SurfaceView is triggering NDK crash signal 11 (SIGSEGV) in libgui.so on Android 13 [285825722]

Can't Repro

Bug

Status Update

No update yet.

Description

lu...@bitmovin.com

created issue #1

Jun 5, 2023 04:48PM

We are observing following crash issues when using SurfaceView to playback video on Android 13 devices. One of the scenarios where we are able to replicate the crash is when frequently changing orientation from portrait to landscape and vice-a-vera. Google crash report for the app shows a large number of users impacted(screenshots are attached) so we believe there are other more nominal scenarios as well causing this behaviour. We found an old report(https://issuetracker.google.com/issues/139111930) with similar crash which was supposed to be fixed earlier.

A few more observations.

The issue is only reported in Android 13.
The issue is observed across a variety of Android device brands/models.

Pls see screenshot for crash stats and list of devices at https://drive.google.com/drive/folders/1xQEivXBpCdvcq7UCHOb8gnaw9cetcL4d?usp=sharing

Please let me know if any more information is required to investigate this issue.

Stack trace 1 :

backtrace:
  #00  pc 0x0000000000116634  /system/lib64/libgui.so (android::SurfaceComposerClient::Transaction::getLayerState(android::sp<android::SurfaceControl> const&)+64)
  #01  pc 0x0000000000117e3c  /system/lib64/libgui.so (android::SurfaceComposerClient::Transaction::setBuffer(android::sp<android::SurfaceControl> const&, android::sp<android::GraphicBuffer> const&, std::__1::optional<android::sp<android::Fence> > const&, std::__1::optional<unsigned long> const&, std::__1::function<void (android::ReleaseCallbackId const&, android::sp<android::Fence> const&, std::__1::optional<unsigned int>)>)+72)
  #02  pc 0x00000000000b20d0  /system/lib64/libgui.so (android::BLASTBufferQueue::acquireNextBufferLocked(std::__1::optional<android::SurfaceComposerClient::Transaction*>)+2796)
  #03  pc 0x00000000000b4304  /system/lib64/libgui.so (android::BLASTBufferQueue::onFrameAvailable(android::BufferItem const&)+652)
  #04  pc 0x00000000000cc2c8  /system/lib64/libgui.so (android::ConsumerBase::onFrameAvailable(android::BufferItem const&)+176)
  #05  pc 0x0000000000090ad0  /system/lib64/libgui.so (android::BufferQueue::ProxyConsumerListener::onFrameAvailable(android::BufferItem const&)+108)
  #06  pc 0x000000000009bd30  /system/lib64/libgui.so (android::BufferQueueProducer::queueBuffer(int, android::IGraphicBufferProducer::QueueBufferInput const&, android::IGraphicBufferProducer::QueueBufferOutput*)+2896)
  #07  pc 0x0000000000027a20  /system/lib64/libcodec2_client.so (android::hardware::media::c2::OutputBufferQueue::outputBuffer(C2ConstGraphicBlock const&, android::IGraphicBufferProducer::QueueBufferInput const&, android::IGraphicBufferProducer::QueueBufferOutput*)+1328)
  #08  pc 0x000000000005fbe8  /system/lib64/libsfplugin_ccodec.so (android::CCodecBufferChannel::renderOutputBuffer(android::sp<android::MediaCodecBuffer> const&, long)+3272)
  #09  pc 0x000000000014e264  /system/lib64/libstagefright.so (android::MediaCodec::onReleaseOutputBuffer(android::sp<android::AMessage> const&)+1188)
  #10  pc 0x000000000013d0c4  /system/lib64/libstagefright.so (android::MediaCodec::onMessageReceived(android::sp<android::AMessage> const&)+6736)
  #11  pc 0x000000000001a9e4  /system/lib64/libstagefright_foundation.so (android::AHandler::deliverMessage(android::sp<android::AMessage> const&)+88)
  #12  pc 0x0000000000021178  /system/lib64/libstagefright_foundation.so (android::AMessage::deliver()+192)
  #13  pc 0x000000000001be00  /system/lib64/libstagefright_foundation.so (android::ALooper::loop()+644)
  #14  pc 0x0000000000013418  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+424)
  #15  pc 0x00000000000ce7e8  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+144)
  #16  pc 0x00000000000bb728  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)
  #17  pc 0x000000000005501c  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68)

Stack trace 2 :

backtrace:
  #00  pc 0x0000000000116520  /system/lib64/libgui.so (android::SurfaceComposerClient::Transaction::getLayerState(android::sp<android::SurfaceControl> const&)+64)
  #01  pc 0x0000000000117d28  /system/lib64/libgui.so (android::SurfaceComposerClient::Transaction::setBuffer(android::sp<android::SurfaceControl> const&, android::sp<android::GraphicBuffer> const&, std::__1::optional<android::sp<android::Fence> > const&, std::__1::optional<unsigned long> const&, std::__1::function<void (android::ReleaseCallbackId const&, android::sp<android::Fence> const&, std::__1::optional<unsigned int>)>)+72)
  #02  pc 0x00000000000b2084  /system/lib64/libgui.so (android::BLASTBufferQueue::acquireNextBufferLocked(std::__1::optional<android::SurfaceComposerClient::Transaction*>)+2796)
  #03  pc 0x00000000000b42b8  /system/lib64/libgui.so (android::BLASTBufferQueue::onFrameAvailable(android::BufferItem const&)+652)
  #04  pc 0x00000000000cc26c  /system/lib64/libgui.so (android::ConsumerBase::onFrameAvailable(android::BufferItem const&)+176)
  #05  pc 0x0000000000090a50  /system/lib64/libgui.so (android::BufferQueue::ProxyConsumerListener::onFrameAvailable(android::BufferItem const&)+108)
  #06  pc 0x000000000009bcb0  /system/lib64/libgui.so (android::BufferQueueProducer::queueBuffer(int, android::IGraphicBufferProducer::QueueBufferInput const&, android::IGraphicBufferProducer::QueueBufferOutput*)+2896)
  #07  pc 0x0000000000106b80  /system/lib64/libgui.so (android::Surface::queueBuffer(ANativeWindowBuffer*, int)+596)
  #08  pc 0x00000000000a1c8c  /system/lib64/libstagefright.so (android::ACodec::BaseState::onOutputBufferDrained(android::sp<android::AMessage> const&)+4208)
  #09  pc 0x00000000000a36cc  /system/lib64/libstagefright.so (android::ACodec::BaseState::onMessageReceived(android::sp<android::AMessage> const&)+1100)
  #10  pc 0x00000000000b13d8  /system/lib64/libstagefright.so (android::ACodec::ExecutingState::onMessageReceived(android::sp<android::AMessage> const&)+924)
  #11  pc 0x00000000000d6d34  /system/lib64/libstagefright.so (android::AHierarchicalStateMachine::handleMessage(android::sp<android::AMessage> const&)+264)
  #12  pc 0x000000000001a9e4  /system/lib64/libstagefright_foundation.so (android::AHandler::deliverMessage(android::sp<android::AMessage> const&)+88)
  #13  pc 0x0000000000021178  /system/lib64/libstagefright_foundation.so (android::AMessage::deliver()+192)
  #14  pc 0x000000000001be00  /system/lib64/libstagefright_foundation.so (android::ALooper::loop()+644)
  #15  pc 0x0000000000013418  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+424)
  #16  pc 0x00000000000f5298  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)

Comments

ra...@google.com <ra...@google.com> #2Jun 6, 2023 08:40AM

Assigned to ra...@google.com.

Just a heads up that this is still a problem. Are you open to accept external PRs to solve this?

wo...@gmail.com <wo...@gmail.com> #3
Restricted+
Jun 7, 2023 08:39PM

Comment has been deleted.

wo...@gmail.com <wo...@gmail.com> #4Jun 7, 2023 08:40PM

Comment has been deleted.

Message last modified on Jun 7, 2023 08:52PM

wo...@gmail.com <wo...@gmail.com> #5
Restricted+
Jun 7, 2023 08:53PM

Comment has been deleted.

wo...@gmail.com <wo...@gmail.com> #6Jun 7, 2023 09:57PM

regarding comment#13, do you need per-ABI preBuild hooks like preDebugBuild[x86_64] before you're unblocked?

Thanks for the follow up.

I'd say that depending on preBuild would be the minimum requirement, as those tasks have no dependencies at all at the moment.

If you could properly let them depend on the build-variant preBuild tasks (i.e. preDebugBuild), would be great.

per-ABI hooks feel unnecessary to me.

ra...@google.com <ra...@google.com> #7Jun 12, 2023 06:39AM

This seems fixed for me btw in 7.3.0-alpha09 including:

Tasks: clean and assembleDebug
ABIs: All 4 default and single ones like x86_64
OS: MacOS 12.3-12.4Beta2 (local dev) and Ubuntu 20.04.4 (CI Flow with GitHub Actions)
Version of Java: Temurin 11, Temurin 18, OpenJDK 18 locally, etc
Version of Gradle: 7.3.3, 7.5 nightly (20220331233901)
Version of SDK Build Tools: 31.0.0
Version of NDK: 24.0.8215888, 25.0.8221429 rc2

Looking solid, lemme kno if worth identifying the AGP version and/or commit that fixed it.

Full details including repro and logs

wo...@gmail.com <wo...@gmail.com> #8Jun 12, 2023 02:34PM

Here is the link to the fix https://android.googlesource.com/platform/tools/base/+/00e15bcb18d58470ce702c415e5db73ce29d1da6 7.3.0-alpha09 sounds right.

lu...@bitmovin.com <lu...@bitmovin.com> #9Jun 15, 2023 11:25AM

Dear Google team, is there any update on this issue please? We are keen to understand the root cause of this crash. We are hoping that could give us some direction about preventing this from happening by tweaking something in the app/player.

ra...@google.com <ra...@google.com> Jun 16, 2023 03:53AM

Reassigned to an...@google.com.

ns...@google.com <ns...@google.com> Jun 17, 2023 12:53AM

Reassigned to wm...@google.com.

lu...@bitmovin.com <lu...@bitmovin.com> #10Jun 22, 2023 06:54AM

Dear Google Team, is there any update on this issue please or an ETA by when this will be investigated?

ch...@google.com <ch...@google.com> #11Jun 22, 2023 04:29PM

Status: Won't Fix (Not Reproducible)

This issue was reported in T, but no longer see it in later builds. We're unsure what may have changed since there has been significant changes and refactors internally since T. As of now, there's no additional work that is backported to T and since it's no longer happening in U, there doesn't appear to be anything left to fix

lu...@gmail.com <lu...@gmail.com> #12Jun 22, 2023 07:03PM

Thanks for the update. Is it possible to share with us any potential causes of the issue happening on Android T. Since it will be quite some time until devices may get update for Android U, we will have this issue happening for our users. Any insights into potential root cause will help us try some solutions in the app or player to either resolve the issue or reduce it's impact.

ch...@google.com <ch...@google.com> #13Jun 23, 2023 02:50PM

We are unsure why it was happening or why it no longer happens. That stack trace indicates an unsychronized access to the transaction, but nothing we can see is unsynchronized in those blocks nor anywhere else using that transaction object.

lu...@bitmovin.com <lu...@bitmovin.com> #14Jun 28, 2023 10:22AM

Thanks for the feedback. To be sure that I understood the status correctly, can you please confirm below understanding.

Google team found the issue to happen in Android 13 but not in Android 14 builds.
It could not be identified which exact change in Android 14 could have fixed the issue as there have been several changes and refactors since Android 13.

ch...@google.com <ch...@google.com> #15Jun 28, 2023 08:58PM

Yes that's correct

ja...@gmail.com <ja...@gmail.com> #16Jan 20, 2024 04:27AM

We are experiencing the same crash that has been reported in the Google Play Console for Samsung A32 and OS 13. Do we have any solutions to prevent these crashes?

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 9215 >>> com.myapplication <<<

backtrace:
#00 pc 0x0000007616a5e1f0
#01 pc 0x00000000000bbcac /system/lib64/libgui.so (android::BLASTBufferQueue::acquireNextBufferLocked(std::__1::optional<android::SurfaceComposerClient::Transaction*>)+1420)
#02 pc 0x00000000000beaf4 /system/lib64/libgui.so (android::BLASTBufferQueue::onFrameAvailable(android::BufferItem const&)+1588)
#03 pc 0x00000000000cc48c /system/lib64/libgui.so (android::ConsumerBase::onFrameAvailable(android::BufferItem const&)+172)
#04 pc 0x0000000000098e28 /system/lib64/libgui.so (android::BufferQueue::ProxyConsumerListener::onFrameAvailable(android::BufferItem const&)+104)
#05 pc 0x00000000000a55e8 /system/lib64/libgui.so (android::BufferQueueProducer::queueBuffer(int, android::IGraphicBufferProducer::QueueBufferInput const&, android::IGraphicBufferProducer::QueueBufferOutput*)+2984)
#06 pc 0x00000000001080a4 /system/lib64/libgui.so (android::Surface::queueBuffer(ANativeWindowBuffer*, int)+1252)
#07 pc 0x000000000078abdc /vendor/lib64/egl/libGLES_mali.so
#08 pc 0x000000000079cc20 /vendor/lib64/egl/libGLES_mali.so
#09 pc 0x000000000079c09c /vendor/lib64/egl/libGLES_mali.so
#10 pc 0x00000000000205bc /system/lib64/libEGL.so (android::eglSwapBuffersWithDamageKHRImpl(void*, void*, int*, int)+476)
#11 pc 0x000000000001cbb8 /system/lib64/libEGL.so (eglSwapBuffersWithDamageKHR+72)
#12 pc 0x000000000032f4e8 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#13 pc 0x00000000006b3c90 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#14 pc 0x00000000005a65fc /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#15 pc 0x00000000005ab3a8 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#16 pc 0x00000000005aaec8 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#17 pc 0x00000000005abce4 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#18 pc 0x00000000005ab72c /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#19 pc 0x00000000005b86b8 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#20 pc 0x000000000034cb30 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#21 pc 0x000000000034ff44 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#22 pc 0x0000000000018224 /system/lib64/libutils.so (android::Looper::pollInner(int)+1060)
#23 pc 0x0000000000017da0 /system/lib64/libutils.so (android::Looper::pollOnce(int, int*, int*, void**)+112)
#24 pc 0x00000000000185e4 /system/lib64/libandroid.so (ALooper_pollOnce+100)
#25 pc 0x0000000000350050 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#26 pc 0x000000000034e6b4 /data/app/~~t8zB1OY7_o6sGL3stJJ4Eg==/com.myapplication-ceixkrx_F-NXDIqt8azoDw==/split_config.arm64_v8a.apk!libflutter.so (BuildId: eaca0879186acf24b2d85d5234cde153c1e45e5c)
#27 pc 0x00000000000c1b40 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+224)
#28 pc 0x0000000000054f20 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)

Issue 285825722

Description

Issue summary

Comments

ra...@google.com <ra...@google.com> #2Jun 6, 2023 08:40AM

wo...@gmail.com <wo...@gmail.com> #3 Restricted+ Jun 7, 2023 08:39PM

wo...@gmail.com <wo...@gmail.com> #4Jun 7, 2023 08:40PM

wo...@gmail.com <wo...@gmail.com> #5 Restricted+ Jun 7, 2023 08:53PM

wo...@gmail.com <wo...@gmail.com> #6Jun 7, 2023 09:57PM

ra...@google.com <ra...@google.com> #7Jun 12, 2023 06:39AM

wo...@gmail.com <wo...@gmail.com> #8Jun 12, 2023 02:34PM

lu...@bitmovin.com <lu...@bitmovin.com> #9Jun 15, 2023 11:25AM

ra...@google.com <ra...@google.com> Jun 16, 2023 03:53AM

ns...@google.com <ns...@google.com> Jun 17, 2023 12:53AM

lu...@bitmovin.com <lu...@bitmovin.com> #10Jun 22, 2023 06:54AM

ch...@google.com <ch...@google.com> #11Jun 22, 2023 04:29PM

lu...@gmail.com <lu...@gmail.com> #12Jun 22, 2023 07:03PM

ch...@google.com <ch...@google.com> #13Jun 23, 2023 02:50PM

lu...@bitmovin.com <lu...@bitmovin.com> #14Jun 28, 2023 10:22AM

ch...@google.com <ch...@google.com> #15Jun 28, 2023 08:58PM

ja...@gmail.com <ja...@gmail.com> #16Jan 20, 2024 04:27AM

Add comment

Issue metadata

wo...@gmail.com <wo...@gmail.com> #3
Restricted+
Jun 7, 2023 08:39PM

wo...@gmail.com <wo...@gmail.com> #5
Restricted+
Jun 7, 2023 08:53PM