JNI ERROR（app bug）：本地参考表溢出（max = 512），即使没有本机代码也是如此

Question

we recently launched our app and upgrade actually from previous version..

and suddenly we started to see this error in a ton of devices ..we have no clue whats happening and the logs are very vague ..

Attaching the logs here .But any help or some clue might help us debug the issue .

---

Build fingerprint: 'Verizon/zeroltevzw/zeroltevzw:5.1.1/LMY47X/G925VVRU4BOK7:user/release-keys'

Revision: '10'

ABI: 'arm64'

pid: 31610, tid: 31610, name: st.mediamanager >>> <<<

signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------

Abort message: 'sart/runtime/indirect_reference_table.cc:98] JNI ERROR (app bug): local reference table overflow (max=512)'

x0   0000000000000000  x1   0000000000007b7a  x2   0000000000000006  x3   0000007fa219fe30

x4   0000007fa219fe30  x5   0000000000000005  x6   0000000000000001  x7   0000000000000020

x8   0000000000000083  x9   00000000000000ca  x10  0000007fa1f2a000  x11  0000000000000001

x12  0000000000000001  x13  0000007fa1f2a000  x14  c4aa4c0daad90e20  x15  0000007f92002a31

x16  0000007fa1f2a610  x17  0000007fa1eca174  x18  0000000000000000  x19  0000007fa219fe30

x20  0000007fa21a00e8  x21  0000007fa1f30000  x22  0000000000000001  x23  0000000000000006

x24  0000007fee90e2d0  x25  0000007f9e0a6000  x26  0000007fee90e2c8  x27  0000007f9dffd520

x28  0000007f9e0a6000  x29  0000007fee90e150  x30  0000007fa1e8c264

sp   0000007fee90e150  pc   0000007fa1eca17c  pstate 0000000060000000

backtrace:

#00 pc 000000000005e17c  /system/lib64/libc.so (tgkill+8)

#01 pc 0000000000020260  /system/lib64/libc.so (pthread_kill+160)

#02 pc 0000000000021794  /system/lib64/libc.so (raise+28)

#03 pc 000000000001b17c  /system/lib64/libc.so (abort+60)

#04 pc 0000000000310534  /system/lib64/libart.so (art::Runtime::Abort()+300)

#05 pc 00000000000d5378  /system/lib64/libart.so (art::LogMessage::~LogMessage()+2684)

#06 pc 00000000001e7ff0  /system/lib64/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+416)

#07 pc 00000000002e28cc  /system/lib64/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+248)

#08 pc 000000000002a5dc  /system/framework/arm64/boot.oat

---

Build fingerprint: 'Verizon/trltevzw/trltevzw:5.1.1/LMY47X/N910VVRU2BPA1:user/release-keys' Revision: '12' ABI: 'arm' pid: 481, tid: 481, name: st.mediamanager >>> <<< signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr -------- Abort message: 'sart/runtime/indirect_reference_table.cc:109] JNI ERROR (app bug): local reference table overflow (max=512)' r0 00000000 r1 000001e1 r2 00000006 r3 00000000 r4 b6fc3e38 r5 00000006 r6 00000016 r7 0000010c r8 00000000 r9 b486f550 sl b4827800 fp 00000475 ip 000001e1 sp bebbaaf8 lr b6e22715 pc b6e46854 cpsr 60070010

backtrace: #00 pc 00038854 /system/lib/libc.so (tgkill+12) #01 pc 00014711 /system/lib/libc.so (pthread_kill+52) #02 pc 0001532f /system/lib/libc.so (raise+10) #03 pc 00011bc9 /system/lib/libc.so (__libc_android_abort+36) #04 pc 0001003c /system/lib/libc.so (abort+4) #05 pc 00230cd1 /system/lib/libart.so (art::Runtime::Abort()+160) #06 pc 000ac58b /system/lib/libart.so (art::LogMessage::~LogMessage()+1322) #07 pc 0016996d /system/lib/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+244) #08 pc 00214f43 /system/lib/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+162) #09 pc 0001bd8d /system/framework/arm/boot.oat

---

Build fingerprint: 'Verizon/zenltevzw/zenltevzw:5.1.1/LMY47X/G928VVRU2AOJ3:user/release-keys' Revision: '9' ABI: 'arm64' pid: 18658, tid: 18658, name: st.mediamanager >>> <<< signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr -------- Abort message: 'sart/runtime/indirect_reference_table.cc:109] JNI ERROR (app bug): local reference table overflow (max=512)' x0 0000000000000000 x1 00000000000048e2 x2 0000000000000006 x3 0000007fa3887e30 x4 0000007fa3887e30 x5 0000000000000005 x6 0000000000000001 x7 0000000000000020 x8 0000000000000083 x9 000000000000005e x10 0000007fa3613000 x11 0000000000000001 x12 0000000000000001 x13 0000007fa3613000 x14 24d3f27831b256ef x15 0000000000000001 x16 0000007fa3613610 x17 0000007fa35b30d4 x18 0000000000000000 x19 0000007fa3887e30 x20 0000007fa38880e8 x21 0000007fa3619000 x22 0000000000000001 x23 0000000000000006 x24 0000007fc7e2cbc0 x25 0000007f9f820d40 x26 0000000000000001 x27 0000007f8c101b60 x28 0000000000000000 x29 0000007fc7e2ca40 x30 0000007fa3575224 sp 0000007fc7e2ca40 pc 0000007fa35b30dc pstate 0000000060000000

backtrace:

#00 pc 000000000005e0dc  /system/lib64/libc.so (tgkill+8)
#01 pc 0000000000020220  /system/lib64/libc.so (pthread_kill+160)
#02 pc 0000000000021754  /system/lib64/libc.so (raise+28)
#03 pc 000000000001b13c  /system/lib64/libc.so (abort+60)
#04 pc 00000000002ffca4  /system/lib64/libart.so (art::Runtime::Abort()+300)
#05 pc 00000000000d15b8  /system/lib64/libart.so (art::LogMessage::~LogMessage()+2684)
#06 pc 00000000002ad730  /system/lib64/libart.so (art::Monitor::VisitLocks(art::StackVisitor*, void (*)(art::mirror::Object*, void*), void*, bool)+952

#07 pc 0000000000314978  /system/lib64/libart.so (art::StackDumpVisitor::VisitFrame()+568)
#08 pc 000000000030ba08  /system/lib64/libart.so (art::StackVisitor::WalkStack(bool)+308)
#09 pc 0000000000313754  /system/lib64/libart.so (art::Thread::DumpJavaStack(std::__1::basic_ostream<char, std::__1::char_traits<char> >&) const+268)
#10 pc 0000000000313968  /system/lib64/libart.so (art::Thread::DumpStack(std::__1::basic_ostream<char, std::__1::char_traits<char> >&) const+272)
#11 pc 000000000031e8dc  /system/lib64/libart.so (art::ThreadList::DumpLocked(std::__1::basic_ostream<char, std::__1::char_traits<char> >&)+100)
#12 pc 00000000002ffd34  /system/lib64/libart.so (art::Runtime::Abort()+444)
#13 pc 00000000000d15b8  /system/lib64/libart.so (art::LogMessage::~LogMessage()+2684)
#14 pc 00000000001d7468  /system/lib64/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+416)
#15 pc 00000000002d2018  /system/lib64/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+248)
#16 pc 000000000002a5dc  /system/framework/arm64/boot.oat

---

Build fingerprint: 'Verizon/kltevzw/kltevzw:5.0/LRX21T/G900VVRU2BOK3:user/release-keys'

Revision: '14'

ABI: 'arm'

pid: 32148, tid: 32148, name: st.mediamanager >>> <<<

signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------

Abort message: 'art/runtime/indirect_reference_table.cc:113] JNI ERROR (app bug): local reference table overflow (max=512)'

r0 00000000  r1 00007d94  r2 00000006  r3 00000000

r4 b6f92114  r5 00000006  r6 00000016  r7 0000010c

r8 00000000  r9 b4e4f520  sl b4e07800  fp 000004ba

ip 00007d94  sp be8a3b38  lr b6f1bfd1  pc b6f40268  cpsr 60070010

backtrace:

#00 pc 00038268  /system/lib/libc.so (tgkill+12)

#01 pc 00013fcd  /system/lib/libc.so (pthread_kill+52)

#02 pc 00014beb  /system/lib/libc.so (raise+10)

#03 pc 00011531  /system/lib/libc.so (__libc_android_abort+36)

#04 pc 0000fcbc  /system/lib/libc.so (abort+4)

#05 pc 0021d5d9  /system/lib/libart.so (art::Runtime::Abort()+160)

#06 pc 000a834b  /system/lib/libart.so (art::LogMessage::~LogMessage()+1322)

#07 pc 001574b7  /system/lib/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+346)

#08 pc 002010d5  /system/lib/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+136)


#09 pc 0001b151  /system/framework/arm/boot.oat

Answer 1

I don't have a full answer, but its too lengthy for a comment so I'll post it as one.

So the error is just what you expect- its a call into native code that causes you to have more than 512 objects shared with native. Usually that happens because of a leak somewhere. And you don't need to be using native code directly to do it- the framework makes a LOT of native calls behind the scenes.

From the stack trace- I see its libart.so, not libdalvik.so. So this is happening on new devices which have switched from the Dalvik VM to Art. The stack trace looks like it was trying to load a class and add a reference to it for some JNI code, but I can't be certain of that. I do know that we've seen class loading bugs at work on Art that didn't exist on dalvik.

If you have any native code at all I'd make sure you were releasing all reference to java memory and classes properly. If you don't- this may be a bug in Art, knowing what the app was doing at the time of the crash would be useful. Is the crash consistent? If so, what are you doing?