Android JNI ERROR: global reference table overflow crash

[Philby Dias]

Hello,

I notice a crash in my Chromium based browser- which repeats regularly for a few users with the log stating "JNI ERROR (app bug): global reference table overflow (max=51200)global reference table dump". Please find the detailed report form Crashlytics' tombstone below:

JNI ERROR (app bug): global reference table overflow (max=51200)global reference table dump:
  Last 10 entries (of 51200):
    51199: 0x7278538 org.chromium.chrome.browser.tab.TabFavicon
    51198: 0x7277608 com.android.internal.util.SyncResultReceiver
    51197: 0x7277530 com.android.internal.util.SyncResultReceiver
    51196: 0x72774e8 org.chromium.chrome.browser.contextmenu.ContextMenuHelper
    51195: 0x72774e0 org.chromium.components.webapps.AppBannerManager
    51194: 0x726ec98 org.chromium.ui.base.EventForwarder
    51193: 0x726ec40 org.chromium.content.browser.webcontents.WebContentsImpl
    51192: 0x726ec30 org.chromium.content.browser.framehost.NavigationControllerImpl
    51191: 0x726ec28 org.chromium.content_public.browser.Page
    51190: 0x726eaa8 org.chromium.chrome.browser.content.WebContentsFactory$WebContentsCreationException
  Summary:
     3555 of org.chromium.content.browser.webcontents.WebContentsImpl (3555 unique instances)
     3555 of org.chromium.ui.base.EventForwarder (3555 unique instances)
     3555 of org.chromium.components.webapps.AppBannerManager (3555 unique instances)
     3555 of org.chromium.chrome.browser.contextmenu.ContextMenuHelper (3555 unique instances)
     3555 of org.chromium.components.browser_ui.device_lock.DeviceLockBridge (3555 unique instances)
     3555 of org.chromium.content.browser.framehost.NavigationControllerImpl (3555 unique instances)
     3555 of org.chromium.content_public.browser.Page (3555 unique instances)
     3554 of org.chromium.chrome.browser.tab.TabFavicon (3554 unique instances)
     3554 of org.chromium.chrome.browser.content.WebContentsFactory$WebContentsCreationException (3554 unique instances)
     3554 of org.chromium.content.browser.webcontents.WebContentsObserverProxy (3554 unique instances)
     3553 of ...dom_distiller.TabDistillabilityProvider.java (3553 unique instances)
     3553 of ...tab.TabBrowserControlsConstraintsHelper.java (3553 unique instances)
     3553 of ...browser.SwipeRefreshHandler (3553 unique instances)
     3553 of ...tab.TrustedCdn (3553 unique instances)
      573 of java.lang.Class (486 unique instances)
      287 of com.android.internal.util.SyncResultReceiver (287 unique instances)

Essentially, from my understanding, the native objects(WebContentsAndroid) that create the WebContentsImpl and other related objects are not getting cleared in time and the instances eventually overflow the limit for JNI references.

I was unable to find the root cause, but I also could not concretely reproduce/detect the leaks happening. For instance, if I create and then close multiple tabs and then use tools like the Android Studio profiler/Shark cli to view the memory dump, it shows neither leaks nor unreachable objects for WebContentsImpl. But I can see multiple references (around 2x the number of tabs) which are still active even after closing the tabs. This also happens when I profile stock chromium version 138.0.7204.168.

So if you have any details regarding the following, kindly help:

1. Is there any known leak issues regarding WebContentsImpl in chromium with any recommended fix? Why could the WebContentsImpl, Page, etc instances be going so high above 3k instances to be retained?

2. Since the above profilers are mostly for java objects, any better tools I can use to profile the native allocations and leaks to find the source of this issue?

PS: I also found this old discussion thread that seems to be discussing about a related topic, but I am not sure how relevant it is, if you do know how it could help then please let me know: https://groups.google.com/a/chromium.org/g/chromium-dev/c/VwLICMzyPc4/m/suK4vM4hBwAJ.

Appreciate your help in advance, thank you!

Philby