📛 malloc failures in the Flutter Engine (use after free)

Tree currently closed on post_backdrop_filter_perf_ios__timeline_summary failure.

[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +25 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:34:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +156 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:34:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +39 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:32:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +13 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:25:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +42 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:23:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +42 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:24:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +154 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:30:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +165 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:23:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +21 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:24:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +102 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:39:12: warning: unused variable '_tmp_0_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_0_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +95 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:27:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +12 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:27:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +35 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:35:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _globals._anonInterface0->ulocalMatrix_Stage0.xz * _in.inPosition + _globals._anonInterface0->ulocalMatrix_Stage0.yw;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +29 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:24:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [   +6 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:39:12: warning: unused variable '_tmp_0_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_0_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +35 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:24:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [   +7 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:35:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _globals._anonInterface0->ulocalMatrix_Stage0.xz * _in.inPosition + _globals._anonInterface0->ulocalMatrix_Stage0.yw;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +176 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:24:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +129 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:24:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +36 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:28:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:34:12: warning: unused variable '_8_prevRect'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float4 _8_prevRect = float4(-1.0, -1.0, -1.0, -1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +48 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:37:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _globals._anonInterface0->ulocalMatrix_Stage0.xz * _in.inPosition + _globals._anonInterface0->ulocalMatrix_Stage0.yw;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +36 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:39:12: warning: unused variable '_tmp_0_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_0_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +29 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:29:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:35:12: warning: unused variable '_8_prevRect'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float4 _8_prevRect = float4(-1.0, -1.0, -1.0, -1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +73 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:29:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [+1868 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:28:12: warning: unused variable 'outputColor_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float4 outputColor_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:29:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +157 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:27:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +172 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:35:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +173 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:27:12: warning: unused variable 'outputColor_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float4 outputColor_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:28:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +11 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:29:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:39:12: warning: unused variable '_tmp_0_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_0_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [  +22 ms] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:32:12: warning: unused variable '_tmp_1_inPosition'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     float2 _tmp_1_inPosition = _in.inPosition;
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]            ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] [Metal Compiler Warning] Warning: Compilation succeeded with: 
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] program_source:25:18: warning: unused variable 'outputCoverage_Stage0'
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     const float4 outputCoverage_Stage0 = float4(1.0);
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]                  ^
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [+12460 ms] Runner(785,0x16bef3000) malloc: *** error for object 0xddd6c95b4: pointer being freed was not allocated
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] Runner(785,0x16bef3000) malloc: *** set a breakpoint in malloc_error_break to debug
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [ +131 ms] Process 785 stopped
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] * thread #12, name = 'io.flutter.1.profiler', stop reason = signal SIGABRT
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     frame #0: 0x00000001c754484c libsystem_kernel.dylib`__pthread_kill + 8
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] libsystem_kernel.dylib`__pthread_kill:
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] ->  0x1c754484c <+8>:  b.lo   0x1c7544868               ; <+36>
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     0x1c7544850 <+12>: stp    x29, x30, [sp, #-0x10]!
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     0x1c7544854 <+16>: mov    x29, sp
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ]     0x1c7544858 <+20>: bl     0x1c7521f5c               ; cerror_nocancel
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] Target 0: (Runner) stopped.
[post_backdrop_filter_perf_ios__timeline_summary] [STDOUT] stdout: [        ] ios-deploy exited with code 0

https://logs.chromium.org/logs/flutter/buildbucket/cr-buildbucket.appspot.com/8852932740661390000/+/steps/run_post_backdrop_filter_perf_ios__timeline_summary/0/stdout

#77404 has also been merged into this issue.

@iskakaushik

/cc @iskakaushik is this related to the issue you are already taking a look at?

@zanderso

@zanderso it does seem similar to it, fwiw, when I reproduced #77404 a few times it ended up having very different back traces each time. I couldn't get engine built with ASAN to run on the device. I will try reproducing the crash on the simulator as see if I can make progress on it. If not I will try to bisect using the device.

@iskakaushik

I'll followup with @iskakaushik on running ASAN on device. @iskakaushik: Were you able to find anything useful with ASAN instrumented simulator builds?

@chinmaygarde

@chinmaygarde I tried building the engine for simulator, I assumed it would work, but looks like we are incorrectly selecting the asan runtime dylib for the wrong simulator cpu version. These are the commands I ran:

flutter/tools/gn --unopt --no-lto --xcode-symlinks --runtime-mode=profile --ios --simulator --asan
ninja -j50 -C out/ios_profile_sim_unopt

I get the following error:

ld: warning: ignoring file /Users/kaushikiska/code/engine/src/buildtools/mac-x64/clang/lib/clang/13.0.0/lib/darwin/libclang_rt.asan_iossim_dynamic.dylib, building for iOS Simulator-x86_64 but attempting to link with file built for iOS-arm64
Undefined symbols for architecture x86_64:
  "___asan_init", referenced from:
      _asan.module_ctor in libcopy_and_verify_framework_module.FlutterUmbrellaImport.o
  "___asan_version_mismatch_check_v8", referenced from:
      _asan.module_ctor in libcopy_and_verify_framework_module.FlutterUmbrellaImport.o
ld: symbol(s) not found for architecture x86_64
clang-13: error: linker command failed with exit code 1 (use -v to see invocation)
[1426/3345] OBJCXX obj/flutter/shell/platform/darwin/graphics/graphics.FlutterDarwinContextMetal.o
ninja: build stopped: subcommand failed.

I am attempting to do an asan build for the device and attempt to fix those failures instead of spending time on getting the simulator builds going. IIRC I encountered rpath errors for asan runtime, will attempt to fix it.

@iskakaushik

@iskakaushik are you missing a --simulator in your gn?

@jmagman

@jmagman I had it, I made a mistake when writing the comment here.

