pas_panic_on_out_of_memory_error crash on tvOS 15.4 and 15.4.1

Question

RuiB OP

Created Apr ’22

Replies 16

Boosts 0

Views 2.2k

Participants 4

Hi there,

I'm experiencing several crashes on JavaScriptCore pas_panic_on_out_of_memory_error, only on devices with tvOS 15.4 and 15.4.1. This happens with users using the app for several hours as well as 5 seconds after launching the app.

Devices: AppleTV6,2 and AppleTV5,3

Thread 14 —

JavaScriptCore              pas_panic_on_out_of_memory_error (JavaScriptCore)

JavaScriptCore              bmalloc_try_iso_allocate_impl_impl_slow (JavaScriptCore)

JavaScriptCore              bmalloc_heap_config_specialized_local_allocator_try_allocate_small_segregated_slow (JavaScriptCore)

JavaScriptCore              bmalloc_allocate_impl_casual_case (JavaScriptCore)

JavaScriptCore              ***::String::String(char16_t const*, unsigned int) (JavaScriptCore)

JavaScriptCore              JSC::LiteralParser<char16_t>::parsePrimitiveValue(JSC::VM&) (JavaScriptCore)

JavaScriptCore              JSC::LiteralParser<char16_t>::parse(JSC::ParserState) (JavaScriptCore)

JavaScriptCore              JSC::jsonProtoFuncParse(JSC::JSGlobalObject*, JSC::CallFrame*) (JavaScriptCore)

JavaScriptCore              llint_entry (JavaScriptCore)

JavaScriptCore              llint_entry (JavaScriptCore)

JavaScriptCore              llint_entry (JavaScriptCore)

JavaScriptCore              llint_entry (JavaScriptCore)

JavaScriptCore              vmEntryToJavaScript (JavaScriptCore)

JavaScriptCore              JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore)

JavaScriptCore              JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*) (JavaScriptCore)

JavaScriptCore              vmEntryToNative (JavaScriptCore)

JavaScriptCore              JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore)

JavaScriptCore              JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore)

JavaScriptCore              JSObjectCallAsFunction (JavaScriptCore)

JavaScriptCore              -[JSValue invokeMethod:withArguments:] (JavaScriptCore)

ITMLKit                     -[IKJSObject invokeMethod:withArguments:] (ITMLKit)

ITMLKit                     -[IKJSEventListenerObject invokeMethod:withArguments:thenDispatchEvent:extraInfo:] (ITMLKit)

ITMLKit                     __43-[IKJSXMLHTTPRequest setRequestReadyState:]_block_invoke (ITMLKit)

ITMLKit                     -[IKAppContext _doEvaluate:] (ITMLKit)

ITMLKit                     -[IKAppContext _evaluate:] (ITMLKit)

ITMLKit                     __41-[IKAppContext evaluate:completionBlock:]_block_invoke (ITMLKit)

ITMLKit                     -[IKAppContext _sourcePerform] (ITMLKit)

ITMLKit                     -[IKConcurrentEvaluator lockSchedulingForEvaluation:] (ITMLKit)

ITMLKit                     IKRunLoopSourcePerformCallBack (ITMLKit)

CoreFoundation              __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (CoreFoundation)

CoreFoundation              __CFRunLoopDoSource0 (CoreFoundation)

CoreFoundation              __CFRunLoopDoSources0 (CoreFoundation)

CoreFoundation              __CFRunLoopRun (CoreFoundation)

CoreFoundation              CFRunLoopRunSpecific (CoreFoundation)

ITMLKit                     -[IKAppContext _jsThreadMain] (ITMLKit)

Foundation                  __NSThread__start__ (Foundation)

libsyste...ad.dylib         _pthread_start (libsystem_pthread.dylib)

libsyste...ad.dylib         thread_start (libsystem_pthread.dylib)

This issue seems very similar to this existing thread, although not sure its related

Answered by DTS Engineer in 847173022

I can’t lock up the ips log files in Xcode Organizer.

Understood.

Honestly, I don’t think getting more crash reports is going to help you here, and you’d be better off investing that time in trying to reproduce the issue. Clearly it’s a common problem, and Apple TV has a pretty limited configuration space, so this is more feasible than it would be, say, if this were happening on a Mac.

First, survey your crash reports to see if they tell you anything about the device spread. The crash report you posted is from AppleTV6,2, that is, Apple TV 4K (1st generation). Are they all from that? Or are you seeing crashes from more modern Apple TVs.

Similarly, do this analysis for the tvOS version spread.

Also look at the app lifespan. In your crash the app had been running for 20-ish minutes. Is that typical? A memory problem like this is more likely to show up the longer the app has been running.

Finally, debugging. JavaScriptCore is part of the WebKit open source project, so you can actually see the source code in your backtrace. For example, frame 0 of thread 2 is pas_panic_on_out_of_memory_error, and its source code is here.

This source should give you some idea of the context of the error. Gosh, just the name is a useful hint: pas_panic_on_out_of_memory_error clearly indicates that JavaScriptCore has trapped because it’s run out of memory.

I don’t know enough about how JavaScriptCore is implemented to tell you whether it’s hitting some arbitrary limit within the code, or whether it’s gone to the system memory allocator to get more memory and that’s refused. However, the code is there for you to investigate and learn those answers for yourself.

And those answer might help you reproduce the problem. For example:

If your process has run out of memory, you could create a build of your app that artificially uses extra memory and see if that triggers a crash like this.
Alternatively, if JavaScriptCore has run out of its own internal memory, you could investigate how your app causes it to use that memory.

I’m sorry I don’t have an easy answer for you here. Debugging problems that only show up in the field is hard.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

laesde OP

1w

@DTS Engineer I think that I got general understanding of the issue that occurs. In our application we still depend on TVML Kit (which is marked as deprecated already). On many screens we use the stackTemplate with collectionList that contains big numer of shelfs (10-20) with lockups that allow to horizontally scroll the rows. Based on investigation of what is going on with memory I see that TVML engine does its best to speedup the process of rendering the lockup elements to provide the best experience while doing the quick scroll through the all shelfs. To handle it, the TVML uses some kind of rasterisation mechanism for TVML elements and display them as a single image in TVStackedImageView. It leads to issues in case of using the first generation of apple TV as rastered elements are kept in memory as long as the template keeps alive. There is a big difference in memory consumptions in case of using 4k display and 1080p. It seems to be related to fact that created images for 4K displays are bigger and in result consumes more memory.

I assume that we indeed get the crash from JS context panic_out_of_memory but it is happening because we hit the memory limit. So its not caused by big memory consumptions of JS engine but because of fact that the biggest part of memory is already consumed by ImageIO region. So JS context may crash after doing any update of TVML DOM or after parsing some response from our API

So in next step I should focus how to reduce usage of that region which should help to solve that crash. But that may be hard assuming that's something fully managed by TVML Kit.

0