From d2de60472103e1b3f2fe82ed53cce38db6334af5 Mon Sep 17 00:00:00 2001 From: Albert Brand Date: Wed, 11 Jan 2017 08:44:58 -0800 Subject: [PATCH] Android: fix JSC crash in dev Summary: On Android with dev mode on, we're seeing a regular SIGSEGV when pushing a lot of animation declarations over the bridge. We tracked this down to being not specific to animations, but the crash is caused in `deepFreezeAndThrowOnMutationInDev`. Specifically: the provided object to freeze is modified while looping, replacing the current key access to a getter/setter. After the modification, JSC crashes during retrieval of the next key - but only when there are a lot of events passing over the bridge. We have a hunch that this is due to a bug in JSC object enumeration but did we not look into it further yet. Any help here is welcome. The JS code seems all right at first sight and shouldn't cause a segmentation crash. The workaround in this PR is to retrieve the keys first from the object and then looping over that array. In our app and in a reduced app test case this fixes the crash. If needed I can provide the reduced app test case. It's really tricky to make a test for this as it requires to be run Closes https://github.com/facebook/react-native/pull/11804 Differential Revision: D4403483 Pulled By: davidaurelio fbshipit-source-id: a31e5cff734e96bfec56e4a39dc1c6854798e245 --- Libraries/Utilities/deepFreezeAndThrowOnMutationInDev.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Libraries/Utilities/deepFreezeAndThrowOnMutationInDev.js b/Libraries/Utilities/deepFreezeAndThrowOnMutationInDev.js index b1dac7777de..9ab2cc4b16a 100644 --- a/Libraries/Utilities/deepFreezeAndThrowOnMutationInDev.js +++ b/Libraries/Utilities/deepFreezeAndThrowOnMutationInDev.js @@ -38,7 +38,10 @@ function deepFreezeAndThrowOnMutationInDev(object: Object) { return; } - for (var key in object) { + var keys = Object.keys(object); + + for (var i = 0; i < keys.length; i++) { + var key = keys[i]; if (object.hasOwnProperty(key)) { object.__defineGetter__(key, identity.bind(null, object[key])); object.__defineSetter__(key, throwOnImmutableMutation.bind(null, key)); @@ -48,7 +51,8 @@ function deepFreezeAndThrowOnMutationInDev(object: Object) { Object.freeze(object); Object.seal(object); - for (var key in object) { + for (var i = 0; i < keys.length; i++) { + var key = keys[i]; if (object.hasOwnProperty(key)) { deepFreezeAndThrowOnMutationInDev(object[key]); }