Native crash when working with expressions

[ericsvg]

Platform: Android
Mapbox SDK version: 6.1.3

I'm trying to convert a filter I used to build this way in Mapbox 5.x.x:

Filter.any(Filter.notHas("price"), Filter.lte("price", maxPrice))

Where price is a float property in vector tiles that may or may not be present, and maxPrice is an Int.

I first tried ths:

Expression.any(
        Expression("!has", Expression.literal("price")),
        Expression.lte(Expression.get("price"), maxPrice)
)

But I'm getting a segfault when I apply it:

Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 32728 (Thread-253), pid 32607 (s.android.debug)

I tried to ensure the get() gave a number so I wrapped it in a toNumber(), but it's still crashing. So I tried changing stuff to see which part could be the culprit and I'm having odd results. For example this does not crash

Expression.any(
        Expression("!has", Expression.literal("price")),
        Expression.neq(Expression.literal("foo"), Expression.literal("bar"))
)

but this does:

Expression.any(
        Expression("!has", Expression.literal("price")),
        Expression.neq(Expression.literal(42.0), Expression.literal(21.0))
)

I tried a whole bunch of combinations to find if it was related to using numbers vs strings, or depended on the results, etc. but can't find a pattern. Using get() seems to crash every time though. I'm having a hard time figuring out what could be wrong.

I don't know if this is relevant, but the filter is combined with the layer's base filter and is supposed to result in this:

["all", ["==", $type, LineString], ["any", ["!has", price], ["<=", ["get", price], 10]]]

This is the toString() result of the first expression I tried to build, where 10 is maxPrice.

[tobrun]

Thank you for the report, was able to track down a bug with the lte expression.
You should be able to workaround this for now with using the following:

layer.setFilter(any(not(has("price")), lte(get("price"), literal(maxPrice))));

Lmk if above doesn't work, haven't validated.

[ericsvg]

Still getting a crash with the workaround, but thanks for fixing it in 6.2. Is there any ETA for it?

[tobrun]

6.2.0-beta.1 is slated for Thursday, with final probably happening week after.
Since this is a severe issue, I'm thinking of releasing this as part of 6.1.4 (aiming for Thursday as well).

[ericsvg]

That'd be great as it's currently a blocker for us 👍

[ericsvg]

Just wanted to let you know I gave the 6.2.0-beta.2 a try and the crash is still here (segfault due to null pointer dereference)

[tobrun]

not able to reproduce a crash with the code in #12021 (comment). Would you be able to provide Expression#toArray definition of your filter?

[ericsvg]

Here's the complete Expression I call setFilter with:

["all", ["all", ["==", $type, LineString], ["in", name, Free, MeterHour, NoData, TimeLimit]], ["any", ["!has", price], ["<=", ["get", "price"], 5]]]

It's built dynamically as a combination of the layer's default filters (["all", ["==", $type, LineString], ["in", name, Free, MeterHour, NoData, TimeLimit]]) and the one I built to filter by price (["any", ["!has", price], ["<=", ["get", "price"], 5]]).

If I remove just the lte part of the filter the crash doesn't occur:

["all", ["all", ["==", $type, LineString], ["in", name, Free, MeterHour, NoData, TimeLimit]], ["any", ["!has", price]]]

Let me know if you need any other kind of information.

[ericsvg]

The output of ndk-stack, if it's of any help:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
Stack frame #00 pc 0000000000256068  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine unicodeCreate at /home/travis/build/mapbox/mason/mason_packages/.build/sqlite-autoconf-3140200/sqlite3.c:159456 (discriminator 1)
Stack frame #01 pc 00000000002ee30c  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine std::__ndk1::vector<std::__ndk1::unique_ptr<mbgl::style::Source, std::__ndk1::default_delete<mbgl::style::Source> >, std::__ndk1::allocator<std::__ndk1::unique_ptr<mbgl::style::Source, std::__ndk1::default_delete<mbgl::style::Source> > > >::__annotate_shrink(unsigned int) const at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/vector:853
Stack frame #02 pc 0000000000255dd0  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine sqlite3Fts3HashClear at /home/travis/build/mapbox/mason/mason_packages/.build/sqlite-autoconf-3140200/sqlite3.c:149648
Stack frame #03 pc 000000000025607c  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine unicodeCreate at /home/travis/build/mapbox/mason/mason_packages/.build/sqlite-autoconf-3140200/sqlite3.c:159478
Stack frame #04 pc 00000000002ee30c  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine std::__ndk1::vector<std::__ndk1::unique_ptr<mbgl::style::Source, std::__ndk1::default_delete<mbgl::style::Source> >, std::__ndk1::allocator<std::__ndk1::unique_ptr<mbgl::style::Source, std::__ndk1::default_delete<mbgl::style::Source> > > >::__annotate_shrink(unsigned int) const at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/vector:853
Stack frame #05 pc 0000000000255dd0  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine sqlite3Fts3HashClear at /home/travis/build/mapbox/mason/mason_packages/.build/sqlite-autoconf-3140200/sqlite3.c:149648
Stack frame #06 pc 00000000004897cc  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine std::__ndk1::__throw_length_error(char const*) at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/stdexcept:225
Stack frame #07 pc 0000000000489630  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine unsigned int const& std::__ndk1::min<unsigned int, std::__ndk1::__less<unsigned int, unsigned int> >(unsigned int const&, unsigned int const&, std::__ndk1::__less<unsigned int, unsigned int>) at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/algorithm:2646
Stack frame #08 pc 0000000000489880  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const, std::__ndk1::shared_ptr<mbgl::style::expression::Expression> > const& std::__ndk1::forward<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const, std::__ndk1::shared_ptr<mbgl::style::expression::Expression> > const&>(std::__ndk1::remove_reference<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const, std::__ndk1::shared_ptr<mbgl::style::expression::Expression> > const&>::type&) at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/type_traits:2221
Stack frame #09 pc 0000000000467418  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine Signature at /home/jukurrpa/Projects/mapbox-gl-native/src/mbgl/style/expression/compound_expression.cpp:208
Stack frame #10 pc 000000000046829c  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine _ZNSt6__ndk14swapIPN4mbgl5style10expression12ParsingErrorEEENS_9enable_ifIXaasr21is_move_constructibleIT_EE5valuesr18is_move_assignableIS7_EE5valueEvE4typeERS7_SA_ at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/type_traits:4457
Stack frame #11 pc 000000000044e0a8  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine bool std::__ndk1::operator!=<double const*>(std::__ndk1::__wrap_iter<double const*> const&, std::__ndk1::__wrap_iter<double const*> const&) at /opt/Android/sdk/ndk-bundle/sources/cxx-stl/llvm-libc++/include/iterator:1540
Stack frame #12 pc 000000000021d440  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine sqlite3VdbeAddOp3 at /home/travis/build/mapbox/mason/mason_packages/.build/sqlite-autoconf-3140200/sqlite3.c:70531
Stack frame #13 pc 000000000021d5dc  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine sqlite3VdbeAddOp3 at /home/travis/build/mapbox/mason/mason_packages/.build/sqlite-autoconf-3140200/sqlite3.c:70531
Stack frame #14 pc 0000000000391d80  /data/app/com.testapp.debug-xxX9OnozLGO6bu27cg-QvA==/lib/arm64/libmapbox-gl.so: Routine std::experimental::fundamentals_v1::optional<mbgl::style::IntervalStops<mbgl::style::SymbolAnchorType> > mbgl::style::conversion::convert<mbgl::style::IntervalStops<mbgl::style::SymbolAnchorType>>(mbgl::style::conversion::Convertible const&, mbgl::style::conversion::Error&) at /home/jukurrpa/Projects/mapbox-gl-native/platform/android/MapboxGLAndroidSDK/.externalNativeBuild/cmake/debug/armeabi-v7a/../../../../../../../include/mbgl/style/conversion.hpp:300
Stack frame #15 pc 0000000000067d0c  /system/lib64/libc.so (__pthread_start(void*)+36)
Stack frame #16 pc 000000000001eba4  /system/lib64/libc.so (__start_thread+68)