Here is a asan run attempt on the device:

iOS Engine Build (with asan)

flutter/tools/gn --unopt --no-lto --xcode-symlinks --runtime-mode=profile --ios --asan
ninja -j50 -C out/ios_profile_unopt

Host Engine Build (with asan)

flutter/tools/gn --unopt --no-lto --xcode-symlinks --runtime-mode=profile --asan
ninja -j50 -C out/host_profile_unopt

Both of those succeed.

Running the app

In $FRAMEWORK_DIR/dev/benchmarks/macrobenchmarks
Run flutter run --profile --local-engine-src-path $ENGINE_SRC --local-engine ios_profile_unopt

This fails with:

Xcode build done.                                           73.0s
(lldb) Runner(496,0x104ec38c0) malloc: nano zone abandoned due to inability to preallocate reserved vm space.
dyld: missing lazy symbol called
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x0000000104e6f440 dyld`__abort_with_payload + 8
dyld`__abort_with_payload:
->  0x104e6f440 <+8>:  b.lo   0x104e6f460               ; <+40>
    0x104e6f444 <+12>: pacibsp
    0x104e6f448 <+16>: stp    x29, x30, [sp, #-0x10]!
    0x104e6f44c <+20>: mov    x29, sp
Target 0: (Runner) stopped.

Update, more complete backtrace:

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x0000000104ed7440 dyld`__abort_with_payload + 8
    frame #1: 0x0000000104edf6e0 dyld`abort_with_payload_wrapper_internal + 104
    frame #2: 0x0000000104edf714 dyld`abort_with_payload + 16
    frame #3: 0x0000000104e8505c dyld`dyld::halt(char const*) + 612
    frame #4: 0x0000000104e85128 dyld`dyld::fastBindLazySymbol(ImageLoader**, unsigned long) + 204
    frame #5: 0x00000001931714b0 libdyld.dylib`dyld_stub_binder + 60
    frame #6: 0x0000000105c7235c Flutter`asan.module_ctor + 28
    frame #7: 0x000000010b972970 Flutter`_OBJC_PROTOCOL_$_FlutterAppLifeCycleProvider + 96
    frame #8: 0x0000000104e8b9ac dyld`dyld::libraryLocator(char const*, bool, char const*, ImageLoader::RPathChain const*, unsigned int&) + 68

Without tweaking anything in xcode the original error I got was:

dyld: Library not loaded: @rpath/libclang_rt.asan_ios_dynamic.dylib
  Referenced from: /private/var/containers/Bundle/Application/3A06217B-54B8-4CA9-A719-34B3DB898F1E/Runner.app/Frameworks/Flutter.framework/Flutter
  Reason: image not found
dyld: launch, loading dependent libraries
DYLD_LIBRARY_PATH=/usr/lib/system/introspection
DYLD_INSERT_LIBRARIES=/Developer/usr/lib/libBacktraceRecording.dylib:/Developer/usr/lib/libMainThreadChecker.dylib:/Developer/Library/PrivateFrameworks/DTDDISupport.framework/libViewDebuggerSupport.dylib

This goes away and results in the errors as seen in the comment #78076 (comment), after:

@rmacnak-google

After enabling ASAN on device, I was able to get the following backtrace: https://gist.github.com/iskakaushik/a7192d10d9218340a36276eb289e6047. Looks like it might be related to timeline trace events, given that this failure seems to be happening on various threads (it doesn't seem to happen on one specific thread). I will run a few more times to confirm.

cc: @rmacnak-google in case the linked backtrace points to any obvious causes.

Update, I've confirmed that with ASAN enabled I'm consistently hitting this problem.

@iskakaushik

Looks like the TimelineEventBlock itself has been reclaimed. That is not something the Flutter engine manages directly. AFAIK, each thread has one of its own. @iskakaushik Is the Dart VM itself being created or destroyed during the corruption? I am assuming not because we don't shut down the VM on iOS. But, beyond that, I am not sure how the timeline mechanism in the engine could cause such an issue.

[ VM ] Add missing locks in timeline recorder cleanup

Should be resolved by dart-lang/sdk@19b6790. Please re-open if this doesn't fix the failures after it makes its way into the framework.

Let's leave this open until it rolls in.

Dart rolled in with flutter-team-archive/engine#25220, should be picked up in the next engine->framework roll.

The engine->framework roll landed, but was reverted due to an unrelated regression, so this is still waiting on the roll to go through.

Zach just restarted the roller to get this one going again. Will keep this open till the framework tree is green.

It looks like an engine roll has stuck in the framework (9de2609). Is this safe to be closed now?

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

Navigation Menu

Repository navigation

📛 malloc failures in the Flutter Engine (use after free) #78076

iOS Engine Build (with asan)

Host Engine Build (with asan)

Running the app

16 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

📛 malloc failures in the Flutter Engine (use after free) #78076

Description

Activity

zanderso commented on Mar 12, 2021

iskakaushik commented on Mar 13, 2021

chinmaygarde commented on Mar 15, 2021

iskakaushik commented on Mar 16, 2021

jmagman commented on Mar 16, 2021

iskakaushik commented on Mar 16, 2021

iskakaushik commented on Mar 16, 2021

iOS Engine Build (with asan)

Host Engine Build (with asan)

Running the app

iskakaushik commented on Mar 16, 2021

iskakaushik commented on Mar 16, 2021

chinmaygarde commented on Mar 16, 2021

16 remaining items

bkonyi commented on Mar 23, 2021

zanderso commented on Mar 23, 2021

jmagman commented on Mar 25, 2021

zanderso commented on Mar 29, 2021

chinmaygarde commented on Mar 29, 2021

bkonyi commented on Mar 30, 2021

github-actions commented on Aug 3, 2021

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions