Using mapbox.terrain-rgb will crash on 5.8.0-alpha/beta.1

[ystsoi]

If a style contains a layer with the mapbox.terrain-rgb data source, it will always crash on version 5.8.0-alpha.1 or 5.8.0-beta.1. It will not crash on 5.7.

Steps to reproduce

1. Create a blank style.
2. Add a layer, and set the data source to mapbox.terrain-rgb.
3. Use the style in an app using Mapbox SDK 5.8.0-beta.1.

Expected behavior

Show the map properly.

Actual behavior

Crash on start.

Configuration

Mapbox SDK versions: 5.8.0-alpha.1 / 5.8.0-beta.1 iOS/macOS versions: iOS 13.3.1 / macOS 10.15.3 Device/simulator models: iPhone 6s / iPhone 11 Pro Max simulator Xcode version: Xcode 11.3.1

[knov]

@ystsoi thanks for reporting. Could you provide crash logs and information on how reproducible this issue is (os/device/frequency)?

[ystsoi]

Here is a crash log on iPhone 6s, always crash for style with mapbox.terrain-rgb:

Date/Time:           2020-03-25 23:37:19.5853 +0800
Launch Time:         2020-03-25 23:37:19.0087 +0800
OS Version:          iPhone OS 13.3.1 (17D50)
Release Type:        User
Baseband Version:    7.30.02
Report Version:      104

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000
VM Region Info: 0 is not in any region.  Bytes before following region: 4372398080
      REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                 00000001049d8000-00000001049ec000 [   80K] r-x/r-x SM=COW  ...TestMapboxCPo

Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [594]
Triggered by Thread:  0

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   GLEngine                        0x00000001bf182e84 gleRunVertexSubmitARM + 868
1   ???                             0x0000000000000002 0 + 2
2   GLEngine                        0x00000001bf180c34 gleSetVertexArrayFunc + 144
3   GLEngine                        0x00000001bf142b88 glDrawElements_ACC_ES2Exec + 756
4   Mapbox                          0x0000000104e1e8e8 0x104da8000 + 485608
5   Mapbox                          0x0000000104e67664 0x104da8000 + 783972
6   Mapbox                          0x0000000104ebbf24 0x104da8000 + 1130276
7   Mapbox                          0x0000000104ebb90c 0x104da8000 + 1128716
8   Mapbox                          0x0000000104ebb324 0x104da8000 + 1127204
9   Mapbox                          0x0000000104ef1a68 0x104da8000 + 1350248
10  Mapbox                          0x0000000104ef0224 0x104da8000 + 1344036
11  Mapbox                          0x00000001051110dc 0x104da8000 + 3576028
12  Mapbox                          0x00000001050c8150 0x104da8000 + 3277136
13  GLKit                           0x00000001cdfcd6c0 -[GLKView _display:] + 208
14  Mapbox                          0x0000000105112478 0x104da8000 + 3581048
15  QuartzCore                      0x00000001ab5ff130 CA::Display::DisplayLink::dispatch_items+ 74032 (unsigned long long, unsigned long long, unsigned long long) + 632
16  IOKit                           0x00000001a5c03930 IODispatchCalloutFromCFMessage + 488
17  CoreFoundation                  0x00000001a4c0f8ac __CFMachPortPerform + 172
18  CoreFoundation                  0x00000001a4c3907c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
19  CoreFoundation                  0x00000001a4c387a8 __CFRunLoopDoSource1 + 444
20  CoreFoundation                  0x00000001a4c3367c __CFRunLoopRun + 2168
21  CoreFoundation                  0x00000001a4c32adc CFRunLoopRunSpecific + 464
22  GraphicsServices                0x00000001aebd3328 GSEventRunModal + 104
23  UIKitCore                       0x00000001a8d4063c UIApplicationMain + 1936
24  TestMapboxCPo                   0x00000001049e7b00 0x1049d8000 + 64256
25  libdyld.dylib                   0x00000001a4abc360 start + 4

[1ec5]

Unfortunately the stack trace isn’t fully symbolicated, but it looks like the crash is down in OpenGL code.

/cc @mapbox/gl-native

[chloekraw]

@ystsoi thank you for reporting this, we will investigate.

[ystsoi]

The crash log is for 5.8.0-beta.1.

It seems that manually symbolicating the stack trace line by line works: atos -arch arm64 -o ~/Downloads/mapbox-ios-sdk-5/dynamic/Mapbox.framework.dSYM/Contents/Resources/DWARF/Mapbox -l 0x104da8000 0x0000000105112478

[alexshalamov]

@1ec5 did you manage to reproduce it? I tried on iPhone Xr and can't reproduce it, I should have iPhone6 and iPhoneSE somewhere, can try later today.

[chloekraw]

@alexshalamov thanks for investigating, are you using devices that are on iOS version 13.3.1? Have you also tried on the simulator? The OP reports this crash on iPhone 11 Pro Max simulator as well.

@ystsoi thanks for all this information. Since we're having trouble reproducing, could you perhaps share your style and provide us with more information about your implementation? Are you using MGLIdeographicFontFamilyName to render CJK glyphs locally, or using any other runtime features? My email address is on my GitHub profile if you'd prefer to share this information privately.

If we can reproduce this crash this week, we'll be able to get a fix into the final release to be published early next week. Thanks again!

[ystsoi]

I have uploaded the test program to: https://github.com/ystsoi/mapbox-gl-native-ios/tree/test-terrain-rgb-issue/TestTerrainRGBIssue

Updated to use 5.8.0-beta.2, which still has the issue.

Just run pod install, set back MGLMapboxAccessToken, run it in a simulator, and you should be able to reproduce the crash.

The style is as simple as one source and one layer: https://github.com/ystsoi/mapbox-gl-native-ios/blob/test-terrain-rgb-issue/TestTerrainRGBIssue/TestTerrainRGBIssue/style.json

[1ec5]

I can reliably reproduce this issue in macosapp (the version attached to macOS map SDK v0.15.0-beta.2) in macOS 10.15.3 (19D76) on a mid-2014 MacBook Pro. To reproduce, use the Debug ‣ Enhance Terrain menu item, which adds an RGB terrain layer to the style:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [23857]

VM Regions Near 0:
--> 
    __TEXT                 000000010bb77000-000000010bb8f000 [   96K] r-x/r-x SM=COW  /Applications/Mapbox GL.app/Contents/MacOS/Mapbox GL

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   GLEngine                        0x00007fff433e02b2 gleRunVertexSubmitImmediate + 930
1   GLEngine                        0x00007fff4337afe5 glDrawElements_ACC_Exec + 948
2   com.mapbox.Mapbox               0x000000010bc30d0e mbgl::gl::Context::draw(mbgl::gfx::DrawMode const&, unsigned long, unsigned long) + 206
3   com.mapbox.Mapbox               0x000000010bc8a72e mbgl::gl::Program<mbgl::HillshadeProgram>::draw(mbgl::gfx::Context&, mbgl::gfx::RenderPass&, mbgl::gfx::DrawMode const&, mbgl::gfx::DepthMode const&, mbgl::gfx::StencilMode const&, mbgl::gfx::ColorMode const&, mbgl::gfx::CullFaceMode const&, mbgl::gfx::UniformValues<mbgl::TypeList<mbgl::uniforms::matrix, mbgl::uniforms::highlight, mbgl::uniforms::shadow, mbgl::uniforms::accent, mbgl::uniforms::light, mbgl::uniforms::latrange> > const&, mbgl::gfx::DrawScope&, mbgl::gfx::AttributeBindings<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> > const&, mbgl::gfx::TextureBindings<mbgl::TypeList<mbgl::textures::image> > const&, mbgl::gfx::IndexBuffer const&, unsigned long, unsigned long) + 686
4   com.mapbox.Mapbox               0x000000010bcf08ed void mbgl::Program<mbgl::HillshadeProgram, (mbgl::gfx::PrimitiveType)2, mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos>, mbgl::TypeList<mbgl::uniforms::matrix, mbgl::uniforms::highlight, mbgl::uniforms::shadow, mbgl::uniforms::accent, mbgl::uniforms::light, mbgl::uniforms::latrange>, mbgl::TypeList<mbgl::textures::image>, mbgl::style::HillshadePaintProperties>::draw<mbgl::gfx::Triangles>(mbgl::gfx::Context&, mbgl::gfx::RenderPass&, mbgl::gfx::Triangles const&, mbgl::gfx::DepthMode const&, mbgl::gfx::StencilMode const&, mbgl::gfx::ColorMode const&, mbgl::gfx::CullFaceMode const&, mbgl::gfx::IndexBuffer const&, std::__1::vector<mbgl::Segment<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> >, std::__1::allocator<mbgl::Segment<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> > > > const&, mbgl::gfx::UniformValues<mbgl::TypeList<mbgl::uniforms::matrix, mbgl::uniforms::highlight, mbgl::uniforms::shadow, mbgl::uniforms::accent, mbgl::uniforms::light, mbgl::uniforms::latrange> > const&, mbgl::gfx::AttributeBindings<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> > const&, mbgl::gfx::TextureBindings<mbgl::TypeList<mbgl::textures::image> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 493
5   com.mapbox.Mapbox               0x000000010bcefe4e auto mbgl::RenderHillshadeLayer::render(mbgl::PaintParameters&)::$_0::operator()<mbgl::gfx::VertexBuffer<mbgl::gfx::detail::VertexType<mbgl::gfx::AttributeType<short, 2ul>, mbgl::gfx::AttributeType<unsigned short, 2ul> > >, mbgl::gfx::IndexBuffer, std::__1::vector<mbgl::Segment<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> >, std::__1::allocator<mbgl::Segment<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> > > >, mbgl::gfx::TextureBindings<mbgl::TypeList<mbgl::textures::image> > >(std::__1::array<double, 16ul> const&, mbgl::gfx::VertexBuffer<mbgl::gfx::detail::VertexType<mbgl::gfx::AttributeType<short, 2ul>, mbgl::gfx::AttributeType<unsigned short, 2ul> > > const&, mbgl::gfx::IndexBuffer const&, std::__1::vector<mbgl::Segment<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> >, std::__1::allocator<mbgl::Segment<mbgl::TypeList<mbgl::attributes::pos, mbgl::attributes::texture_pos> > > > const&, mbgl::UnwrappedTileID const&, mbgl::gfx::TextureBindings<mbgl::TypeList<mbgl::textures::image> > const&) const + 926
6   com.mapbox.Mapbox               0x000000010bcef6bd mbgl::RenderHillshadeLayer::render(mbgl::PaintParameters&) + 1885
7   com.mapbox.Mapbox               0x000000010bd320eb mbgl::Renderer::Impl::render(mbgl::RenderTree const&) + 1835
8   com.mapbox.Mapbox               0x000000010bd305e3 mbgl::Renderer::render(std::__1::shared_ptr<mbgl::UpdateParameters> const&) + 51
9   com.mapbox.Mapbox               0x000000010bf71fed -[MGLMapView renderSync] + 132 (MGLRendererFrontend.h:58)