Libc: Fatal signal 5 (SIGTRAP), code 1 (TRAP_BRKPT), fault addr [154541085]

Infeasible

Bug

[AOSP] assigned

adexe s nau

Status Update

No update yet.

Description

ns...@gmail.com

created issue #1

Apr 21, 2020 06:50AM

Seeing this crash on samsung and huwaei devices so far

failed to readlink /proc/9089/fd/63: No such file or directory
03-27 13:36:22.113 9779 9779 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone
03-27 13:36:22.126 4103 4103 I /system/bin/tombstoned: received crash request for pid 9089
03-27 13:36:22.130 9779 9779 I crash_dump64: performing dump of process 9078 (target tid = 9089)
03-27 13:36:22.148 9779 9779 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-27 13:36:22.148 9779 9779 F DEBUG : Build fingerprint: 'samsung/a50ub/a50:9/PPR1.180610.011/A505GUBU1ASE3:user/release-keys'
03-27 13:36:22.148 9779 9779 F DEBUG : Revision: '6'
03-27 13:36:22.148 9779 9779 F DEBUG : ABI: 'arm64'
03-27 13:36:22.148 9779 9779 F DEBUG : pid: 9078, tid: 9089, name: ReferenceQueueD >>> com.boxer.email <<<
03-27 13:36:22.148 9779 9779 F DEBUG : signal 5 (SIGTRAP), code 1 (TRAP_BRKPT), fault addr 0x7f8aa2c3c4
03-27 13:36:22.148 9779 9779 F DEBUG : x0 0000007ee70aef00 x1 0000007f8aa2c3c4 x2 0000007f8a41fb40 x3 0000007ec8d25260
03-27 13:36:22.148 9779 9779 F DEBUG : x4 000000006f499414 x5 0000007f08888788 x6 0000000000000001 x7 0000007ee9068140
03-27 13:36:22.148 9779 9779 F DEBUG : x8 0000007f8addf4e4 x9 0000000000000000 x10 0000000000000000 x11 0000000000aad1f5
03-27 13:36:22.148 9779 9779 F DEBUG : x12 0000000000000000 x13 0000007ee813d940 x14 0000000000000000 x15 0000000000000000
03-27 13:36:22.148 9779 9779 F DEBUG : x16 0000007f8b184150 x17 0000007f8ada1e8c x18 0000000000000008 x19 0000007ec8d25260
03-27 13:36:22.149 9779 9779 F DEBUG : x20 0000007f044d27a8 x21 000000007fffffff x22 0000000015e48e58 x23 0000000015e48df0
03-27 13:36:22.149 9779 9779 F DEBUG : x24 000000006f436170 x25 0000000015e48e30 x26 0000007f088db0a0 x27 0000007f087e9080
03-27 13:36:22.149 9779 9779 F DEBUG : x28 0000000000000043 x29 0000007eef387e10
03-27 13:36:22.149 9779 9779 F DEBUG : sp 0000007eef387e00 lr 0000007f8ada1f54 pc 0000007f8aa2c3c4
03-27 13:36:22.251 9779 9779 F DEBUG :
03-27 13:36:22.251 9779 9779 F DEBUG : backtrace:
03-27 13:36:22.251 9779 9779 F DEBUG : #00 pc 00000000001053c4 /system/lib64/libhwui.so (SkCodec::~SkCodec())
03-27 13:36:22.251 9779 9779 F DEBUG : #01 pc 000000000047af50 /system/lib64/libhwui.so (SkPaint::~SkPaint()+196)
03-27 13:36:22.251 9779 9779 F DEBUG : #02 pc 0000000000156b58 /system/lib64/libandroid_runtime.so (android::PaintGlue::deletePaint(android::Paint*)+24)
03-27 13:36:22.251 9779 9779 F DEBUG : #03 pc 000000000007cc20 /system/framework/arm64/boot-core-libart.oat (offset 0x79000) (java.math.NativeBN.BN_copy [DEDUPED]+160)
03-27 13:36:22.251 9779 9779 F DEBUG : #04 pc 000000000013726c /system/framework/arm64/boot-core-libart.oat (offset 0x79000) (libcore.util.NativeAllocationRegistry$CleanerThunk.run+76)
03-27 13:36:22.251 9779 9779 F DEBUG : #05 pc 000000000037e944 /system/framework/arm64/boot.oat (offset 0x114000) (sun.misc.Cleaner.clean+132)
03-27 13:36:22.251 9779 9779 F DEBUG : #06 pc 000000000018d15c /system/framework/arm64/boot.oat (offset 0x114000) (java.lang.ref.ReferenceQueue.enqueueLocked+236)
03-27 13:36:22.251 9779 9779 F DEBUG : #07 pc 000000000018d27c /system/framework/arm64/boot.oat (offset 0x114000) (java.lang.ref.ReferenceQueue.enqueuePending+172)
03-27 13:36:22.251 9779 9779 F DEBUG : #08 pc 0000000000184704 /system/framework/arm64/boot-core-libart.oat (offset 0x79000) (java.lang.Daemons$ReferenceQueueDaemon.runInternal+244)
03-27 13:36:22.251 9779 9779 F DEBUG : #09 pc 0000000000111e7c /system/framework/arm64/boot-core-libart.oat (offset 0x79000) (java.lang.Daemons$Daemon.run+76)
03-27 13:36:22.251 9779 9779 F DEBUG : #10 pc 000000000025d068 /system/framework/arm64/boot.oat (offset 0x114000) (java.lang.Thread.run+72)
03-27 13:36:22.251 9779 9779 F DEBUG : #11 pc 000000000055ab88 /system/lib64/libart.so (art_quick_invoke_stub+584)
03-27 13:36:22.251 9779 9779 F DEBUG : #12 pc 00000000000d04c8 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
03-27 13:36:22.251 9779 9779 F DEBUG : #13 pc 00000000004618ac /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
03-27 13:36:22.251 9779 9779 F DEBUG : #14 pc 0000000000462968 /system/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue*)+424)
03-27 13:36:22.251 9779 9779 F DEBUG : #15 pc 000000000048dd88 /system/lib64/libart.so (art::Thread::CreateCallback(void*)+1120)
03-27 13:36:22.251 9779 9779 F DEBUG : #16 pc 00000000000836c8 /system/lib64/libc.so (__pthread_start(void*)+196)
03-27 13:36:22.251 9779 9779 F DEBUG : #17 pc 0000000000023bac /system/lib64/libc.so (__start_thread+68)

Comments

ns...@gmail.com <ns...@gmail.com> #2Apr 27, 2020 12:45PM

The following changes were cherrypicked through Coastguard (

https://android-build.googleplex.com/coastguard/)
Release Track: (

https://android-build.googleplex.com/coastguard/dashboard/6552735953321984/#/history/all)
Created: 2020-03-24 00:08:58.917870+00:00
Changes: aosp/1266484

ns...@gmail.com <ns...@gmail.com> #3May 7, 2020 11:42AM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit 41c9e54ce4ab51f95d19a55fa92a56b6bd018c62
Author: Ian Lake <ilake@google.com>
Date: Mon Mar 23 16:07:32 2020

Allow obfuscation of kept Fragments

Fragments that are kept solely by class
can safely be obfuscated.

By switching to keepclasseswithmembers,
only classes with a default constructor
will qualify to be kept. This also allows
shrinking of classes that are constructed
through a custom FragmentFactory.

Test: tested in sample app at

bug 148181315

#comment4
BUG: 151605338
Change-Id: I68ea8779bce80f33f27658cf87a94ccede5376b0

M fragment/fragment/proguard-rules.pro

https://android-review.googlesource.com/1266484

vi...@google.com <vi...@google.com> #4Jun 4, 2020 05:50AM

Assigned to vi...@google.com.

While -keepclassmembers caused a regression in the original bug, we've added allowsObfuscation to allow even kept fragments to be obfuscated.

This will be available in the upcoming Fragment 1.2.4 and 1.3.0-alpha03.

vi...@google.com <vi...@google.com> #5Jun 10, 2020 06:29AM

The new release 1.2.4 now leads to a direct crash on app-start, i.e. when Android tries to inflate any Fragment referenced in the main navigation graph.

ns...@gmail.com <ns...@gmail.com> #6Jun 10, 2020 08:56AM

Re #5 - please file a new bug with a sample project that reproduces your issue.

ns...@gmail.com <ns...@gmail.com> #7Jun 11, 2020 06:47AM

This change in 1.2.4 also leads to ClassNotFoundException when a fragment is created by providing a name attribute to a FragmentContainerView if the referenced fragment class name is not explicitly kept and obfuscation is enabled:

<androidx.fragment.app.FragmentContainerView
                ...
                android:name="fullClassName"
                ... />

This, of course, is the expected behavior, but I think it is too much of an API-breaking change for a patch release.

vi...@google.com <vi...@google.com> #8Jun 18, 2020 02:21PM

Re #7 - please make sure you've followed the instructions in b/142601969 as otherwise no ProGuard rules are generated for FragmentContainerView referenced classes as per the Fragment 1.2.0 Known Issues.

If you're using Android Gradle Plugin 4.1 Canary 4 or higher and you're not getting your classes properly kept and non-obfuscated when using FragmentContainerView, please file a bug against AAPT.

ns...@gmail.com <ns...@gmail.com> #9Jun 25, 2020 09:57AM

Re #6: It's essentially https://issuetracker.google.com/issues/142601969 and indeed an API-breaking change. Unfortunately, there's no proper fix for AGP 3.6 nor 4.0, thus one can't update until those are stable. It's unfortunate as other AndroidX libraries start depending on 1.3.4 (such as preferences).

deleted

Restricted

0 B

vi...@google.com <vi...@google.com> #10Jun 26, 2020 08:47AM

Thanks everyone

ri...@gmail.com <ri...@gmail.com> #11Jul 14, 2020 06:31PM

In my option, your problem is not related to Samsung or Huwaei. ReferenceQueue's job is something like frees the memory. If you modified the memory which not allocated by you, you will get tons of random crashes. You should check all your native codes.

vi...@google.com <vi...@google.com> #12Jul 8, 2021 01:54PM

Could you share actual abort message?
Do you have any idea where the TRAP_BRKPT is coming from. If so, this is almost certainly memory corruption by their native code or, much less likely, misuse of framework code that uses native code. The usual advice is to run with HWASAN or ASAN, and hope you can find the problem that way.

vi...@google.com <vi...@google.com> #13Jul 15, 2021 01:44PM

Please share the details requested in

comment #12

vi...@google.com <vi...@google.com> #14Aug 3, 2021 01:56PM

Status: Won't Fix (Infeasible)

We are closing this issue as we don't have enough actionable information. If you are still facing this problem, please open new issue and add the relevant information along with reference to earlier issue.