Skip to content

chore(android): Mark MemoryLimiter sessions as having exited abnormally (JAVA-687) - #6113

Merged
0xadam-brown merged 4 commits into
mainfrom
feat/memory-limiter-session-repair-pipeline
Sep 16, 2026
Merged

0xadam-brown merged 4 commits into
mainfrom
feat/memory-limiter-session-repair-pipeline

Conversation

@0xadam-brown

@0xadam-brown 0xadam-brown commented Sep 15, 2026

Copy link
Copy Markdown
Member

📜 Description

Follow up to #6111.

PR marks recovered MemoryLimiter exits as abnormal session endings so release health no longer treats the terminated process as a healthy exit.

To do so, we piggyback on the existing AbnormalExit repair path currently used by ANRs. That makes sense as it's the sanctioned path for sessions that end abnormally, which fits MemoryLimiter kills.

Note: The possible session states are: Ok (ie, start state / pre-exit), Exited (normal exit), Crashed, Abnormal, and Unhandled (used by Flutter). See here.

💡 Motivation and Context

#6111 introduced the event path for generating SentryEvents from ApplicationExitInfo records produced by MemoryLimiter process kills. This PR finishes that work by adding the session-repair path. Without it, previous session records would report healthy exits when in fact they'd been killed via the MemoryLimiter.

The PR works by having MemoryLimiterHint implement the AbnormalExit interface, just like AnrHint and AnrV2Hint do today. That interface is read by:

  • ApplicationExitInfoEventProcessor, which backfills the synthetic SentryEvent with contextual data from the killed process.
  • SentryClient, which marks the session as abnormal.
  • EnvelopeCache, which finalizes the prior session on disk.

Because MemoryLimiterHint implements Backfillable, it's not sent to the MainEventProcessor, and hence it isn't given a record of the current process's threads. That's good b/c the current process isn't the one that was killed. (AnrV2Hint similarly implements Backfillable and skips MainEventProcessor.)

addresses: JAVA-687

💚 How did you test it?

Unit tests + I had my clanker manually test behavior against the (yet-to-be introduced) MemoryLimiter sample app.

📝 Checklist

  • I added GH Issue ID & Linear ID
  • I added tests to verify the changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • Review from the native team if needed.
  • No breaking change or entry added to the changelog.
  • No breaking change for hybrid SDKs or communicated to hybrid SDKs.
  • Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

  • PR introducing the MemoryLimiter sample app.

#skip-changelog (the CHANGELOG entry from #6111 covers both it and this, as we'll merge both PRs simultaneously / incorporate them into the same release.

@linear-code

linear-code Bot commented Sep 15, 2026

Copy link
Copy Markdown

JAVA-687

@sentry

sentry Bot commented Sep 15, 2026

Copy link
Copy Markdown

📲 Install Builds

Android

🔗 App Name App ID Version Configuration
SDK Size io.sentry.tests.size 8.56.0 (1) release

⚙️ sentry-android Build Distribution Settings

@0xadam-brown
0xadam-brown marked this pull request as ready for review September 15, 2026 10:14
@0xadam-brown 0xadam-brown added the sanity-check PR needs a lightweight review for obvious issues label Sep 15, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit e3d925c. Configure here.

Comment thread sentry/src/main/java/io/sentry/hints/AbnormalExit.java Outdated
@0xadam-brown
0xadam-brown marked this pull request as draft September 15, 2026 13:03
@0xadam-brown

This comment was marked as resolved.

@0xadam-brown
0xadam-brown marked this pull request as ready for review September 15, 2026 14:18
Comment thread sentry/src/main/java/io/sentry/hints/AbnormalExit.java
Base automatically changed from feat/memory-limiter-integration to main September 16, 2026 12:46
…ly (JAVA-687)

Mark recovered MemoryLimiter exits as abnormal session endings so release health no longer treats the terminated process as a healthy exit. Reuse the existing AbnormalExit cache repair path with a stable memory_limiter mechanism and the OS exit timestamp.
@0xadam-brown
0xadam-brown force-pushed the feat/memory-limiter-session-repair-pipeline branch from d38185b to bdb8e1c Compare September 16, 2026 13:24
@0xadam-brown

Copy link
Copy Markdown
Member Author

Rebased on an updated target; otherwise unchanged.

@0xadam-brown
0xadam-brown enabled auto-merge (squash) September 16, 2026 13:28
@0xadam-brown
0xadam-brown enabled auto-merge (squash) September 16, 2026 13:33
@0xadam-brown
0xadam-brown merged commit 91f22cd into main Sep 16, 2026
71 of 72 checks passed
@0xadam-brown
0xadam-brown deleted the feat/memory-limiter-session-repair-pipeline branch September 16, 2026 14:32
runningcode added a commit that referenced this pull request Sep 18, 2026
* ref(android): Mark AppStartMetrics.setAppStartType as @testonly (#6121)

No production code calls this setter; the cold/warm classification assigns
the field directly. Its only callers are tests, so annotate it the way the
neighboring test seams (setFirstIdle, getFirstIdle, clear) already are.

It has to stay public: most of those call sites live in
io.sentry.android.core, a different package from AppStartMetrics.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat(android): Recover MemoryLimiter app exits on startup (JAVA-687) (#6111)

Introduce a new MemoryLimiterIntegration that captures process deaths attributable to Android 17's new [MemoryLimiter](https://source.android.com/docs/core/perf/memory-limiter#process-monitoring) system service (see also [here](https://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html)).

Process death info is extracted from ApplicationExitInfo on the next app launch. We then enrich it with persisted SDK state and send it to Relay as a fatal Sentry event.

Integration is experimental; is only available for Android API >= 37; and is disabled by default.

