App crash: `hermes::vm::HadesGC::EvacAcceptor<false>::acceptNullable(hermes::vm::PinnedHermesValue&) ()`

[mrousavy]

Description

Dobry dzień 👋

I just tried upgrading to the new architecture in a hobby project (ShadowLens), and I seem to get a lot of crashes from Reanimated.

Once I stop a recording from the Camera, I play a fade out animation and run an unmount Layout Animation, then a mount Layout Animation for adding the thumbnail to the Gallery, and at some point during this sequence, Reanimated crashes with a Hermes exception:

Thread 0

#0  (null) in hermes::vm::HadesGC::EvacAcceptor<false>::acceptNullable(hermes::vm::PinnedHermesValue&) ()
#1  (null) in hermes::vm::GCScope::mark(hermes::vm::RootAcceptor&) ()
#2  (null) in hermes::vm::HandleRootOwner::markGCScopes(hermes::vm::RootAcceptor&) ()
#3  (null) in hermes::vm::Runtime::markRoots(hermes::vm::RootAndSlotAcceptorWithNames&, bool) ()
#4  (null) in void hermes::vm::HadesGC::youngGenEvacuateImpl<hermes::vm::HadesGC::EvacAcceptor<false>>(hermes::vm::HadesGC::EvacAcceptor<false>&, bool) ()
#5  (null) in hermes::vm::HadesGC::youngGenCollection(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, bool) ()
#6  (null) in hermes::vm::HadesGC::allocSlow(unsigned int) ()
#7  (null) in hermes::vm::JSObject* hermes::vm::GCBase::makeA<hermes::vm::JSObject, true, (hermes::vm::HasFinalizer)0, (hermes::vm::LongLived)0, hermes::vm::Runtime&, hermes::vm::Handle<hermes::vm::JSObject>&, h... ()
#8  (null) in hermes::vm::JSObject::create(hermes::vm::Runtime&, hermes::vm::Handle<hermes::vm::JSObject>) ()
#9  (null) in facebook::hermes::HermesRuntimeImpl::createObject() ()
#10 0x000000010071e5c8 in facebook::jsi::RuntimeDecorator<facebook::jsi::Runtime, facebook::jsi::Runtime>::createObject() at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native/ReactCommon/jsi/jsi/decorator.h:226
#11 0x000000010071e5c8 in facebook::jsi::WithRuntimeDecorator<reanimated::AroundLock, facebook::jsi::Runtime, facebook::jsi::Runtime>::createObject() at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native/ReactCommon/jsi/jsi/decorator.h:635
#12 0x000000010071409c in facebook::jsi::Object::Object(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native/ReactCommon/jsi/jsi/jsi.h:663
#13 0x000000010071409c in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:224
#14 0x0000000100714528 in reanimated::ShareableWorklet::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:253
#15 0x00000001007140fc in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:227
#16 0x0000000100714528 in reanimated::ShareableWorklet::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:253
#17 0x00000001007140fc in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:227
#18 0x0000000100714528 in reanimated::ShareableWorklet::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:253
#19 0x00000001007140fc in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:227
#20 0x000000010071351c in reanimated::ShareableArray::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:177
#21 0x00000001007140fc in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:227
#22 0x0000000100714528 in reanimated::ShareableWorklet::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:253
#23 0x000000010071351c in reanimated::ShareableArray::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:177
#24 0x00000001007140fc in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:227
#25 0x0000000100714528 in reanimated::ShareableWorklet::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:253
#26 0x00000001006f721c in facebook::jsi::Value reanimated::WorkletRuntime::runGuarded<>(std::__1::shared_ptr<reanimated::ShareableWorklet> const&) const at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/ReanimatedRuntime/WorkletRuntime.h:42
#27 0x00000001006f721c in reanimated::NativeReanimatedModule::scheduleOnUI(facebook::jsi::Runtime&, facebook::jsi::Value const&)::$_7::operator()() const at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/NativeModules/NativeReanimatedModule.cpp:178
#28 0x00000001006f721c in decltype(std::declval<reanimated::NativeReanimatedModule::scheduleOnUI(facebook::jsi::Runtime&, facebook::jsi::Value const&)::$_7&>()()) std::__1::__invoke[abi:ue170006]<reanimated::NativeReanimate... ()
#29 0x00000001006f721c in void std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:ue170006]<reanimated::NativeReanimatedModule::scheduleOnUI(facebook::jsi::Runtime&, facebook::jsi::Value const&)::$_7&>(reanimate... ()
#30 0x00000001006f721c in std::__1::__function::__alloc_func<reanimated::NativeReanimatedModule::scheduleOnUI(facebook::jsi::Runtime&, facebook::jsi::Value const&)::$_7, std::__1::allocator<reanimated::NativeReanimatedModul... ()
#31 0x00000001006f721c in std::__1::__function::__func<reanimated::NativeReanimatedModule::scheduleOnUI(facebook::jsi::Runtime&, facebook::jsi::Value const&)::$_7, std::__1::allocator<reanimated::NativeReanimatedModule::sch... ()
#32 0x000000010071c3d8 in std::__1::__function::__value_func<void ()>::operator()[abi:ue170006]() const ()
#33 0x000000010071c3d8 in std::__1::function<void ()>::operator()() const ()
#34 0x000000010071c3d8 in reanimated::UIScheduler::triggerUI() at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/Tools/UIScheduler.cpp:16
#35 (null) in _dispatch_call_block_and_release ()
#36 (null) in _dispatch_client_callout ()
#37 (null) in _dispatch_main_queue_drain ()
#38 (null) in _dispatch_main_queue_callback_4CF ()
#39 (null) in __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ ()
#40 (null) in __CFRunLoopRun ()
#41 (null) in CFRunLoopRunSpecific ()
#42 (null) in GSEventRunModal ()
#43 (null) in -[UIApplication _run] ()
#44 (null) in UIApplicationMain ()
#45 0x00000001006b0420 in main at /Users/mrousavy/Projects/ShadowLens/app/ios/ShadowLens/main.m:8
#46 (null) in start ()

This one here is interesting to me:

#13 0x000000010071409c in reanimated::ShareableObject::toJSValue(facebook::jsi::Runtime&) at /Users/mrousavy/Projects/ShadowLens/app/node_modules/react-native-reanimated/Common/cpp/SharedItems/Shareables.cpp:224

It's exactly the point where we do obj.setNativeState(...):

And apparently that crashes!

Worst thing of all is... I wrote that code 😅🤦‍♂️

I don't know how that can crash to be honest - we are not using nativeState_ in any of our shareables, are we? Not sure about the new Fabric Shadow Trees if those are already being converted to Shareables tbh.

Steps to reproduce

It's hard for me to pinpoint exactly why and how this is happening, so at this point I unfortunately don't have a repro yet.

I'll first try to fix it myself, and then create a repro if I fail to do that.

Snack or a link to a repository

yea again sorry I don't have that yet. see comment above

Reanimated version

^3.12.0

React Native version

0.74.2

Platforms

iOS

JavaScript runtime

Hermes

Workflow

React Native

Architecture

Fabric (New Architecture)

Build type

Release app & production bundle

Device

Real device

Device model

iPhone 15 Pro

Acknowledgements

Yes

[github-actions[bot]]

Hey! 👋

The issue doesn't seem to contain a minimal reproduction.

Could you provide a snack or a link to a GitHub repository under your username that reproduces the problem?

[szydlovsky]

Dzień dobry @mrousavy , layout animations for fabric are still under review: https://github.com/software-mansion/react-native-reanimated/pull/6055

[szydlovsky]

So you can either switch to Paper for the time being, or await next stable release 👍

[mrousavy]

Ah gotcha, I wasn't sure if it was related to Layout Animations or not - thanks for the quick reply! :)

[bartlomiejbloniarz]

Dzień dobry @mrousavy, I am a bit confused about this issue since layout animations should be a noop on the new architecture. From your description it seems that some of them were running?

[mrousavy]

Yea I do have layout animations, but they are all noop (in my app they just jump to the target value immediately).

[bartlomiejbloniarz]

Can you check if removing those layout animations fixes these issues? I've been working on layout animations on a separate branch and I'm not sure how layout animations could be causing these problems

[bartlomiejbloniarz]

The issue was caused by reanimated accessing the UI runtime from two threads at the same time. Usually this doesn't happen, because we use WithRuntimeDecorator to wrap our runtime calls with a mutex. Unfortunately, methods related to NativeState were not included in this decorator, allowing for concurrent runtime access. I opened a PR to RN, which should resolve this issue.

[mrousavy]

nice investigation!