Permalink
Browse files

Android: fix JSC crash in dev

Summary:
On Android with dev mode on, we're seeing a regular SIGSEGV when pushing a lot of animation declarations over the bridge. We tracked this down to being not specific to animations, but the crash is caused in `deepFreezeAndThrowOnMutationInDev`.

Specifically: the provided object to freeze is modified while looping, replacing the current key access to a getter/setter. After the modification, JSC crashes during retrieval of the next key - but only when there are a lot of events passing over the bridge.

We have a hunch that this is due to a bug in JSC object enumeration but did we not look into it further yet. Any help here is welcome. The JS code seems all right at first sight and shouldn't cause a segmentation crash.

The workaround in this PR is to retrieve the keys first from the object and then looping over that array. In our app and in a reduced app test case this fixes the crash.

If needed I can provide the reduced app test case. It's really tricky to make a test for this as it requires to be run
Closes #11804

Differential Revision: D4403483

Pulled By: davidaurelio

fbshipit-source-id: a31e5cff734e96bfec56e4a39dc1c6854798e245
  • Loading branch information...
AlbertBrand authored and facebook-github-bot committed Jan 11, 2017
1 parent e94beab commit d2de60472103e1b3f2fe82ed53cce38db6334af5
Showing with 6 additions and 2 deletions.
  1. +6 −2 Libraries/Utilities/deepFreezeAndThrowOnMutationInDev.js
@@ -38,7 +38,10 @@ function deepFreezeAndThrowOnMutationInDev(object: Object) {
return;
}
for (var key in object) {
var keys = Object.keys(object);
for (var i = 0; i < keys.length; i++) {
var key = keys[i];
if (object.hasOwnProperty(key)) {
object.__defineGetter__(key, identity.bind(null, object[key]));
object.__defineSetter__(key, throwOnImmutableMutation.bind(null, key));
@@ -48,7 +51,8 @@ function deepFreezeAndThrowOnMutationInDev(object: Object) {
Object.freeze(object);
Object.seal(object);
for (var key in object) {
for (var i = 0; i < keys.length; i++) {
var key = keys[i];
if (object.hasOwnProperty(key)) {
deepFreezeAndThrowOnMutationInDev(object[key]);
}

0 comments on commit d2de604

Please sign in to comment.