[Bug]: DevTools performance profile lead to crash (or Renderer crash) on Apple M1 MacOS BigSur 11.3.1

[nbashkankov]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Electron Version

7.2.1, 11.4.2

What operating system are you using?

macOS

Operating System Version

11.3.1

What arch are you using?

x64

Last Known Working Electron version

N/a

Expected Behavior

Open DevTools-> Performance tab -> press "Capture"

Tracing starts capturing without crasing Renderer or Full Application.

Actual Behavior

There are different behavior on various electron version:
Electron 7.2.1 - Only Renderer process gone with WSOD - issue is floating - sometimes renderer crash/sometimes not (cant find pattern)
[ERROR:platform_shared_memory_region_mac.cc(230)] mach_vm_map: (ipc/send) invalid msg-header (0x10000010)
after that error Renderer on which Capture was started are crashed, rest of Application (Main and other processes works ok)

Electron 11.4.2 - Right after Capture press - whole App freezing - and later App crash with MacOS report:
sometimes i see this error:

[ERROR:platform_shared_memory_region_mac.cc(205)] mach_vm_map: (ipc/send) invalid msg-header (0x10000010)

System Integrity Protection: enabled

Crashed Thread:        0  CrBrowserMain  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BREAKPOINT (SIGTRAP)
Exception Codes:       0x0000000000000002, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Trace/BPT trap: 5
Termination Reason:    Namespace SIGNAL, Code 0x5
Terminating Process:   exc handler [13703]

Thread 0 Crashed:: CrBrowserMain  Dispatch queue: com.apple.main-thread
0   com.github.Electron.framework 	0x000000010bcc4af9 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 6234585
1   libsystem_kernel.dylib        	0x00007fff203c5e0a __sigreturn + 10

Thread 1:: com.apple.rosetta.exceptionserver
0   runtime                       	0x00007ffdffbde878 0x7ffdffbdd000 + 6264
1   runtime                       	0x00007ffdffbe8d70 0x7ffdffbdd000 + 48496
2   runtime                       	0x00007ffdffbe9a40 0x7ffdffbdd000 + 51776

Thread 2:
0   runtime                       	0x00007ffdffc3799c 0x7ffdffbdd000 + 371100

sometimes this:

assertion failed: emulated forward to an arm pc that isn't in translated code.  arm_pc=0x118862064 abi_kind=4 emulation_interval=[0x11a13fbbc,0x11abcf88c) instruction_interval=[0x11abcf864, 0x11abcf88c) x86_rip=0x10f05c70a
(ThreadContextRegisterState.cpp:690 move_to_instruction_boundary)

Crashed Thread:        0  CrBrowserMain  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BREAKPOINT (SIGTRAP)
Exception Codes:       EXC_ARM_BREAKPOINT at 0x00007ffdffee2360 (brk 1)
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Trace/BPT trap: 5
Termination Reason:    Namespace SIGNAL, Code 0x5
Terminating Process:   exc handler [13498]

Application Specific Information:
assertion failed: emulated forward to an arm pc that isn't in translated code.  arm_pc=0x118862064 abi_kind=4 emulation_interval=[0x11a13fbbc,0x11abcf88c) instruction_interval=[0x11abcf864, 0x11abcf88c) x86_rip=0x10f05c70a
(ThreadContextRegisterState.cpp:690 move_to_instruction_boundary)
 

Thread 0 Crashed:: CrBrowserMain  Dispatch queue: com.apple.main-thread
0   runtime                       	0x00007ffdffee2360 0x7ffdffe8f000 + 340832
1   runtime                       	0x00007ffdffee1d6c 0x7ffdffe8f000 + 339308
2   runtime                       	0x00007ffdffea4a58 0x7ffdffe8f000 + 88664
3   runtime                       	0x00007ffdffea7138 0x7ffdffe8f000 + 98616
4   runtime                       	0x00007ffdffee9808 0x7ffdffe8f000 + 370696
5   <translation info unavailable>	0x00000001011291f0 ???
6   com.github.Electron.framework 	0x000000010993707e v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7198558
7   com.github.Electron.framework 	0x000000010ccfa3c5 v8::internal::compiler::ZoneStats::GetCurrentAllocatedBytes() const + 13320485
8   com.github.Electron.framework 	0x000000010ccfa526 v8::internal::compiler::ZoneStats::GetCurrentAllocatedBytes() const + 13320838
9   com.github.Electron.framework 	0x000000010c2c5475 v8::internal::compiler::ZoneStats::GetCurrentAllocatedBytes() const + 2617813
10  com.github.Electron.framework 	0x00000001094d324e v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 2595118
11  com.github.Electron.framework 	0x00000001094bf8f1 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 2514897
12  com.github.Electron.framework 	0x000000010894bc74 ElectronInitializeICUandStartNode + 2509044

both cases for Electrons 11 has in common issue after SetupIsolateDelegate::SetupHeap(v8::internal::Heap*)

Testcase Gist URL

No response

Additional Information

No response

[zcbenz]

Does this problem happen on later versions >= 12?

[nornagon]

Please attach a crash dump. You can collect them by adding the following snippet to your main process code, before app.whenReady:

const { app, crashReporter } = require('electron')

console.log(app.getPath('crashDumps'))
crashReporter.start({ submitURL: '', uploadToServer: false })

Then reproduce the crash, zip up the crash dumps directory and attach it here.

[nbashkankov]

Does this problem happen on later versions >= 12?

checked on Electron 12.0.9
Same result: right after record started - freeze than crash with same reason about SetupHeap

Crashed Thread:        0  CrBrowserMain  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BREAKPOINT (SIGTRAP)
Exception Codes:       0x0000000000000002, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Trace/BPT trap: 5
Termination Reason:    Namespace SIGNAL, Code 0x5
Terminating Process:   exc handler [21902]

Thread 0 Crashed:: CrBrowserMain  Dispatch queue: com.apple.main-thread
0   com.github.Electron.framework 	0x000000010a414fc9 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 6271689
1   libsystem_kernel.dylib        	0x00007fff20429e0a __sigreturn + 10
2   ???                           	0x00007f84db9533e8 ???
3   com.github.Electron.framework 	0x000000010a5639f7 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7642359
4   com.github.Electron.framework 	0x000000010a563d8e v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7643278
5   com.github.Electron.framework 	0x000000010a56cfff v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7680767
6   com.github.Electron.framework 	0x000000010cf9e088 v8::internal::compiler::ZoneStats::GetCurrentAllocatedBytes() const + 6977144
7   com.github.Electron.framework 	0x000000010a550b0a v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7564810
8   com.github.Electron.framework 	0x000000010a556366 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7587430
9   com.github.Electron.framework 	0x000000010a555cdd v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7585757
10  com.github.Electron.framework 	0x000000010a54e4e0 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7555040
11  com.github.Electron.framework 	0x000000010a54ed9e v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 7557278

from electron logs (--enable-logging v1):

[:ERROR:platform_shared_memory_region_mac.cc(205)] mach_vm_map: (ipc/send) invalid msg-header (0x10000010)

[nornagon]

SetupHeap is a mislabeling of the address. Please attach a crash dump, using the instructions in #29627 (comment)

[nbashkankov]

SetupHeap is a mislabeling of the address. Please attach a crash dump, using the instructions in #29627 (comment)

hi - tryed with 11.4.1 - unfortunately - no luck with crashpad - chrome_crashpad_handler didnt capture any crash dump.
crashDumps folder are always empty - even if i just manually call process.crash()
(only .../Crashpad/settings.dat file always changed but it has 40 bytes size)

i see that chrome_crashpad_handler launched right after App started and closed after crash, but no dumps 🤷‍♂️

[nornagon]

Hm, that's worrisome! Can you try out this super simple repo just to make sure we're testing the same thing? https://gist.github.com/nornagon/d3d4f440a83eca642b076f28a12d8d10

Instructions:

git clone https://gist.github.com/d3d4f440a83eca642b076f28a12d8d10.git crash-test
cd crash-test
npm install
npm start
ls ~/Library/Application\ Support/crash-test/Crashpad/pending

It should list a .dmp file.

[nbashkankov]

@nornagon - followed your instruction - no luck:

[nornagon]

nothing in completed or new either?

[blaadje]

Hi, got the same issue Mac m1 os 11.1 , Electron 13.1.2.
Tried the Crashpad as well and nothing in there

The issue happens 100% of time.

[nbashkankov]

nothing in completed or new either?

yep. all folders are empty. Probably there is separate issue with Crashpad on M1 - but it outside of my topic

issue from topic is really important - it blocks me from investigating performance issues.

Even more - i tryed to capture trace via CDP(ChromeDevToolsProtocol) client - same issue -
App crashed when Tracing.start executed