Android: undefined function error inside async function crash whole app

[Informate]

I have searched and made sure there are no existing issues for the issue I am filing

• I have searched the existing issues

Description

The crash ONLY happen when the new rejection handler redirector feature pull request is applied!

When an undefined function is called inside an asyncronous function the error is reported and then the app crashes.

[ERROR] V8Util: Uncaught ReferenceError: zippy is not defined
[ERROR] V8Util: /app.js @ 2 >>> zippy();
[ERROR] TiExceptionHandler: (main) [247,247] /app.js:2
[ERROR] TiExceptionHandler: zippy();
[ERROR] TiExceptionHandler: ^
[ERROR] TiExceptionHandler: ReferenceError: zippy is not defined
[ERROR] TiExceptionHandler: at basic (/app.js:2:1)
[ERROR] TiExceptionHandler: at /app.js:4:17
[ERROR] TiExceptionHandler: at /app.js:4:25
[ERROR] TiExceptionHandler: at Module._runScript (ti:/kroll.js:1196:15)
[ERROR] TiExceptionHandler: at Module.load (ti:/kroll.js:734:13)
[ERROR] TiExceptionHandler: at Module.loadJavascriptText (ti:/kroll.js:1062:15)
[ERROR] TiExceptionHandler: at Module.loadAsFile (ti:/kroll.js:1108:22)
[ERROR] TiExceptionHandler: at Module.loadAsFileOrDirectory (ti:/kroll.js:1039:26)
[ERROR] TiExceptionHandler: at Module.require (ti:/kroll.js:865:30)
[ERROR] TiExceptionHandler: at Module.global.Module.require (:4405:32)
[ERROR] TiExceptionHandler:
[ERROR] TiExceptionHandler: org.appcelerator.kroll.runtime.v8.V8Runtime.nativeRunModule(Native Method)
[ERROR] TiExceptionHandler: org.appcelerator.kroll.runtime.v8.V8Runtime.doRunModule(V8Runtime.java:172)
[ERROR] TiExceptionHandler: org.appcelerator.titanium.TiApplication.launch(TiApplication.java:850)
[ERROR] TiExceptionHandler: org.appcelerator.titanium.TiLaunchActivity.loadScript(TiLaunchActivity.java:96)
[ERROR] TiExceptionHandler: org.appcelerator.titanium.TiRootActivity.loadScript(TiRootActivity.java:508)
[ERROR] TiExceptionHandler: org.appcelerator.titanium.TiLaunchActivity.onResume(TiLaunchActivity.java:177)
[ERROR] TiExceptionHandler: org.appcelerator.titanium.TiRootActivity.onResume(TiRootActivity.java:527)
[ERROR] TiExceptionHandler: android.app.Instrumentation.callActivityOnResume(Instrumentation.java:1456)
[ERROR] TiExceptionHandler: android.app.Activity.performResume(Activity.java:8353)
[ERROR] TiExceptionHandler: android.app.ActivityThread.performResumeActivity(ActivityThread.java:4908)

Expected Behavior

App do not crashes

Actual behavior

App crashes

Reproducible sample

async function basic() {
zippy();
}
(async ()=>await basic())();

Steps to reproduce

Run the app.js

Platform

Android

SDK version you are using

#14182

Alloy version you are using

No response

[cb1kenobi]

Do you have a reproduction test case? The original code snippet in this issue was flawed.

[Informate]

Do you have a reproduction test case? The original code snippet in this issue was flawed.

In the original code where I found the issue the crashing problem has been solved by correcting the function name (so the error is there for sure).
I am having some problem with the test case, the original code is really complex, i'll work on it.
Anyway a different issue is present for the setTimeout function reciving a promises instead of a function as expected but in the original code there should not be any timer.

[m1ga]

we could add a check around https://github.com/tidev/titanium-sdk/blob/main/android/titanium/src/java/ti/modules/titanium/TitaniumModule.java#L207 and verify that the "timout" parameter is an int. But it would be good to know why it's not an int at that point

[cb1kenobi]

we could add a check around main/android/titanium/src/java/ti/modules/titanium/TitaniumModule.java#L207 and verify that the "timout" parameter is an int. But it would be good to know why it's not an int at that point

We probably should have validation on setTimeout(). setTimeout() will coerce the timeout into a number, so you can pass in a string. Regardless, I think setTimeout() is a separate issue.

