-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Crash due to non-thread-safe access to Exception stack frames when using async/await #70081
Comments
Repro project attached. |
You mentioned trying this with native Xamarin apps, did you also try it on top of dotnet 6 ios/Android too? |
Hi @jahmai-ca. We have added the "s/needs-info" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time. |
@drasticactions Yes, per the issue description, while the reproduction is for net6-android, I also tried this on net6-windows, xamarinios10 and monoandroid11, but I did not attach the repro project for those since the issue doesn't happen for those. I didn't try net6-ios. |
repro with vs main build(32522.39.main) |
What is the normal next step for this issue? IMO it should be fixed for MAUI GA. |
@drasticactions Is there any way to submit a PR for this issue? I feel it's pretty important and would be happy to contribute, but I have no idea which repo it comes from. Is it from a private repo? |
@jahmai-ca I don't think the issue is something that can be fixed within this repo itself. This is either going to be Android SDK specific (https://github.com/xamarin/xamarin-android) or Runtime specific. I think this issue is much lower level than the UI framework stuff located here. @jonathanpeppers What do you think? |
We have a But I don't see it in the stack trace (just inside the BCL), I think we can move this to dotnet/runtime for them to investigate? |
I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label. |
Tagging subscribers to this area: @dotnet/area-system-threading-tasks Issue DetailsDescriptionWhen an exception is re-thrown from an I believe the issue is that This issue happens on Android (net6.0-android), but may also happen on iOS (net6.0-ios) if it shares the same implementation (untested). FWIW this appears to be a fairly serious bug and will block me from switching our Xam apps to MAUI. Steps to Reproduce
Version with bugRelease Candidate 3 (current) Last version that worked wellUnknown/Other Affected platformsAndroid Affected platform versionsAndroid 12 Did you find any workaround?No workaround :( Relevant log output05-18 12:19:19.680 E/TaskAwaitCrash(19152): System.ArgumentException: Destination array was not long enough. Check destIndex and length, and the array's lower bounds (Parameter 'destinationArray')
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Array.Copy(Array sourceArray, Int32 sourceIndex, Array destinationArray, Int32 destinationIndex, Int32 length, Boolean reliable)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Array.Copy(Array sourceArray, Int32 sourceIndex, Array destinationArray, Int32 destinationIndex, Int32 length)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Exception.CaptureDispatchState()
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Runtime.ExceptionServices.ExceptionDispatchInfo..ctor(Exception exception)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(Exception source)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskExceptionHolder.AddFaultException(Object exceptionObject)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskExceptionHolder.Add(Object exceptionObject, Boolean representsCancellation)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.Task.AddException(Object exceptionObject, Boolean representsCancellation)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.Task.AddException(Object exceptionObject)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.Task.TrySetException(Object exceptionObject)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskCompletionSource.TrySetException(Exception exception)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskCompletionSource.SetException(Exception exception)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at TaskAwaitCrash.MainPage.<>c__DisplayClass2_0.<<OnCounterClicked>b__0>d.MoveNext() in C:\Users\JahmaiLay\source\repos\TaskAwaitCrash\MainPage.xaml.cs:line 40
|
Tagging subscribers to 'arch-android': @steveisok, @akoeplinger Issue DetailsDescriptionWhen an exception is re-thrown from an I believe the issue is that This issue happens on Android (net6.0-android), but may also happen on iOS (net6.0-ios) if it shares the same implementation (untested). FWIW this appears to be a fairly serious bug and will block me from switching our Xam apps to MAUI. Steps to Reproduce
Version with bugRelease Candidate 3 (current) Last version that worked wellUnknown/Other Affected platformsAndroid Affected platform versionsAndroid 12 Did you find any workaround?No workaround :( Relevant log output05-18 12:19:19.680 E/TaskAwaitCrash(19152): System.ArgumentException: Destination array was not long enough. Check destIndex and length, and the array's lower bounds (Parameter 'destinationArray')
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Array.Copy(Array sourceArray, Int32 sourceIndex, Array destinationArray, Int32 destinationIndex, Int32 length, Boolean reliable)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Array.Copy(Array sourceArray, Int32 sourceIndex, Array destinationArray, Int32 destinationIndex, Int32 length)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Exception.CaptureDispatchState()