* fix(core): Keep resolving the hostname after Sentry.close() (#6119)

* fix(core): Keep resolving the hostname after Sentry.close()

MainEventProcessor was Closeable, so Scopes.close() closed it, and it shut
down the process-wide HostnameCache singleton. Nothing ever replaced that
singleton: INSTANCE is assigned once and never cleared, so a re-init handed the
same shut-down cache to the new MainEventProcessor, and to MetricsApi and
LoggerApi, which read it directly.

The damage was silent and permanent. While the cache was still fresh,
getHostname() kept returning the value it already had. On the first expiry
after the close, getHostname() flipped updateRunning to true and then
submit() threw RejectedExecutionException on the terminated executor. That is
a RuntimeException, so it was swallowed into handleCacheUpdateFailure(), but
the updateRunning reset lives in the submitted callable's finally block, which
never ran. updateRunning stayed true, so the compareAndSet guard failed from
then on and no refresh was ever attempted again. server_name froze at its last
resolved value for the life of the process, with no exception and no log line.

Nothing needs to close this cache. Its executor is a single daemon thread with
allowCoreThreadTimeOut(true) and a 30 second keep-alive, so the worker exits on
its own once idle and never holds up process exit; the thread exists for about
30 seconds out of every 5 hour refresh interval. Scopes.close() already leaves
the timer executor running for exactly this reason.

The one test that covered this path, SentryClientTest's `when client is closed,
hostname cache is closed`, asserted isClosed() on a processor that had never
resolved a hostname, where isClosed() returned true because the cache was still
null. It never exercised the behavior it named. Replaced with an assertion that
MainEventProcessor is not Closeable, which fails if the wiring comes back.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* changelog

* fix(core): Clear updateRunning when a refresh cannot be queued

updateRunning is cleared in exactly one place, the submitted callable's finally
block, so it is cleared if and only if the callable runs. Every failure from
Future.get() leaves the callable running, so it still clears the flag itself.
A failure from submit() does not: the callable was never queued, nothing clears
the flag, and the compareAndSet guard in getHostname() then fails forever, so
no refresh is ever attempted again.

Removing MainEventProcessor's close() took away the only reachable way to make
submit() throw, but the invariant was still wrong: a bounded queue, a shutdown
added later, or a failure to start a thread would silently resurrect the same
permanent freeze.

Splitting submit() out of the try means the two cases can be told apart.
Clearing the flag on a timeout or an interrupt as well would be wrong, since
the callable is still running there and refreshes would pile up behind a slow
lookup; MainEventProcessorTest's `sets servername to null if retrieving takes
longer time` covers that path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test(core): Drop the not-Closeable assertion

It asserted a type relationship rather than behavior, which says nothing about
whether the hostname keeps resolving. The behavior that matters is covered by
HostnameCacheTest: `worker thread times out while idle instead of staying
alive` guards the self-terminating executor that makes closing unnecessary, and
`a refresh that cannot be queued does not stop later refreshes` guards the
latch that turned a one-off failure into a permanent one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(core): Order breadcrumbs by their own timestamp (JAVA-579) (#6097)

* fix(core): Order breadcrumbs by their own timestamp (JAVA-579)

Breadcrumb.compareTo ordered purely by a System.nanoTime() reading taken
in the constructor. A breadcrumb rebuilt from a serialized one — read
back from disk, or handed over by a hybrid SDK — got that reading at
parse time, so a breadcrumb recorded yesterday sorted as if it had just
happened, and the merged order in CombinedScopeView became parse order.
The clone constructor had the same problem: copying a breadcrumb moved
it to the end of the order.

Order by the recorded timestamp instead, and keep the creation tick only
as the tie-breaker it was added for in #3355, since timestamps are
millisecond-granular. A deserialized breadcrumb carries no tick, and a
clone carries the original's, so neither jumps position.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* changelog

* ref(core): Keep the creation tick on deserialized breadcrumbs

Always fill the tick and let the timestamp comparison carry the fix, so
ordering no longer depends on every caller using a stable sort.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ref(core): Sort breadcrumbs by their natural ordering in SentryClient

SortBreadcrumbsByDate compared timestamps only, so ties fell through to
the sort's stability. Breadcrumb.compareTo now defines that same order
with a defined tie-breaker, leaving the comparator a weaker duplicate of
it and the codebase with two definitions of breadcrumb order.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(android): Mark MemoryLimiter sessions as having exited abnormally (JAVA-687) (#6113)

Mark recovered MemoryLimiter exits as abnormal session endings so release health no longer treats the terminated process as a healthy exit. Reuses the existing AbnormalExit cache repair path with a stable memory_limiter mechanism and the OS exit timestamp.

* fix(changelog): Relocate misplaced CHANGELOG entries ahead of release (#6123)

* release: 8.57.0

* fix(core): Disable manifest URL caching when reading versions (JAVA-730) (#6124)

ManifestVersionReader was retaining jar-backed inflater state while scanning META-INF/MANIFEST.MF entries. Disable URL caching for those reads and close the stream after parsing.

* chore(deps): bump the github-actions group across 1 directory with 4 updates (#6110)

Bumps the github-actions group with 4 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [getsentry/craft](https://github.com/getsentry/craft).


Updates `actions/setup-java` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@dd06d9c...de7274f)

Updates `github/codeql-action/init` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `getsentry/craft` from 2.30.1 to 2.31.0
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@cd1e829...55694f8)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: getsentry/craft
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Adam Brown <adam.brown@sentry.io>
Co-authored-by: 0xadam-brown <281682121+0xadam-brown@users.noreply.github.com>
Co-authored-by: sentry-release-bot[bot] <180476844+sentry-release-bot[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

sanity-check PR needs a lightweight review for obvious issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants