 252
7  Foundation                     0x181417e4c __NSThread__start__ + 1000
8  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
9  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
10 libsystem_pthread.dylib        0x1806a5028 thread_start + 4

AVAudioSession Notify Thread
0  libsystem_kernel.dylib         0x1805c0fd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x1805c0e54 mach_msg + 72
2  CoreFoundation                 0x1809f8c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1809f6964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x180920c50 CFRunLoopRunSpecific + 384
5  libAVFAudio.dylib              0x1870919e0 GenericRunLoopThread::Entry(void*) + 164
6  libAVFAudio.dylib              0x18706675c CAPThread::Entry(CAPThread*) + 84
7  libsystem_pthread.dylib        0x1806a7b28 _pthread_body + 156
8  libsystem_pthread.dylib        0x1806a7a8c _pthread_body + 154
9  libsystem_pthread.dylib        0x1806a5028 thread_start + 4

com.apple.libdispatch-manager
0  libsystem_kernel.dylib         0x1805dd4d8 kevent_qos + 8
1  libdispatch.dylib              0x1804a07d8 _dispatch_mgr_invoke + 232
2  libdispatch.dylib              0x18048f648 _dispatch_source_invoke + 50

Version of Realm and Tooling

In the CONTRIBUTING guidelines, you will find a script,
which will help determining these versions.

Realm version: 2.1.0

Xcode version: 8.1

iOS/OSX version: 9 && 10

Dependency manager + version: cocoapods

T-Bug-Crash

All 9 comments

Hi @rex-remind101, I'm sorry you're affected by this.

Unfortunately, this report is missing considerable information before we can do much to investigate this. I understand you cannot reproduce in a project in which you can share with us, but here's some useful information to share short of a full repro:

  1. Does this crash happen with previous versions of Realm? Is this a regression specific to 2.1.0?
  2. How common is this crash? What percentage of sessions/users/Realms are affected?
  3. Does doing/avoid certain things make this crash more/less likely to happen? Like avoiding certain parts of your app, avoiding notification blocks, using a 32-bit vs 64-bit device, Simulator vs device, debug vs release builds, updating from an app using a previous version of Realm vs starting fresh, etc.

Also sharing the message that's logged to the console would help.

Given that the stack trace shows the termination handler kicking in at realm::SlabAlloc::do_free(unsigned long, char const*) + 704, my guess is that the second assertion is the one failing, not the first: https://github.com/realm/realm-core/blob/v2.1.4/src/realm/alloc_slab.cpp#L388-L463

// Mutable memory cannot be freed unless it has first been allocated, and
// any allocation puts free space tracking into the "dirty" state.
REALM_ASSERT_3(read_only, ||, m_free_space_state == free_space_Dirty);

This is likely related to the elusive double-free bug we've been trying to trace down in core lately. See realm/realm-core#2293.

Crashed: RLMRealm notification listener
SIGABRT ABORT 0x00000001927fa014

This is a new crash for us. We just released a new version to the app store where we updated from Realm 2.0.3 to 2.1.0. We'll need to wait to see how prevalent this is.

current data
screen shot 2016-11-29 at 11 53 21 am

We think we may have fixed this in core 2.2.0, we're just waiting for a release of the sync binaries before we can include those fixes in Realm ObjC/Swift, and then we'll be able to get you to update to that release to confirm this issue's resolved.

Amazing 馃憤 It's our biggest crash atm though <1% of users affected.

@rex-remind101 could you please update to 2.1.1 and let us know if this is resolved? https://github.com/realm/realm-cocoa/releases/tag/v2.1.1

Will do 馃憤, we'll update here when our next iOS release goes out and we have some data.

Hi @rex-remind101!

Hopefully that new Realm release fixed your issue. It's nearly been 3 weeks since there was activity in this issue, so I'm going to close it off.

If it turns out that the issue is still persisting, please feel free to re-open and follow up. :)

Happy holidays!

Was this page helpful?
0 / 5 - 0 ratings