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Runtime.ExceptionServices.ExceptionDispatchInfo..ctor(Exception exception)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(Exception source)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskExceptionHolder.AddFaultException(Object exceptionObject)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskExceptionHolder.Add(Object exceptionObject, Boolean representsCancellation)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.Task.AddException(Object exceptionObject, Boolean representsCancellation)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.Task.AddException(Object exceptionObject)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.Task.TrySetException(Object exceptionObject)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskCompletionSource.TrySetException(Exception exception)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at System.Threading.Tasks.TaskCompletionSource.SetException(Exception exception)
05-18 12:19:19.680 E/TaskAwaitCrash(19152): at TaskAwaitCrash.MainPage.<>c__DisplayClass2_0.<<OnCounterClicked>b__0>d.MoveNext() in C:\Users\JahmaiLay\source\repos\TaskAwaitCrash\MainPage.xaml.cs:line 40
|
This looks like a thread-safety bug in mono's Exception.CaptureDispatchState: runtime/src/mono/System.Private.CoreLib/src/System/Exception.Mono.cs Lines 65 to 90 in f7a32c0
Task uses ExceptionDispatchInfo, but EDI is more general and isn't specific to Task. |
I hope this is in 6.0.7. Looking forward to converting our Xam apps to MAUI! |
There is a crash in `Exception.CaptureDispatchState` when called from one thread at the same time another calls into `Exception.RestoreDispatchState`. The reason for the crash is due to the way we do not update `foreignExceptionFrames` in a thread-safe way. `foreignExceptionFrames` is used in both methods and can crash when the size changes before the array is copied. The fix is to lock when reading from and writing to `foreignExceptionFrames`. Fixes dotnet#70081
There is a crash in `Exception.CaptureDispatchState` when called from one thread at the same time another calls into `Exception.RestoreDispatchState`. The reason for the crash is due to the way we do not update `foreignExceptionFrames` in a thread-safe way. `foreignExceptionFrames` is used in both methods and can crash when the size changes before the array is copied. The fix copies `foreignExceptionFrame` into a local variable in `CaptureDispatchState` Fixes #70081
There is a crash in `Exception.CaptureDispatchState` when called from one thread at the same time another calls into `Exception.RestoreDispatchState`. The reason for the crash is due to the way we do not update `foreignExceptionFrames` in a thread-safe way. `foreignExceptionFrames` is used in both methods and can crash when the size changes before the array is copied. The fix is to lock when reading from and writing to `foreignExceptionFrames`. Fixes #70081
…ate (#71171) * [iOS][Android] Fix crash in Exception.CaptureDispatchState There is a crash in `Exception.CaptureDispatchState` when called from one thread at the same time another calls into `Exception.RestoreDispatchState`. The reason for the crash is due to the way we do not update `foreignExceptionFrames` in a thread-safe way. `foreignExceptionFrames` is used in both methods and can crash when the size changes before the array is copied. The fix is to lock when reading from and writing to `foreignExceptionFrames`. Fixes #70081 * Lock all of CaptureDispatchState * Marek's feedback * Remove unnecessary field Co-authored-by: Steve Pfister <steve.pfister@microsoft.com>
) There is a crash in `Exception.CaptureDispatchState` when called from one thread at the same time another calls into `Exception.RestoreDispatchState`. The reason for the crash is due to the way we do not update `foreignExceptionFrames` in a thread-safe way. `foreignExceptionFrames` is used in both methods and can crash when the size changes before the array is copied. The fix copies `foreignExceptionFrame` into a local variable in `CaptureDispatchState` Fixes dotnet#70081
Description
When an exception is re-thrown from an
await
from multiple observers (think aTaskCompletionSource
where there are more than one callerawait
ing on the result), anArgumentException
can be thrown fromException.CaptureDispatchState
due to the member fieldthis.foreignExceptionsFrames
being changed byException.RestoreDispatchState
during the re-throw of the exception fromawait
ing theTaskCompletionSource
.I believe the issue is that
Exception.CaptureDispatchState
is accessingthis.foreignExceptionsFrames
in a non-thread-safe way, and due to thethis.foreignExceptionsFrames.Length
property of the array changing during execution of the method, insufficient array space is allocated to the variablemonoStackFrameArray
thenArray.Copy
fails due to a change inthis.foreignExceptionsFrames.Length
.This issue happens on Android (net6.0-android), but may also happen on iOS (net6.0-ios) if it shares the same implementation (untested).
This issue does not happen on Windows as it appears that
Exception.CaptureDispatchState
is handled by some extern call.This issue does not happen on Xamarin.iOS (xamarinios) or Xamarin.Android (monoandroid), in either Xamarin.Native or Xamarin.Forms apps.
FWIW this appears to be a fairly serious bug and will block me from switching our Xam apps to MAUI.
Steps to Reproduce
OnCounterClicked
to the following:Click me
button repeatedly until the WTF error is seen in the logcat output.Version with bug
Release Candidate 3 (current)
Last version that worked well
Unknown/Other
Affected platforms
Android
Affected platform versions
Android 12
Did you find any workaround?
No workaround :(
Relevant log output
The text was updated successfully, but these errors were encountered: