Realm 0.86.0 crashes when call clear()

[zard17]

I have updated Realm on my application from 0.85 to 0.86 and a crash occured at librealm_jni whenever I call clear. Below is my code which is working on 0.85.

        // remove the row if there is no downloaded document
        RealmResults<IngListDesc> lessonsToBeRemoved = expired.where()
                .equalTo("doc_downloaded", false)
                .findAll();

        // remove children
        mRealm.beginTransaction();
        for (int i=0; i < lessonsToBeRemoved.size(); i++) {
            RealmResults<IngDetailDesc> detailDescs =
                    lessonsToBeRemoved.get(i).getLessons().where().findAll();
            for (int j=0; j < detailDescs.size(); j++) {
                detailDescs.get(j).getObjects().where().findAll().clear();
            }
            detailDescs.clear();
        }
        lessonsToBeRemoved.clear();
        mRealm.commitTransaction();

[beeender]

@zard17 Would you please add the crash log here? It looks like the same issue with #1882

Thanks!

[zard17]

@beeender Here is the crash log. Thanks!

D/CrashAnrDetector( 3342): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

D/CrashAnrDetector( 3342): Build fingerprint: 'samsung/gts210ltekx/gts210ltekx:5.0.2/LRX22G/T815N0KOU2AOJ1:user/release-keys'

D/CrashAnrDetector( 3342): Revision: '6'

D/CrashAnrDetector( 3342): ABI: 'arm'

D/CrashAnrDetector( 3342): pid: 32170, tid: 32170, name: xxx  >>> xxx <<<

D/CrashAnrDetector( 3342): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x290

D/CrashAnrDetector( 3342):     r0 9a830960  r1 b3472c74  r2 00000006  r3 00000290

D/CrashAnrDetector( 3342):     r4 9ab5b840  r5 00000000  r6 9ab5b840  r7 12c983a0

D/CrashAnrDetector( 3342):     r8 88494898  r9 b4428000  sl 00000001  fp 12de1180

D/CrashAnrDetector( 3342):     ip beadc844  sp beadc878  lr b342fae1  pc b33af8f8  cpsr 600b0030

D/CrashAnrDetector( 3342):     d0  0000000000030c8a  d1  0000000000000000

D/CrashAnrDetector( 3342):     d2  6c2d65726f632f79  d3  616a2e7472616273

D/CrashAnrDetector( 3342):     d4  00000000633db6fd  d5  4014000000000000

D/CrashAnrDetector( 3342):     d6  1f364c905893293d  d7  4014000000000000

D/CrashAnrDetector( 3342):     d8  3e8000003f400000  d9  0000000000000000

D/CrashAnrDetector( 3342):     d10 0000000000000000  d11 0000000000000000

D/CrashAnrDetector( 3342):     d12 0000000000000000  d13 0000000000000000

D/CrashAnrDetector( 3342):     d14 0000000000000000  d15 0000000000000000

D/CrashAnrDetector( 3342):     d16 beadc93000000000  d17 0000000000030c84

D/CrashAnrDetector( 3342):     d18 00200079006c006e  d19 0069006100760061

D/CrashAnrDetector( 3342):     d20 0000000100010001  d21 0000000000000000

D/CrashAnrDetector( 3342):     d22 ffff000000000000  d23 ffffffffffffffff

D/CrashAnrDetector( 3342):     d24 0080008000800080  d25 0080008000800080

D/CrashAnrDetector( 3342):     d26 0001000000000000  d27 0001000100010001

D/CrashAnrDetector( 3342):     d28 0800080008000800  d29 0800080008000800

D/CrashAnrDetector( 3342):     d30 ffff000000000000  d31 ffffffffffffffff

D/CrashAnrDetector( 3342):     scr 20000011

D/CrashAnrDetector( 3342): 

D/CrashAnrDetector( 3342): backtrace:

D/CrashAnrDetector( 3342):     #00 pc 000498f8  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342): 

D/CrashAnrDetector( 3342): stack:

D/CrashAnrDetector( 3342):          beadc7f8  00000000  

D/CrashAnrDetector( 3342):          beadc7fc  00000000  

D/CrashAnrDetector( 3342):          beadc800  12f37738  /dev/ashmem/dalvik-main space (deleted)

D/CrashAnrDetector( 3342):          beadc804  b4f24ef7  /system/lib/libart.so (artInvokeInterfaceTrampoline+138)

D/CrashAnrDetector( 3342):          beadc808  00000006  

D/CrashAnrDetector( 3342):          beadc80c  00000000  

D/CrashAnrDetector( 3342):          beadc810  9a830960  

D/CrashAnrDetector( 3342):          beadc814  b342fac5  /data/app/xxx/lib/arm/librealm-jni.so (__cxxabiv1::__si_class_type_info::__do_dyncast(int, __cxxabiv1::__class_type_info::__sub_kind, __cxxabiv1::__class_type_info const*, void const*, __cxxabiv1::__class_type_info const*, void const*, __cxxabiv1::__class_type_info::__dyncast_result&) const)

D/CrashAnrDetector( 3342):          beadc818  00000000  

D/CrashAnrDetector( 3342):          beadc81c  b3473bb8  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342):          beadc820  b3472c74  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342):          beadc824  00000001  

D/CrashAnrDetector( 3342):          beadc828  12de1180  /dev/ashmem/dalvik-main space (deleted)

D/CrashAnrDetector( 3342):          beadc82c  b342feab  /data/app/xxx/lib/arm/librealm-jni.so (__dynamic_cast+74)

D/CrashAnrDetector( 3342):          beadc830  9a830960  

D/CrashAnrDetector( 3342):          beadc834  b3473bb8  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342):          beadc838  9a830960  

D/CrashAnrDetector( 3342):          beadc83c  beadc844  [stack]

D/CrashAnrDetector( 3342):          beadc840  beadc960  [stack]

D/CrashAnrDetector( 3342):          beadc844  9a830960  

D/CrashAnrDetector( 3342):          beadc848  00000006  

D/CrashAnrDetector( 3342):          beadc84c  00000000  

D/CrashAnrDetector( 3342):          beadc850  00000006  

D/CrashAnrDetector( 3342):          beadc854  00000010  

D/CrashAnrDetector( 3342):          beadc858  b449d300  

D/CrashAnrDetector( 3342):          beadc85c  9ab5b840  

D/CrashAnrDetector( 3342):          beadc860  00000000  

D/CrashAnrDetector( 3342):          beadc864  9ab5b840  

D/CrashAnrDetector( 3342):          beadc868  12c983a0  /dev/ashmem/dalvik-main space (deleted)

D/CrashAnrDetector( 3342):          beadc86c  88494898  /dev/ashmem/dalvik-alloc space (deleted)

D/CrashAnrDetector( 3342):          beadc870  b4428000  

D/CrashAnrDetector( 3342):          beadc874  b33af8e5  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342):     #00  beadc878  00000010  

D/CrashAnrDetector( 3342):          beadc87c  b33af915  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342):          beadc880  b44712b0  

D/CrashAnrDetector( 3342):          beadc884  9ab5b840  

D/CrashAnrDetector( 3342):          beadc888  9ab5b840  

D/CrashAnrDetector( 3342):          beadc88c  b33f4307  /data/app/xxx/lib/arm/librealm-jni.so

D/CrashAnrDetector( 3342):          beadc890  beadc8a8  [stack]

D/CrashAnrDetector( 3342):          beadc894  b4f99a4c  /system/lib/libart.so

D/CrashAnrDetector( 3342):          beadc898  12c0fd80  /dev/ashmem/dalvik-main space (deleted)

D/CrashAnrDetector( 3342):          beadc89c  b4f01c17  /system/lib/libart.so (art::CheckReferenceResult(art::mirror:

[beeender]

@zard17 Is encryption enabled in you app?

[zaki50]

I succeeded to reproduce this on our unit test.

// test for https://github.com/realm/realm-java/issues/1886
public void testClearForTableView() {
    testRealm.beginTransaction();
    final AllTypes object = testRealm.copyToRealm(new AllTypes());
    final RealmResults<Dog> all = object.getColumnRealmList().where().findAll(); // no crash if comment this line out.
    object.removeFromRealm();
    testRealm.commitTransaction(); // crash!
}

[creativepsyco]

Yep, can't delete any realm objects right now with 0.86 just a native crash.

Here is the tombstone crash report.

tombstone_07.txt

[kneth]

@creativepsyco Thanks. Your tombstone aligns with ours, and we are investigating a potential bug in our underlying storage engine.

[kneth]

We will release a workaround shortly but we have identified a subtle bug in our underlying storage engine. I can't say when it is solved but we are working on it.

[kneth]

The code snippet by @zaki50 show what the issue is: The object all relies on object, and when object is removed, all is invalid. Realm's underlying storage engine does not detect this, which results in a native crash. We will change the behaviour of the storage engine so it will detect this, and a proper exception will be thrown.

To summarize: accessing a RealmResults which originate from a delete object, isn't valid.

[kneth]

I'll close this issue. I created #1945 to track the resolution of the issue found by this issue.