Segfault when realm_open is called on PopOS 22.04

[KitsuneAlex]

How frequently does the bug occur?

Always

Description

We use Realm in one of our soon-to-be-released products at work and while trying to set up the demo application i found a crash. I traced back the issue to a singular strlen call somewhere within the realm_open function, which leads me to believe a null C-string is passed to Realm somewhere within that function.

The actual segmentation fault is caused by this instruction in the AVX2 implementation of the strlen function provided by libc.so.6:

(%rdi) dereferences a null-pointer here.
I omitted the MachCode listings in the crash report to reduce noise a little bit, if you need the listings please let me know.

Stacktrace & log output

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f313bb9d7fd, pid=43552, tid=43721
#
# JRE version: OpenJDK Runtime Environment (17.0.10) (build 17.0.10+0-17.0.10b1087.21-11609105)
# Java VM: OpenJDK 64-Bit Server VM (17.0.10+0-17.0.10b1087.21-11609105, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# C  [libc.so.6+0x19d7fd]
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /media/data/develop/timmy-client/compose-app/core.43552)
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

---------------  S U M M A R Y ------------

Command Line: -Dcompose.application.configure.swing.globals=true -Dcompose.application.resources.dir=/media/data/develop/timmy-client/compose-app/build/compose/tmp/prepareAppResources -agentlib:jdwp=transport=dt_socket,server=n,suspend=y,address=127.0.0.1:46169 -javaagent:/media/data/gradle/caches/modules-2/files-2.1/org.jetbrains.kotlinx/kotlinx-coroutines-core-jvm/1.8.0/ac1dc37a30a93150b704022f8d895ee1bd3a36b3/kotlinx-coroutines-core-jvm-1.8.0.jar -Xmx1G -Dfile.encoding=UTF-8 -Duser.country=DE -Duser.language=de -Duser.variant -ea de.connect2x.timmy.desktop.MainKt

Host: AMD Ryzen Threadripper 1950X 16-Core Processor, 32 cores, 62G, Pop!_OS 22.04 LTS
Time: Mon Apr 22 14:29:11 2024 CEST elapsed time: 70.260773 seconds (0d 0h 1m 10s)

---------------  T H R E A D  ---------------

Current thread (0x00007f2f5967a6f0):  JavaThread "DefaultDispatcher-worker-5 @coroutine#8505" daemon [_thread_in_native, id=43721, stack(0x00007f30f9c24000,0x00007f30f9d24000)]

Stack: [0x00007f30f9c24000,0x00007f30f9d24000],  sp=0x00007f30f9d206c8,  free space=1009k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libc.so.6+0x19d7fd]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  io.realm.kotlin.internal.interop.realmcJNI.realm_open(J)J+0
j  io.realm.kotlin.internal.interop.realmc.realm_open(J)J+1
j  io.realm.kotlin.internal.interop.RealmInterop.realm_open(Lio/realm/kotlin/internal/interop/NativePointer;Lio/realm/kotlin/internal/interop/NativePointer;)Lkotlin/Pair;+59
j  io.realm.kotlin.internal.ConfigurationImpl$openRealm$2.invoke(Lio/realm/kotlin/internal/interop/NativePointer;)Lkotlin/Pair;+14
j  io.realm.kotlin.internal.ConfigurationImpl$openRealm$2.invoke(Ljava/lang/Object;)Ljava/lang/Object;+5
j  io.realm.kotlin.internal.interop.NativePointerKt.use(Lio/realm/kotlin/internal/interop/NativePointer;Lkotlin/jvm/functions/Function1;)Ljava/lang/Object;+15
j  io.realm.kotlin.internal.ConfigurationImpl.openRealm$suspendImpl(Lio/realm/kotlin/internal/ConfigurationImpl;Lio/realm/kotlin/internal/RealmImpl;Lkotlin/coroutines/Continuation;)Ljava/lang/Object;+28
j  io.realm.kotlin.internal.ConfigurationImpl.openRealm(Lio/realm/kotlin/internal/RealmImpl;Lkotlin/coroutines/Continuation;)Ljava/lang/Object;+3
j  io.realm.kotlin.internal.RealmImpl$1.invokeSuspend(Ljava/lang/Object;)Ljava/lang/Object;+234
J 8635 c2 kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(Ljava/lang/Object;)V (128 bytes) @ 0x00007f31299f8f0c [0x00007f31299f8a60+0x00000000000004ac]
J 8634 c2 kotlinx.coroutines.DispatchedTask.run()V (574 bytes) @ 0x00007f31296ed808 [0x00007f31296ed440+0x00000000000003c8]
j  kotlinx.coroutines.EventLoopImplBase.processNextEvent()J+198
j  kotlinx.coroutines.BlockingCoroutine.joinBlocking()Ljava/lang/Object;+75
j  kotlinx.coroutines.BuildersKt__BuildersKt.runBlocking(Lkotlin/coroutines/CoroutineContext;Lkotlin/jvm/functions/Function2;)Ljava/lang/Object;+158
j  kotlinx.coroutines.BuildersKt.runBlocking(Lkotlin/coroutines/CoroutineContext;Lkotlin/jvm/functions/Function2;)Ljava/lang/Object;+2
j  io.realm.kotlin.internal.platform.CoroutineUtilsSharedJvmKt.runBlocking(Lkotlin/coroutines/CoroutineContext;Lkotlin/jvm/functions/Function2;)Ljava/lang/Object;+14
j  io.realm.kotlin.internal.platform.CoroutineUtilsSharedJvmKt.runBlocking$default(Lkotlin/coroutines/CoroutineContext;Lkotlin/jvm/functions/Function2;ILjava/lang/Object;)Ljava/lang/Object;+15
j  io.realm.kotlin.internal.RealmImpl.<init>(Lio/realm/kotlin/internal/InternalConfiguration;)V+191
j  io.realm.kotlin.internal.RealmImpl.<init>(Lio/realm/kotlin/internal/InternalConfiguration;Lkotlin/jvm/internal/DefaultConstructorMarker;)V+2
j  io.realm.kotlin.internal.RealmImpl$Companion.create$io_realm_kotlin_library(Lio/realm/kotlin/internal/InternalConfiguration;)Lio/realm/kotlin/internal/RealmImpl;+12
j  io.realm.kotlin.Realm$Companion.open(Lio/realm/kotlin/Configuration;)Lio/realm/kotlin/Realm;+13
j  net.folivo.trixnity.client.store.repository.realm.CreateRealmRepositoriesModuleKt.createRealmRepositoriesModule(Lkotlin/jvm/functions/Function1;)Lorg/koin/core/module/Module;+283
j  de.connect2x.trixnity.messenger.CreateRepositoriesModule_jvmAndNativeKt$platformCreateRepositoriesModuleModule$1$1$1$create$2.invokeSuspend(Ljava/lang/Object;)Ljava/lang/Object;+80
J 8635 c2 kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(Ljava/lang/Object;)V (128 bytes) @ 0x00007f31299f8f0c [0x00007f31299f8a60+0x00000000000004ac]
J 8634 c2 kotlinx.coroutines.DispatchedTask.run()V (574 bytes) @ 0x00007f31296ed808 [0x00007f31296ed440+0x00000000000003c8]
j  kotlinx.coroutines.internal.LimitedDispatcher$Worker.run()V+8
j  kotlinx.coroutines.scheduling.TaskImpl.run()V+5
J 8714 c1 kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(Lkotlinx/coroutines/scheduling/Task;)V (73 bytes) @ 0x00007f312283edc4 [0x00007f312283ecc0+0x0000000000000104]
J 8711 c1 kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(Lkotlinx/coroutines/scheduling/Task;)V (39 bytes) @ 0x00007f3121bf67ac [0x00007f3121bf6580+0x000000000000022c]
j  kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker()V+44
j  kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run()V+1
v  ~StubRoutines::call_stub

siginfo: si_signo: 11 (SIGSEGV), si_code: 128 (SI_KERNEL), si_addr: 0x0000000000000000

Registers:
RAX=0x000000000000002f, RBX=0x00007f30d486a770, RCX=0x00007f30f9d20878, RDX=0x74366f70452f302f
RSP=0x00007f30f9d206c8, RBP=0x74366f70452f302f, RSI=0x00007f30f9d20828, RDI=0x74366f70452f302f
R8 =0x0000000000000020, R9 =0x0000000000003510, R10=0x00007f30d4614630, R11=0x00007f30d4749b60
R12=0x0000000000003510, R13=0x00007f30d486a770, R14=0x00007f30f9d206f0, R15=0x00007f30d486a840
RIP=0x00007f313bb9d7fd, EFLAGS=0x0000000000010283, CSGSFS=0x002b000000000033, ERR=0x0000000000000000
  TRAPNO=0x000000000000000d


Register to memory mapping:

RAX=0x000000000000002f is an unknown value
RBX=0x00007f30d486a770: <offset 0x000000000026a770> in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000
RCX=0x00007f30f9d20878 is pointing into the stack for thread: 0x00007f2f5967a6f0
RDX=0x74366f70452f302f is an unknown value
RSP=0x00007f30f9d206c8 is pointing into the stack for thread: 0x00007f2f5967a6f0
RBP=0x74366f70452f302f is an unknown value
RSI=0x00007f30f9d20828 is pointing into the stack for thread: 0x00007f2f5967a6f0
RDI=0x74366f70452f302f is an unknown value
R8 =0x0000000000000020 is an unknown value
R9 =0x0000000000003510 is an unknown value
R10=0x00007f30d4614630: <offset 0x0000000000014630> in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000
R11=0x00007f30d4749b60: _ZNSo9_M_insertImEERSoT_+0x0000000000000000 in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000
R12=0x0000000000003510 is an unknown value
R13=0x00007f30d486a770: <offset 0x000000000026a770> in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000
R14=0x00007f30f9d206f0 is pointing into the stack for thread: 0x00007f2f5967a6f0
R15=0x00007f30d486a840: <offset 0x000000000026a840> in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000


Top of Stack: (sp=0x00007f30f9d206c8)
0x00007f30f9d206c8:   00007f30d4705619 0000000000000005
0x00007f30f9d206d8:   00007f30f9d20820 00007f30f9d20878
0x00007f30f9d206e8:   00007f30d4749bea 00007f30d53dfb01
0x00007f30f9d206f8:   00007f30f9d20820 0000000000050001
0x00007f30f9d20708:   57a81c2c40481e00 c2c38b90037e2769
0x00007f30f9d20718:   00007f30d547ece4 00007f30f9d20820
0x00007f30f9d20728:   00007f30f9d20a50 00007f30f9d20758
0x00007f30f9d20738:   00007f30d53dfb5b 00007f30d53dfb60
0x00007f30f9d20748:   00007f30d50a02ec 00007f30f9d20808
0x00007f30f9d20758:   00007f30d53dfb62 00007f30f9d20828
0x00007f30f9d20768:   00007f30d47296f3 00007f30d486ae20
0x00007f30f9d20778:   00007f30d4860830 00007f30f9d20878
0x00007f30f9d20788:   00007f30f9d20a10 00007f30d48607e0
0x00007f30f9d20798:   00007f30f9d20808 00007f30f9d20860
0x00007f30f9d207a8:   00007f30d50a0550 00007f30d4860858
0x00007f30f9d207b8:   00007f30d4860808 00007f30d4860880
0x00007f30f9d207c8:   00007f30d48608d0 00007f30d4860970
0x00007f30f9d207d8:   00007f30d53dfb5b 00007f30f9d20a50
0x00007f30f9d207e8:   0000000000000001 00007f30f9d20820
0x00007f30f9d207f8:   00007f30f9d20810 00007f309053ed08
0x00007f30f9d20808:   00007f30d486ae20 00007f30d4860948
0x00007f30f9d20818:   0000000000000000 00007f30d4860970
0x00007f30f9d20828:   00007f30d48605d8 00007f3090587258
0x00007f30f9d20838:   00007f3090587258 00007f3090587259
0x00007f30f9d20848:   00007f3090587258 00007f309058725d
0x00007f30f9d20858:   00007f3090587458 00007f30d486ae20
0x00007f30f9d20868:   0000000000000018 00007f3090587258
0x00007f30f9d20878:   00007f30d4860998 0000000000000006
0x00007f30f9d20888:   0000000000000000 0000000000001002
0x00007f30f9d20898:   0000000000000000 0000000000000000
0x00007f30f9d208a8:   0000000000000000 0000000000000000
0x00007f30f9d208b8:   0000000000000000 0000000000000000 

Instructions: (pc=0x00007f313bb9d7fd)
0x00007f313bb9d6fd:   fd d7 ca c5 fd d7 c3 09 c1 75 38 c5 fd 6f 0f c5
0x00007f313bb9d70d:   fd 74 d1 48 83 c7 20 c5 dd 74 d9 c5 fd d7 ca c5
0x00007f313bb9d71d:   fd d7 c3 09 c1 75 1c c5 fd 6f 0f c5 fd 74 d1 48
0x00007f313bb9d72d:   83 c7 20 c5 dd 74 d9 c5 fd d7 ca c5 fd d7 c3 09
0x00007f313bb9d73d:   c1 74 90 85 c0 75 1c 85 d2 0f 84 84 00 00 00 89
0x00007f313bb9d74d:   d0 48 89 f7 0f bd c0 48 8d 44 07 e0 c5 f8 77 c3
0x00007f313bb9d75d:   0f 1f 00 c5 fd d7 ca 85 c9 75 18 89 c2 48 89 fe
0x00007f313bb9d76d:   e9 5e ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00
0x00007f313bb9d77d:   0f 1f 00 41 89 c8 41 83 e8 01 41 31 c8 44 21 c0
0x00007f313bb9d78d:   85 c0 74 b3 0f bd c0 48 8d 44 07 e0 c5 f8 77 c3
0x00007f313bb9d79d:   0f 1f 00 48 01 cf 89 d1 41 89 c8 41 83 e8 01 41
0x00007f313bb9d7ad:   31 c8 44 21 c0 85 c0 74 1a 0f bd c0 48 8d 44 07
0x00007f313bb9d7bd:   e0 c5 f8 77 c3 66 66 2e 0f 1f 84 00 00 00 00 00
0x00007f313bb9d7cd:   0f 1f 00 31 c0 c5 f8 77 c3 66 2e 0f 1f 84 00 00
0x00007f313bb9d7dd:   00 00 00 f3 0f 1e fa 89 f8 48 89 fa c5 f9 ef c0
0x00007f313bb9d7ed:   25 ff 0f 00 00 3d e0 0f 00 00 0f 87 33 01 00 00
0x00007f313bb9d7fd:   c5 fd 74 0f c5 fd d7 c1 85 c0 74 57 f3 0f bc c0
0x00007f313bb9d80d:   c5 f8 77 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f
0x00007f313bb9d81d:   1f 40 00 f3 0f bc c0 29 d7 ff c7 01 f8 c5 f8 77
0x00007f313bb9d82d:   c3 66 90 f3 0f bc c0 29 d7 83 c7 21 01 f8 c5 f8
0x00007f313bb9d83d:   77 c3 90 f3 0f bc c0 29 d7 83 c7 41 01 f8 c5 f8
0x00007f313bb9d84d:   77 c3 90 f3 0f bc c0 29 d7 83 c7 61 01 f8 c5 f8
0x00007f313bb9d85d:   77 c3 90 48 83 cf 1f c5 fd 74 4f 01 c5 fd d7 c1
0x00007f313bb9d86d:   85 c0 75 af c5 fd 74 4f 21 c5 fd d7 c1 85 c0 75
0x00007f313bb9d87d:   b2 c5 fd 74 4f 41 c5 fd d7 c1 85 c0 75 b5 c5 fd
0x00007f313bb9d88d:   74 4f 61 c5 fd d7 c1 85 c0 75 b8 48 ff c7 48 83
0x00007f313bb9d89d:   cf 7f 90 c5 fd 6f 4f 01 c5 f5 da 57 21 c5 fd 6f
0x00007f313bb9d8ad:   5f 41 c5 e5 da 67 61 c5 dd da ea c5 fd 74 ed c5
0x00007f313bb9d8bd:   fd d7 cd 48 83 ef 80 85 c9 74 d8 c5 fd 74 c9 c5
0x00007f313bb9d8cd:   fd d7 c1 48 29 d7 85 c0 75 39 c5 fd 74 d2 c5 fd
0x00007f313bb9d8dd:   d7 c2 85 c0 75 3d c5 fd 74 db c5 fd d7 c3 48 c1
0x00007f313bb9d8ed:   e1 20 48 09 c8 f3 48 0f bc c0 48 83 ef 3f 48 01 


Stack slot to memory mapping:
stack at sp + 0 slots: 0x00007f30d4705619: _ZNKSt7__cxx1110moneypunctIcLb0EE11do_groupingEv+0x0000000000000029 in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000
stack at sp + 1 slots: 0x0000000000000005 is an unknown value
stack at sp + 2 slots: 0x00007f30f9d20820 is pointing into the stack for thread: 0x00007f2f5967a6f0
stack at sp + 3 slots: 0x00007f30f9d20878 is pointing into the stack for thread: 0x00007f2f5967a6f0
stack at sp + 4 slots: 0x00007f30d4749bea: _ZNSo9_M_insertImEERSoT_+0x000000000000008a in /lib/x86_64-linux-gnu/libstdc++.so.6 at 0x00007f30d4600000
stack at sp + 5 slots: 0x00007f30d53dfb01: <offset 0x00000000009dfb01> in /home/fux/.cache/io.realm.kotlin/1.14.1/librealmc.so at 0x00007f30d4a00000
stack at sp + 6 slots: 0x00007f30f9d20820 is pointing into the stack for thread: 0x00007f2f5967a6f0
stack at sp + 7 slots: 0x0000000000050001 is an unknown value


Compiled method (c2)   70264 8635   !   4       kotlin.coroutines.jvm.internal.BaseContinuationImpl::resumeWith (128 bytes)
 total in heap  [0x00007f31299f8510,0x00007f31299fee30] = 26912
 relocation     [0x00007f31299f8670,0x00007f31299f8a60] = 1008
 main code      [0x00007f31299f8a60,0x00007f31299fbd60] = 13056
 stub code      [0x00007f31299fbd60,0x00007f31299fbf00] = 416
 oops           [0x00007f31299fbf00,0x00007f31299fbf60] = 96
 metadata       [0x00007f31299fbf60,0x00007f31299fc2c0] = 864
 scopes data    [0x00007f31299fc2c0,0x00007f31299fddd8] = 6936
 scopes pcs     [0x00007f31299fddd8,0x00007f31299fe758] = 2432
 dependencies   [0x00007f31299fe758,0x00007f31299fe858] = 256
 handler table  [0x00007f31299fe858,0x00007f31299fed50] = 1272
 nul chk table  [0x00007f31299fed50,0x00007f31299fee30] = 224

[Constant Pool (empty)]

Can you reproduce the bug?

Always

Reproduction Steps

Will provide privately if needed.

Version

1.14.1

What Atlas App Services are you using?

Local Database only

Are you using encryption?

Yes

Platform OS and version(s)

PopOS 22.04

Build environment

Kernel version: 6.8.0-76060800daily20240311-generic
libc version: Ubuntu GLIBC 2.35-0ubuntu3.6
libc compiler: GNU CC version 11.4.0
Android Studio version: 241.14494.240.2411.11743578
Android Build Tools version: 35.0.0 rc3
Gradle version: 8.5

[sync-by-unito]

➤ PM Bot commented:

Jira ticket: RKOTLIN-1071

[masterofnil]

Having the same issue with Fedora 39 and libc 2.38

[rorbech]

It is really hard to say anything from the above crash. Is it possible to describe some more details about how use are using the realm by supplying the model, configuration, etc.

[KitsuneAlex]

Will dig into this and give some context, but it could be an issue in Trixnity as far as i can tell. Wouldn't bet on it tho. I will come back to you asap :)

[KitsuneAlex]

Little update here. I can't really provide any samples here since the crash doesn't happen in our own code.
I'd appreciate it if you could just leave this issue open for now while i report this to the Trixnity project.

[masterofnil]

I've been using it in a compose multiplatform app and using koin to get a realm configuration (which shouldn't be a problem AFAIK). I noticed it crashes when the realm is open the first time, when files don't exists yet (but they do end up being created even though it crashes), but then opens normally. That is, until you commit a transaction which also makes it crash (and again, does commit the changes).
Not sure if it helps, but here's the stacktrace for one of them failures (sorry, code formatting does some weird things here):

j  io.realm.kotlin.internal.interop.realmcJNI.realm_commit(J)Z+0
j  io.realm.kotlin.internal.interop.realmc.realm_commit(J)Z+1
j  io.realm.kotlin.internal.interop.RealmInterop.realm_commit(Lio/realm/kotlin/internal/interop/NativePointer;)V+11
j  io.realm.kotlin.internal.WriteTransactionManager$DefaultImpls.commitTransaction(Lio/realm/kotlin/internal/WriteTransactionManager;)V+12
j  io.realm.kotlin.internal.SuspendableWriter$WriterRealm.commitTransaction()V+1
j  io.realm.kotlin.internal.SuspendableWriter$write$2.invokeSuspend(Ljava/lang/Object;)Ljava/lang/Object;+260
J 2803 c1 kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(Ljava/lang/Object;)V (128 bytes) @ 0x00007fca79ef317c [0x00007fca79ef2d40+0x000000000000043c]
J 5454 c1 kotlinx.coroutines.DispatchedTask.run()V (574 bytes) @ 0x00007fca7a4d9d1c [0x00007fca7a4d86e0+0x000000000000163c]
j  java.util.concurrent.ThreadPoolExecutor.runWorker(Ljava/util/concurrent/ThreadPoolExecutor$Worker;)V+92 [email protected]
j  java.util.concurrent.ThreadPoolExecutor$Worker.run()V+5 [email protected]
j  java.lang.Thread.run()V+11 [email protected]

When i have some time i'll see if i can do a sample project to reproduce.

[masterofnil]

So i started downgrading versions for funsies and seems that it works on io.realm.kotlin:1.10.2, all versions above that seems to be crashing (1.11.0 has some other random issue).
I guess a workaround is to use that version for now until this gets resolved.

[KitsuneAlex]

Very interesting, i don't know if these issue are strictly related but i'll look into it anyways since i am kinda lost at this point to be honest. Also, you may wanna look into fenced code blocks in Markdown ^^ You can use them without a language tag too, which just renders it as monospace text basicly. Much nicer for stacktraces.

So i started downgrading versions for funsies and seems that it works on io.realm.kotlin:1.10.2, all versions above that seems to be crashing (1.11.0 has some other random issue). I guess a workaround is to use that version for now until this gets resolved.

[mehmetakify]

I get same error with version 1.13.0. After downgrading to 1.10.2 it solved.

[CaelumF]

I'm seeing a similar or same issue that occurs on Fedora 39 (also using Threadripper, not sure if relevant) but not on Mac OS, with version 2.0.0. Older versions did work on this same system

[KitsuneAlex]

Fixed for me in 2.2.0