Crashlytics crashing with JNI ERROR (app bug): local reference table overflow (max=512)

[epsmarkh]

Please fill in the following fields:

Unity editor version: 2019.1.6f1
Firebase Unity SDK version: 6.1.1
Firebase plugins in use (Auth, Database, etc.): Analytics, Crashlytics
Additional SDKs you are using (Facebook, AdMob, etc.): Amplitude, OneSignal, GooglePlayGamesServices, Adjust
Platform you are using the Unity editor on (Mac, Windows, or Linux): Windows
Platform you are targeting (iOS, Android, and/or desktop): Android

Please describe the issue here:

When there is a large call stack, crashlytics expection reporting is crashing with JNI ERROR (app bug): local reference table overflow (max=512)

06-12 18:22:50.332: D/ViewRootImpl@4be201b: Relayout returned: oldFrame=[0,0][630,68] newFrame=[0,0][630,68] result=0x1 surface={isValid=true 536124692480} surfaceGenerationChanged=false
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] JNI ERROR (app bug): local reference table overflow (max=512)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] local reference table dump:
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] Last 10 entries (of 512):
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 511: 0x330bab80 java.lang.StackTraceElement
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 510: 0x331a4240 java.lang.String "System.Threading... (33 chars)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 509: 0x330bac28 java.lang.String "Run"
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 508: 0x331a4298 java.lang.String "System.Threading... (33 chars)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 507: 0x330bac40 java.lang.StackTraceElement
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 506: 0x331a42f0 java.lang.String "System.Threading... (33 chars)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 505: 0x33014ee8 java.lang.String "RunInternal"
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 504: 0x331a4348 java.lang.String "System.Threading... (33 chars)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 503: 0x330bac58 java.lang.StackTraceElement
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 502: 0x330a3830 java.lang.String "System.Threading... (32 chars)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] Summary:
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 1 of com.unity3d.player.UnityPlayer$e
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 382 of java.lang.String (382 unique instances)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 1 of java.lang.Exception
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 127 of java.lang.StackTraceElement (127 unique instances)
06-12 18:22:50.548: A/art(19914): art/runtime/indirect_reference_table.cc:129] 1 of java.lang.StackTraceElement[] (365 elements)
06-12 18:22:50.549: A/art(19914): art/runtime/indirect_reference_table.cc:129]
06-12 18:22:50.714: D/GameManagerService(3737): requestWithJsonForFW. requestCommand: get_network_stats
06-12 18:22:50.714: D/GameManagerService(3737): respondWithJson() : command : get_network_stats
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] Runtime aborting...
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] Aborting thread:
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] "UnityMain" prio=5 tid=26 Runnable
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] | group="" sCount=0 dsCount=0 obj=0x32c0d100 self=0xd8304900
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] | sysTid=19958 nice=0 cgrp=default sched=0/0 handle=0xbff47920
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] | state=R schedstat=( 185409059781 3467402580 148425 ) utm=16514 stm=2026 core=6 HZ=100
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] | stack=0xbfe45000-0xbfe47000 stackSize=1038KB
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] | held mutexes= "abort lock" "mutator lock"(shared held)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #00 pc 0034e655 /system/lib/libart.so (_ZN3art15DumpNativeStackERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEEiP12BacktraceMapPKcPNS_9ArtMethodEPv+128)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #1 pc 0032ee11 /system/lib/libart.so (_ZNK3art6Thread9DumpStackERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEEbP12BacktraceMap+308)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #2 pc 00321e89 /system/lib/libart.so (_ZNK3art10AbortState10DumpThreadERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEEPNS_6ThreadE+24)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #3 pc 00321cd3 /system/lib/libart.so (_ZNK3art10AbortState4DumpERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEE+362)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #4 pc 00318aab /system/lib/libart.so (_ZN3art7Runtime5AbortEv+90)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #5 pc 000b4ac1 /system/lib/libart.so (_ZN3art10LogMessageD2Ev+864)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #6 pc 001bbd01 /system/lib/libart.so (_ZN3art22IndirectReferenceTable3AddEjPNS_6mirror6ObjectE+308)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #7 pc 0027af01 /system/lib/libart.so (_ZN3art3JNI12NewStringUTFEP7_JNIEnvPKc+424)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #8 pc 000fc4bb /data/app/com.mgs.sniper1-1/lib/arm/libFirebaseCppApp-6.0.0.so (_ZN8firebase11crashlytics8internal19CrashlyticsInternal19BuildJavaStackTraceERNSt6__ndk16vectorINS0_5FrameENS3_9allocatorIS5_EEEEPNS1_13JNIReferencesE+106)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #9 pc 000fc39d /data/app/com.mgs.sniper1-1/lib/arm/libFirebaseCppApp-6.0.0.so (_ZN8firebase11crashlytics8internal19CrashlyticsInternal18BuildJavaExceptionENSt6__ndk112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEERNS3_6vectorINS0_5FrameENS7_ISB_EEEEPNS1_13JNIReferencesE+88)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #10 pc 000fc2f9 /data/app/com.mgs.sniper1-1/lib/arm/libFirebaseCppApp-6.0.0.so (_ZN8firebase11crashlytics8internal19CrashlyticsInternal12LogExceptionEPKcS4_NSt6__ndk16vectorINS0_5FrameENS5_9allocatorIS7_EEEE+108)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #11 pc 000fc70d /data/app/com.mgs.sniper1-1/lib/arm/libFirebaseCppApp-6.0.0.so (_ZN8firebase11crashlytics11Crashlytics12LogExceptionEPKcS3_NSt6__ndk16vectorINS0_5FrameENS4_9allocatorIS6_EEEE+26)
06-12 18:22:50.903: A/art(19914): art/runtime/runtime.cc:419] native: #12 pc 000fb37b /data/app/com.mgs.sniper1-1/lib/arm/libFirebaseCppApp-6.0.0.so (Firebase_Crashlytics_CSharp_FirebaseCrashlyticsInternal_LogException+54)

Please answer the following, if applicable:

Have you been able to reproduce this issue with just the Firebase Unity quickstarts (this GitHub project)?

No since it requires code with a large call stack so is difficult to reproduce in the sample code.

[patm1987]

Thanks for reporting this, we're looking into it and will reach out if we need more information.

[epsmarkh]

We have discovered that it is happening on the Samsung Galaxy s8 sm-g950f running Android 7. Other devices do not suffer the same crash. We have adapted the sample project to emulate the task code we are running which and got it to cause the crash on device. I have attached a log with the crash created using this code.

log.txt

Since the upload limit doesn't let me upload the entire project, to recreate our test project, replace the file located at quickstart-unity\crashlytics\testapp\Assets\Firebase\Sample\Crashlytics\UIHandler.cs with the following:

UIHandler.zip

We also compile as .net 4 and for IL2CPP.

When you press the Log Caught Exception button, it will run our code and cause the crash on an affected device.

[patm1987]

Thanks, you rock!

[stewartmiles]

@epsmarkh I took a look into this and it appears that the library is using a load of local JNI references to construct the Java stack frame object that grows with the stack frame size. I've boiled it down to, I think, about 6 JNI references to pass an exception to the Java layer. This should land in our next release.

[alexames]

This should be fixed as of the latest release, 6.2.0