iOS app crashes on release mode when performing a .Sum on a List of 20k+ items

[andyx48]

Description

Our production app is crashing without leaving any stacktrace when performing a .Sum or .Average on a List of ~20k items in release mode.

When manually performing the operation in a foreach instead of using .Sum, works as expected.

I have also tried to replicate the .Sum method on my code to see where the issue arises, and it seems that the use of Generics is what is making the app to crash, when changing the generics data types to defined data types, the app does not crash.

I have attached a basic reproduction app.

Steps to Reproduce

1. Create a new dotnet MAUI app.
2. Create a List of a custom model with one of the properties being a decimal.
3. Add 20k elements to the list.
4. Perform a List.Sum(x=>x.DecimalProperty)

Expected result:
To perform the sum of the items.

Actual results:
The app crashes when attempting to perform the operation, but only on Release mode, works as expected when on Debug mode

Link to public reproduction project repository

https://github.com/andyx48/GenericsCrashRepro

Version with bug

8.0.3

Is this a regression from previous behavior?

Yes, this used to work in Xamarin.Forms

Last version that worked well

Unknown/Other

Affected platforms

iOS

Affected platform versions

iOS 15 and up to the latest version

Did you find any workaround?

No

Relevant log output

No response

[drasticactions]

I checked out your project and I couldn't reproduce a crash on simulator nor device with Release mode. I also created a generic iOS project using your code and couldn't get it to crash there either. If there is a crash, in all likelihood, it would be a runtime issue rather than a MAUI UI issue, but seeing that in your app, CollectionView was causing the UI to perform very poorly and at a low framerate, my guess is that control might be causing more issues that could lead to whatever crash you're having.

Could you try my repro project and see if that crashes on your device.

@rolfbjarne Would you know of more ways to get more information about this crash this user is having?

[ghost]

Hi @andyx48. We have added the "s/needs-info" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[rolfbjarne]

Either of these (preferrably both) could be useful:

• Device logs: https://support.apple.com/en-in/guide/console/cnsl1012/mac
• Crash repors: https://github.com/xamarin/xamarin-macios/wiki/Diagnosis#crash-reports

[andyx48]

Hey @drasticactions, I tried with your repro project, and is also crashing for me in release mode using my physical device iPhone XS Max iOS Version 17.2.
I also tried to make it crash using an emulator (which I haven't tried before) but I was not able to reproduce there, so must be physical devices only.
Attached the video of the crash, the logs and crash report which I generated with your repro app.
DeviceLogs.zip
GenericCrash-2024-01-26-072406.ips.zip

RPReplay_Final1706217849.MP4

[rolfbjarne]

Unfortunately the native stack trace isn't all that helpful, because native symbols were stripped:

hread 0 name:  tid_103 Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   GenericCrash                  	       0x104969b3c 0x10439c000 + 6085436
1   GenericCrash                  	       0x1049c7a68 0x10439c000 + 6470248
2   GenericCrash                  	       0x104a073fc 0x10439c000 + 6730748
3   GenericCrash                  	       0x1043d1234 0x10439c000 + 217652
4   GenericCrash                  	       0x1044a3fcc 0x10439c000 + 1081292
5   GenericCrash                  	       0x104486af8 0x10439c000 + 961272
6   GenericCrash                  	       0x104a1c4f4 0x10439c000 + 6817012
7   GenericCrash                  	       0x1049c3ce0 0x10439c000 + 6454496
8   GenericCrash                  	       0x104a1ff20 0x10439c000 + 6831904
9   GenericCrash                  	       0x10448b4f0 0x10439c000 + 980208
10  GenericCrash                  	       0x1043ac6f8 0x10439c000 + 67320
11  GenericCrash                  	       0x1044a3fcc 0x10439c000 + 1081292
12  GenericCrash                  	       0x10463dfb8 0x10439c000 + 2760632
13  GenericCrash                  	       0x104a1c4f4 0x10439c000 + 6817012
14  GenericCrash                  	       0x1049c4ad0 0x10439c000 + 6458064
15  GenericCrash                  	       0x1049c7908 0x10439c000 + 6469896
16  GenericCrash                  	       0x104a8baec 0x10439c000 + 7273196
17  GenericCrash                  	       0x104a8b9b4 0x10439c000 + 7272884
18  UIKitCore                     	       0x1a3b37850 -[UIApplication sendAction:to:from:forEvent:] + 99
19  UIKitCore                     	       0x1a34dbdd8 -[UIControl sendAction:to:forEvent:] + 111
20  UIKitCore                     	       0x1a34dc150 -[UIControl _sendActionsForEvents:withEvent:] + 323
21  UIKitCore                     	       0x1a34d9774 -[UIButton _sendActionsForEvents:withEvent:] + 123
22  UIKitCore                     	       0x1a34db280 -[UIControl touchesEnded:withEvent:] + 399

Can you add the following to the csproj, try again and get an updated crash report?

<PropertyGroup>
    <NoSymbolStrip>true</NoSymbolStrip>
</PropertyGroup>

That should make the stack trace better.

BTW the device log didn't show anything useful, so there's no need to get an updated version of that.

[ghost]

Hi @andyx48. We have added the "s/needs-info" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[andyx48]

No problem, here the crash report with <NoSymbolStrip>true</NoSymbolStrip>
GenericCrash-2024-01-29-071217.ips.zip

[rolfbjarne]

OK, that's a better crash report:

Thread 0 name:  tid_103 Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   GenericCrash                  	       0x100709b8c mono_class_instance_size + 0
1   GenericCrash                  	       0x100767ab8 mono_class_value_size + 24
2   GenericCrash                  	       0x1007a744c mono_gc_wbarrier_value_copy_internal + 172
3   GenericCrash                  	       0x100171234 System_Decimal_CreateChecked_TOther_GSHAREDVT_TOther_GSHAREDVT + 292
4   GenericCrash                  	       0x100243fcc gsharedvt_trampoline + 220
5   GenericCrash                  	       0x100226af8 wrapper_runtime_invoke_object_runtime_invoke_dynamic_intptr_intptr_intptr_intptr + 296
6   GenericCrash                  	       0x1007bc544 mono_jit_runtime_invoke + 1380
7   GenericCrash                  	       0x100763d30 mono_runtime_invoke_checked + 148
8   GenericCrash                  	       0x1007bff70 mono_gsharedvt_constrained_call + 420
9   GenericCrash                  	       0x10022b4f0 wrapper_managed_to_native_object___icall_wrapper_mono_gsharedvt_constrained_call_intptr_intptr_intptr_intptr_intptr_intptr + 160
10  GenericCrash                  	       0x10014c6f8 System_Linq_Enumerable_Average_TSource_GSHAREDVT_TSelector_GSHAREDVT_TAccumulator_GSHAREDVT_TResult_GSHAREDVT_System_Collections_Generic_IEnumerable_1_TSource_GSHAREDVT_System_Func_2_TSource_GSHAREDVT_TSelector_GSHAREDVT + 856
11  GenericCrash                  	       0x100243fcc gsharedvt_trampoline + 220
12  GenericCrash                  	       0x1003de008 System_Linq_System_Linq_Enumerable_Average_TSource_REF_System_Collections_Generic_IEnumerable_1_TSource_REF_System_Func_2_TSource_REF_System_Decimal + 112
13  GenericCrash                  	       0x1007bc544 mono_jit_runtime_invoke + 1380
14  GenericCrash                  	       0x100764b20 mono_runtime_try_invoke + 156
15  GenericCrash                  	       0x100767958 mono_runtime_invoke + 480
16  GenericCrash                  	       0x10082bb3c native_to_managed_trampoline_6(objc_object*, objc_selector*, _MonoMethod**, unsigned int) + 300
17  GenericCrash                  	       0x10082ba04 -[UIKit_UIControlEventProxy BridgeSelector] + 44

[rolfbjarne]

I can reproduce the crash, and this looks like something for dotnet/runtime.

[rolfbjarne]

Crash in lldb:

(lldb) bt
* thread dotnet/maui#1, name = 'tid_103', queue = 'com.apple.main-thread', stop reason = signal SIGSEGV
  * frame #0: 0x0000000102a76520 GenericCrash`mono_class_value_size(klass=0x000000014b0a7720, align=0x0000000000000000) at object.c:8013 [opt]
    frame dotnet/maui#1: 0x0000000102ab222c GenericCrash`mono_gc_wbarrier_value_copy_internal(dest=0x0000000103538458, src=0x000000016d868050, count=1, klass=0x000000014b0a7720) at sgen-mono.c:117:25 [opt]
    frame dotnet/maui#2: 0x00000001024d1234 GenericCrash`System_Decimal_CreateChecked_TOther_GSHAREDVT_TOther_GSHAREDVT + 292
    frame dotnet/maui#3: 0x00000001025a3fcc GenericCrash`gsharedvt_trampoline + 220
    frame dotnet/maui#4: 0x0000000102586af8 GenericCrash`wrapper_runtime_invoke_object_runtime_invoke_dynamic_intptr_intptr_intptr_intptr + 296
    frame dotnet/maui#5: 0x0000000102ac69fc GenericCrash`mono_jit_runtime_invoke(method=<unavailable>, obj=<unavailable>, params=<unavailable>, exc=<unavailable>, error=0x000000016d8683f8) at mini-runtime.c:3636:3 [opt]
    frame dotnet/maui#6: 0x0000000102a727a4 GenericCrash`mono_runtime_invoke_checked [inlined] do_runtime_invoke(method=0x0000000281681140, obj=0x0000000000000000, params=0x000000016d868448, exc=0x0000000000000000, error=0x000000016d8683f8) at object.c:2573:11 [opt]
    frame dotnet/maui#7: 0x0000000102a72768 GenericCrash`mono_runtime_invoke_checked(method=0x0000000281681140, obj=0x0000000000000000, params=0x000000016d868448, error=0x000000016d8683f8) at object.c:2789:9 [opt]
    frame dotnet/maui#8: 0x0000000102aca35c GenericCrash`mono_gsharedvt_constrained_call(mp=<unavailable>, cmethod=<unavailable>, klass=<unavailable>, info=<unavailable>, deref_args="", args=0x000000016d868448) at jit-icalls.c:1497:6 [opt]
    frame dotnet/maui#9: 0x000000010258b4f0 GenericCrash`wrapper_managed_to_native_object___icall_wrapper_mono_gsharedvt_constrained_call_intptr_intptr_intptr_intptr_intptr_intptr + 160
    frame dotnet/maui#10: 0x00000001024ac6f8 GenericCrash`System_Linq_Enumerable_Average_TSource_GSHAREDVT_TSelector_GSHAREDVT_TAccumulator_GSHAREDVT_TResult_GSHAREDVT_System_Collections_Generic_IEnumerable_1_TSource_GSHAREDVT_System_Func_2_TSource_GSHAREDVT_TSelector_GSHAREDVT(param0=<unavailable>, param1=<unavailable>) at <unknown>:1

[rolfbjarne]

FWIW I reproduced using @drasticactions's project: https://github.com/drasticactions/MauiRepros/tree/main/GenericCrash, and building it like this:

dotnet build /p:RuntimeIdentifier=ios-arm64 /p:Configuration=Release /bl GenericCrash.csproj

[ghost]

Tagging subscribers to 'os-ios': @steveisok, @akoeplinger, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Our production app is crashing without leaving any stacktrace when performing a .Sum or .Average on a List of ~20k items in release mode.

When manually performing the operation in a foreach instead of using .Sum, works as expected.

I have also tried to replicate the .Sum method on my code to see where the issue arises, and it seems that the use of Generics is what is making the app to crash, when changing the generics data types to defined data types, the app does not crash.

I have attached a basic reproduction app.

Steps to Reproduce

1. Create a new dotnet MAUI app.
2. Create a List of a custom model with one of the properties being a decimal.
3. Add 20k elements to the list.
4. Perform a List.Sum(x=>x.DecimalProperty)

Expected result:
To perform the sum of the items.

Actual results:
The app crashes when attempting to perform the operation, but only on Release mode, works as expected when on Debug mode

Link to public reproduction project repository

https://github.com/andyx48/GenericsCrashRepro

Version with bug

8.0.3

Is this a regression from previous behavior?

Yes, this used to work in Xamarin.Forms

Last version that worked well

Unknown/Other

Affected platforms

iOS

Affected platform versions

iOS 15 and up to the latest version

Did you find any workaround?

No

Relevant log output

No response

Author:	andyx48
Assignees:	-
Labels:	untriaged, os-ios, needs-area-label
Milestone:	-

[steveisok]

@vargaz can you please take a look?

[vargaz]

I can reproduce.

[charlesroddie]

This is the same as #97224 in that it involves ios, mono aot, gc writebarrier, linq average, and decimal.

The crash we are getting is vaguely similar but involves ios, gc, a writing guard exception, and linq. But it's coreclr/nativeaot and no decimal.

[ivanpovazan]

FWIW, these were detected as failures on tvos-arm64 runs and relevant tests got disabled in #97511

As @charlesroddie suggested the tracking issue is: #97224

[steveisok]

@vitek-karas since this was hit in .net 8, it would make sense to backport #97721. What do you think?

[vitek-karas]

I agree - especially since it was customer reported. It should be easy to make the case to get this to servicing.
@vargaz could you please backport the fix to 8.0-servicing?