[m1ga]

oh, I thought that was the error line that was causing the : ReferenceError: function_name is not defined error. But now I see that they are different issues

[Informate]

Sorry, the real problem is the undefined function in an awaited async function.
The test case was failing due to a different issue on setTimeout 1° parameter (promises instead of a function) not the 2° (int).
I am working on the test, but in the original code the error is solved by renaming the function (maybe the crash could be to memory problems, I am working on it).

[Informate]

I realized that the crash happen with the feat request under pull request.
#14182

[Informate]

I am investigating the problem (as of ChatGPT):

ReferenceError is a VM-generated exception
It does not always have: A valid sourceLine, A consistent scriptResourceName, A complete stack at the time of rejection
This is also documented on the V8 side: ReferenceError may be reported before full script metadata is attached.

DispatchException assumes that: sourceLine is consistent, resourceName is stable, lineNumber belongs to the same script, and that the error is not rethrown while one is already active!

This assumption is false in the case of ReferenceError async.

Suggested solution:

if (value->IsNativeError()) {
 Local<Object> err = value.As<Object>();
 Local<Value> name =
  err->Get(context, STRING_NEW(isolate, "name")).ToLocalChecked();

 if (name->StrictEquals(STRING_NEW(isolate, "ReferenceError"))) {
  // già gestito come eccezione VM
  return;
 }
}

[Informate]

I have found and solved the problem crashing the app:
The V8 Engine throws a second Rejection Exception with a different event type called HandlerAddedAfterReject,
this rejection do not have a valid value and so can be safely discarded (as done by the Node.JS official engine, just marking the Promise as handled [Promise.handled=true;]).

The ReferenceError exception is now handled safely and correctly (I will update the repository as soon as I can), the only issue remaining is that the rejection exception is thrown once for each level in the async stack, so the exception could be raised more than once.

In the example, 1° time:

[ERROR] V8Util: Uncaught ReferenceError: zippy is not defined
[ERROR] V8Util: /app.js @ 2 >>> zippy()

[ERROR] TiExceptionHandler: (main) [12,3233] /app.js:2
[ERROR] TiExceptionHandler: zippy()
[ERROR] TiExceptionHandler: ^
[ERROR] TiExceptionHandler: Uncaught ReferenceError: zippy is not defined
[ERROR] TiExceptionHandler: basic (/app.js:2:1),/app.js:7:26,/app.js:7:35,Module._runScript (ti:/kroll.js:1205:15),Module.load (ti:/kroll.js:743:13),Module.loadJavascriptText (ti:/kroll.js:1071:15),Module.loadAsFile (ti:/kroll.js:1117:22),Module.loadAsFileOrDirectory (ti:/kroll.js:1048:26),Module.require (ti:/kroll.js:874:30),Module.global.Module.require (<embedded>:12279:32),require (ti:/kroll.js:1171:22),global.require (<embedded>:12267:10),<embedded>:17707:3,loadAsync (<embedded>:17643:5),_startSnapshot (<embedded>:17704:1),/ti.main.js:1:8,Module._runScript (ti:/kroll.js:1196:24),Module.load (ti:/kroll.js:743:13),Function.Module.runModule (ti:/kroll.js:1266:13)
[ERROR] TiExceptionHandler:
[ERROR] TiExceptionHandler:     org.appcelerator.kroll.runtime.v8.V8Runtime.nativeRunModule(Native Method)
[ERROR] TiExceptionHandler:     org.appcelerator.kroll.runtime.v8.V8Runtime.doRunModule(V8Runtime.java:172)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiApplication.launch(TiApplication.java:879)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiLaunchActivity.loadScript(TiLaunchActivity.java:96)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiRootActivity.loadScript(TiRootActivity.java:508)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiLaunchActivity.onResume(TiLaunchActivity.java:177)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiRootActivity.onResume(TiRootActivity.java:527)
[ERROR] TiExceptionHandler:     android.app.Instrumentation.callActivityOnResume(Instrumentation.java:1456)
[ERROR] TiExceptionHandler:     android.app.Activity.performResume(Activity.java:8353)
[ERROR] TiExceptionHandler:     android.app.ActivityThread.performResumeActivity(ActivityThread.java:4908)

In the example, 2° time (at a lower async stack level):

[ERROR] V8Util: Uncaught ReferenceError: zippy is not defined
[ERROR] V8Util: /app.js @ 7 >>> (async()=>{extra(),await basic()})();
[ERROR] TiExceptionHandler: (main) [1,5257] /app.js:7
[ERROR] TiExceptionHandler: (async()=>{extra(),await basic()})();
[ERROR] TiExceptionHandler:                                 ^
[ERROR] TiExceptionHandler: Uncaught ReferenceError: zippy is not defined
[ERROR] TiExceptionHandler: basic (/app.js:2:1),/app.js:7:26,/app.js:7:35,Module._runScript (ti:/kroll.js:1205:15),Module.load (ti:/kroll.js:743:13),Module.loadJavascriptText (ti:/kroll.js:1071:15),Module.loadAsFile (ti:/kroll.js:1117:22),Module.loadAsFileOrDirectory (ti:/kroll.js:1048:26),Module.require (ti:/kroll.js:874:30),Module.global.Module.require (<embedded>:12279:32),require (ti:/kroll.js:1171:22),global.require (<embedded>:12267:10),<embedded>:17707:3,loadAsync (<embedded>:17643:5),_startSnapshot (<embedded>:17704:1),/ti.main.js:1:8,Module._runScript (ti:/kroll.js:1196:24),Module.load (ti:/kroll.js:743:13),Function.Module.runModule (ti:/kroll.js:1266:13)
[ERROR] TiExceptionHandler:
[ERROR] TiExceptionHandler:     org.appcelerator.kroll.runtime.v8.V8Runtime.nativeRunModule(Native Method)
[ERROR] TiExceptionHandler:     org.appcelerator.kroll.runtime.v8.V8Runtime.doRunModule(V8Runtime.java:172)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiApplication.launch(TiApplication.java:879)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiLaunchActivity.loadScript(TiLaunchActivity.java:96)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiRootActivity.loadScript(TiRootActivity.java:508)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiLaunchActivity.onResume(TiLaunchActivity.java:177)
[ERROR] TiExceptionHandler:     org.appcelerator.titanium.TiRootActivity.onResume(TiRootActivity.java:527)
[ERROR] TiExceptionHandler:     android.app.Instrumentation.callActivityOnResume(Instrumentation.java:1456)
[ERROR] TiExceptionHandler:     android.app.Activity.performResume(Activity.java:8353)
[ERROR] TiExceptionHandler:     android.app.ActivityThread.performResumeActivity(ActivityThread.java:4908)


[ERROR] TiExceptionHandler: (main) [14043,14043] /app.js:7
[ERROR] TiExceptionHandler: (async()=>{extra(),await basic()})();
[ERROR] TiExceptionHandler:                                 ^
[ERROR] TiExceptionHandler: Uncaught ReferenceError: zippy is not defined
[ERROR] TiExceptionHandler: basic (/app.js:2:1),/app.js:7:26,/app.js:7:35,Module._runScript (ti:/kroll.js:1205:15),Module.load (ti:/kroll.js:743:13),Module.loadJavascriptText (ti:/kroll.js:1071:15),Module.loadAsFile (ti:/kroll.js:1117:22),Module.loadAsFileOrDirectory (ti:/kroll.js:1048:26),Module.require (ti:/kroll.js:874:30),Module.global.Module.require (<embedded>:12279:32),require (ti:/kroll.js:1171:22),global.require (<embedded>:12267:10),<embedded>:17707:3,loadAsync (<embedded>:17643:5),_startSnapshot (<embedded>:17704:1),/ti.main.js:1:8,Module._runScript (ti:/kroll.js:1196:24),Module.load (ti:/kroll.js:743:13),Function.Module.runModule (ti:/kroll.js:1266:13)

@m1ga would you like that I try to avoid the multiple reporting of the exception at different async stack levels (if easy to do) or is not important for you?

[Informate]

In the unwind process of async funciton Rejections are duplicated, if you want deduplication (reporting just once) a tracking mechanism is needed for already reported Rejections. But this introduce a lot more complexity, I suppose that deduplication could be not needed at the moment, the error will just show up more than once when bouncing throw the async unwind call stack.

Otherwise:

// global / per isolate
std::unordered_set<int> seenPromises;

void reportRejection(PromiseRejectMessage data) {
 auto promise = data.GetPromise();

 int id = promise->GetIdentityHash();

 if (data.GetEvent() == kPromiseRejectWithNoHandler) {
  if (seenPromises.contains(id))
   return;

  seenPromises.insert(id);
  // log / dispatch UNA volta
 }

 if (data.GetEvent() == kPromiseHandlerAddedAfterReject) {
  seenPromises.erase(id); // handled
 }

 ...

[m1ga]

@Informate sorry, I have no real knowledge on that c++ level or use any async stuff in my apps so I can't really help here or provide any guiding direction. I can test code later to see if it works but that's about all 😄