Crash in StreamConfigurationMapCompat::getHighResolutionOutputSizes [282025204]

Fixed

Bug

Status Update

No update yet.

Description

bo...@withvector.com

created issue #1

May 11, 2023 05:37PM

Please note: This component is for the CameraX API used in Jetpack. Please DO NOT file Pixel Camera issues here.

Please describe your issue and include details such as the version of CameraX you are using and any relevant logs related to your issue.

// If at all possible, capture an Android logcat (

https://developer.android.com/studio/command-line/logcat) when you're experiencing the issue, preferably while the camera is still active.

CAMERAX VERSION 1.0.0.alpha06

CAMERA APPLICATION NAME AND VERSION: Vector (com.convoy.loaddoc) version 10.8.509

ANDROID OS BUILD NUMBER: OPPS27.91-99-9-15

DEVICE NAME: Motorola E5

DESCRIPTION: NullPointerException in cameraProvider.bindToLifecycle on devices that have no high resolution modes.
The problem is if `mImpl.getHighResolutionOutputSizes(format);` returns null (see code fragment below), it will still cache it, and the second invocation will retrieve the null and attempt to call clone(), crashing the app.
The `mCachedFormatHighResolutionOutputSizes.put(format, outputSizes);` line should be moved into the body of the if statement, and/or a null check should be added to the fetch before calling clone().

LIST ANY EXPERIMENTAL FEATURES: (As an example - @ExperimentalCamera2Interop)
none

STEPS TO REPRODUCE:
1. Launch app and login
2. Start a workflow by clicking the + button in the bottom right
3. Find a camera icon and click it.
4. Go through the image capture sequence.
5. Click "add image" to add a second image next to the first
6. Click the image capture (shutter) button

OBSERVED RESULTS:
The app displays a crash alert

EXPECTED RESULTS:
The app should not crash

REPRODUCIBILITY: (5 of 5, 1 of 100, etc)

ADDITIONAL INFORMATION:

CODE FRAGMENTS (this will help us troubleshoot your issues):
@Nullable
public Size[] getHighResolutionOutputSizes(int format) {
if (mCachedFormatHighResolutionOutputSizes.containsKey(format)) {
return mCachedFormatHighResolutionOutputSizes.get(format).clone();
}

Size[] outputSizes = mImpl.getHighResolutionOutputSizes(format);

// High resolution output sizes can be null.
if (outputSizes != null && outputSizes.length > 0) {
outputSizes = mOutputSizesCorrector.applyQuirks(outputSizes, format);
}

mCachedFormatHighResolutionOutputSizes.put(format, outputSizes);
return outputSizes != null ? outputSizes.clone() : null;
}

Comments

wu...@google.com <wu...@google.com> #2May 12, 2023 01:00AM

Reassigned to bo...@withvector.com.

A couple of questions:

1. Have you saw crash in real device or only in simulators?
2. Do you use dynamic feature for language ID?

bo...@withvector.com <bo...@withvector.com> #3May 12, 2023 04:15AM

Tested on Android 12 Emulator with custom executor, but cannot repro this issue.

bo...@withvector.com <bo...@withvector.com> #4May 12, 2023 05:50PM

Second crash in the description is from a real device. Experienced it myself on two different Xiaomi phones, plus lots of crashes from users in the Google Play console.
Dynamic features are not used in the application.

As a wild guess, I have downgraded build tools from 31.0.0 to 30.0.3, compileSdk from 31 to 30, and moved all work with Language ID to the service in a separate process (just to be sure that crash can kill secondary process instead of main). This combination is in beta for 2 days by now and I don't see any SIGSEGV crashes.

wu...@google.com <wu...@google.com> #5May 15, 2023 06:47AM

Reassigned to ca...@google.com.

Hmm, I feel the crash might be something related to separate/secondary process.

I also changed compileSdk and targetSDK to 31 but still cannot repro this issue.

ch...@google.com <ch...@google.com> May 15, 2023 06:56AM

Accepted by ch...@google.com.

ap...@google.com <ap...@google.com> #6May 15, 2023 09:48AM

On the contrary, there was no separate process before, when crashes started.

In the new build (with the aforementioned changes) I can see SIGSEGV crash, but only one instead of dozens and it has a bit different backtrace:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)
liblanguage_id_jni.so (offset 0x11e000)

backtrace:
  #00  pc 000000000003c7c0  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003b960  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003bb48  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003bafc  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000036c98  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000032714  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000031cac  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000057438  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/oat/arm64/base.odex (offset 0x57000)

ch...@google.com <ch...@google.com> May 16, 2023 01:23AM

Marked as fixed.

ju...@google.com <ju...@google.com> #7May 24, 2023 07:37PM

FYI, ML Kit launched a new language ID SDK in the latest release, which uses a new language ID model. https://developers.google.com/ml-kit/release-notes#august_11_2021

Could you try the new SDK version(17.0.0) to check if you can still repro this native crash? Thanks!