Problem

SIG_handler was installed for SIGABRT and SIGSEGV and threw a NativeScriptException from inside the signal handler. That is undefined behaviour: the unwinder cannot cross the kernel-built signal frame, so on arm64 the throw reached std::terminate → LogAndAbortUncaught → _Exit(EXIT_FAILURE) and the process died anyway. Installing sa_handler for SIGSEGV also displaced debuggerd, so no tombstone was written — no backtrace, no registers, no fault address.

A crash produced exactly this, and nothing else:

TNS.Native: Uncaught NativeScriptException: Exception Message: JNI Exception occurred (SIGSEGV).
TNS.Native: =======
TNS.Native: Check the 'adb logcat' for additional information about the error.
TNS.Native: =======

So the handler bought nothing: it destroyed the diagnostics and still crashed. This is why a genuine worker data race read as flaky tests for weeks (#2006).

What changed

A diagnostic-only handler that never throws. It writes a pre-rendered breadcrumb with a single write(2) and hands the signal back to whoever owned it before, so debuggerd still writes the tombstone with the kernel's original siginfo.

• State is rendered into a plain byte buffer on ordinary threads whenever it changes, double-buffered so the handler never reads a half-written one. The handler does two pwrite(2)s to a pre-opened fd and chains — no allocation, no lock, no JNI, no V8, no logging.
• Installed SA_SIGINFO | SA_ONSTACK. No alt stack is allocated: bionic already gives every thread one, and SA_ONSTACK is what makes a stack-overflow SIGSEGV survivable.
• Chaining restores the previous disposition and returns, letting the faulting instruction re-fault so debuggerd sees the kernel's original siginfo rather than a synthesized one. Signals with si_code <= 0 (abort/kill) cannot re-fault and are re-raised instead.
• std::set_terminate(LogAndAbortUncaught) is unchanged — that one is the legitimate handler for genuine uncaught C++ exceptions and already _Exit()s.

Cost: a mutex + snprintf over ≤16 slots per runtime create/destroy, worker start, and module load. Module load already does file I/O and compilation, so this sits far below its noise floor. ~31 KB of static buffers and one fd. Nothing on any hot path; zero steady-state cost.

Design decision: not android_set_abort_message

android_set_abort_message was the obvious candidate and was tested first. It does reach SIGSEGV tombstones, not just SIGABRT (confirmed on API 35) — but bionic is first-write-wins: a probe set three messages and the tombstone showed the first.

That rules it out. A breadcrumb has to update as the runtime moves, and a write-once slot freezes at startup state. Worse, claiming that slot means libc's fortify/assert messages and ART's Java-crash messages can no longer be recorded — we would be destroying diagnostics to add our own.

That same finding caught a bug in the first cut of this change: the breadcrumb was reported with ANDROID_LOG_FATAL, and liblog feeds fatal records to android_set_abort_message, so it silently squatted the slot and surfaced as the Abort message: of the next process's tombstone. It now logs at ERROR, with the constraint documented in the code.

Before / after

Before: the four logcat lines above, no tombstone. (Known prior behaviour on main, reported from a real crash — not a measurement re-taken for this PR.)

After, induced SIGSEGV on a worker thread — full tombstone, correct fault address, symbolized backtrace:

pid: 15027, tid: 15180, name: W54: ./eventLoo  >>> com.tns.testapplication <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000
Cause: null pointer dereference
backtrace:
  #00 ... libNativeScript.so (tns::ModuleInternal::LoadModule(...)+372)
  #01 ... libNativeScript.so (tns::ModuleInternal::LoadImpl(...)+2404)
  #02 ... libNativeScript.so (tns::ModuleInternal::RequireCallbackImpl(...)+4900)
  #03 ... libNativeScript.so (tns::ModuleInternal::RequireCallback(...)+456)
  #04 ... libNativeScript.so (Builtins_CallApiCallbackGeneric+104)

plus the breadcrumb, reported on next launch:

fatal signal 11 on tid 15180
NativeScript runtime state (pid 15027):
  runtime=0  tid=15027 main   module=.../app/shared/Require/ResolveCanonicalPath/second.js
  runtime=23 tid=15107 worker script=./EvalWorker.js          module=.../app/shared/Workers/EvalWorker.js
  runtime=48 tid=15180 worker script=./eventLoopEchoWorker.js module=.../app/tests/eventLoopEchoWorker.js

tid 15180 matches the tombstone's crashing thread, whose name the tombstone truncates to W54: ./eventLoo — the breadcrumb supplies the full worker script and the module it was in.

SIGABRT verified separately: signal 6 (SIGABRT), code -6 (SI_TKILL), backtrace through abort → LoadModule, breadcrumb pid/tid matching the tombstone exactly.

Behaviour change, and why there is no opt-out

Fatal signals now surface as real native crashes instead of being converted into JS exceptions, so apps that were "surviving" these will now report them (Play Console / Crashlytics included). That is the point.

No opt-out flag is offered deliberately: the old path never actually kept the app running on arm64 — the throw could not unwind out of the signal frame, so it always reached _Exit. There is no "limps on" behaviour to preserve, only "dies opaquely, without a tombstone". An opt-out would be a supported switch that re-enables undefined behaviour and re-disables tombstones. If a specific app regresses, the fault it was hiding is the thing to fix.

The disabled exceptionHandlingTests spec asserting that a JNI misuse yields a catchable "SIGABRT" exception is removed along with the behaviour it documented.

Testing

878 tests / 0 failures / 0 errors / 4 skipped on the final commit-clean APK. No tombstone during the run and the breadcrumb file was 0 bytes afterwards — no false positives.

The 879 → 878 delta is exactly the deleted xit spec: disabled specs still count toward jasmine's total (skipped went 5 → 4). No test regressed.

Not verified

• The "before" snippet is the known prior behaviour, not a measurement re-taken on main for this PR.
• Everything was verified on one arm64 API 35 emulator. android_set_abort_message's first-write-wins behaviour and debuggerd's abort-message printing could differ on older releases — neither is load-bearing for the shipped design, but the tombstone-chaining is, and that is proven only on API 35.
• WASM trap handler interaction. V8 installs its own SIGSEGV handler for WASM traps. This is safe by construction — Install() runs at JNI_OnLoad, before V8 init, so V8's handler sits ahead of ours and recoverable traps never reach us — and the WASM specs pass, but a deliberate WASM out-of-bounds trap was not constructed to prove it.

Summary by CodeRabbit

• New Features

  • Added crash breadcrumbs capturing runtime, worker script, module, signal, and thread information.
  • Crash context is persisted and recovered across launches to improve diagnostics after unexpected failures.

• Bug Fixes

  • Improved fatal-crash handling while preserving existing signal behavior.
  • Removed obsolete platform- and architecture-specific gating for the skipped crash test.