Can't Repro
Status Update
No update yet.
Comments
ra...@google.com
jr...@google.com
Can you run the crash stack through ./development/scripts/stack so that line numbers are part of the stack? That has to be done by whatever did the build for native crashes.
xi...@xiaomi.corp-partner.google.com
I am unable to run the crash stack on my end. Currently, this issue is no longer recurring
xi...@xiaomi.corp-partner.google.com
Help close this case, thank you
Description
07-27 09:25:17.698 1000 8033 8033 F DEBUG : Build fingerprint: 'Redmi/manet/manet:14/UKQ1.230621.003/23.7.27:user/release-keys'
07-27 09:25:17.698 1000 8033 8033 F DEBUG : Revision: '0'
07-27 09:25:17.698 1000 8033 8033 F DEBUG : ABI: 'arm64'
07-27 09:25:17.698 1000 8033 8033 F DEBUG : Timestamp: 2023-07-27 09:25:17.561843843+0800
07-27 09:25:17.698 1000 8033 8033 F DEBUG : Process uptime: 10s
07-27 09:25:17.698 1000 8033 8033 F DEBUG : ZygotePid: 4858
07-27 09:25:17.698 1000 8033 8033 F DEBUG : Cmdline: /system/bin/surfaceflinger
07-27 09:25:17.698 1000 8033 8033 F DEBUG : pid: 4865, tid: 4949, name: RegionSampling >>> /system/bin/surfaceflinger <<<
07-27 09:25:17.698 1000 8033 8033 F DEBUG : uid: 1000
07-27 09:25:17.698 1000 8033 8033 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
07-27 09:25:17.698 1000 8033 8033 F DEBUG : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
07-27 09:25:17.698 1000 8033 8033 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xffffffffffffffff
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x0 0000000000000000 x1 0000002a000001c3 x2 ffffffffffffffff x3 000000000000000f
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x4 00000000000001c0 x5 0000000000000002 x6 000000000000002c x7 00000079e898f551
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x8 00000000000001c3 x9 000000000000002a x10 0000000000000000 x11 0000000000000000
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x12 00000000000001c3 x13 00000000000001c3 x14 000000000000002a x15 00000000000001c0
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x16 00000000000001c0 x17 000000000000000f x18 00000079ec18a000 x19 b4000079e0a41eb0
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x20 00000079e898f920 x21 0000000000000017 x22 b4000079d5985f60 x23 0000007a85830133
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x24 0000007a8582011d x25 b4000079d5985f80 x26 0000000000000c00 x27 00000000000001c3
07-27 09:25:17.698 1000 8033 8033 F DEBUG : x28 b4000079f08a3958 x29 00000079e898f8b0
07-27 09:25:17.698 1000 8033 8033 F DEBUG : lr 0000007a85a0be88 sp 00000079e898f850 pc 0000007a85a0bf40 pst 0000000020001000
07-27 09:25:17.698 1000 8033 8033 F DEBUG : 6 total frames
07-27 09:25:17.698 1000 8033 8033 F DEBUG : backtrace:
07-27 09:25:17.698 1000 8033 8033 F DEBUG : #00 pc 00000000002b9f40 /system/lib64/libsurfaceflinger.so (android::RegionSamplingThread::sampleBuffer(android::sp<android::GraphicBuffer> const&, android::Point const&, std::_1::vector<android::RegionSamplingThread::Descriptor, std::_1::allocator<android::RegionSamplingThread::Descriptor> > const&, unsigned int)+548) (BuildId: 198eda86c070e61bb225b02d027b865e)
07-27 09:25:17.698 1000 8033 8033 F DEBUG : #01 pc 00000000002bab2c /system/lib64/libsurfaceflinger.so (android::RegionSamplingThread::captureSample()+2724) (BuildId: 198eda86c070e61bb225b02d027b865e)
07-27 09:25:17.698 1000 8033 8033 F DEBUG : #02 pc 00000000002baedc /system/lib64/libsurfaceflinger.so (android::RegionSamplingThread::threadMain()+112) (BuildId: 198eda86c070e61bb225b02d027b865e)
07-27 09:25:17.698 1000 8033 8033 F DEBUG : #03 pc 00000000002bbd38 /system/lib64/libsurfaceflinger.so (void* std::_1::thread_proxy<std::1::tuple<std::1::unique_ptr<std::1::thread_struct, std::1::default_delete<std::1::thread_struct> >, android::RegionSamplingThread::RegionSamplingThread(android::SurfaceFlinger&, android::RegionSamplingThread::TimingTunables const&)::$_2> >(void*) (._uniq.22835156453571511455795338659787558893)+44) (BuildId: 198eda86c070e61bb225b02d027b865e)
07-27 09:25:17.699 1000 8033 8033 F DEBUG : #04 pc 00000000000fcfc4 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 26087219768fb8aa5dd08ed6e6de0176)
07-27 09:25:17.699 1000 8033 8033 F DEBUG : #05 pc 0000000000096924 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 26087219768fb8aa5dd08ed6e6de0176)
07-27 09:25:17.699 1000 5040 5379 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.sendBroadcastMultiplePermissions:1281 android.content.Context.sendBroadcastMultiplePermissions:2487 com.android.server.TelephonyRegistry.broadcastServiceStateChanged:3615 com.android.server.TelephonyRegistry.notifyServiceStateForPhoneId:1770 com.android.internal.telephony.ITelephonyRegistry$Stub.onTransact:534
202 float sampleArea(const uint32_t* data, int32_t width, int32_t height, int32_t stride,
203 uint32_t orientation, const Rect& sample_area) {
204 if (!sample_area.isValid() || (sample_area.getWidth() > width) ||
205 (sample_area.getHeight() > height)) {
206 ALOGE("invalid sampling region requested");
207 return 0.0f;
208 }
209
210 const uint32_t pixelCount =
211 (sample_area.bottom - sample_area.top) * (sample_area.right - sample_area.left);
212 uint32_t accumulatedLuma = 0;
213
214 // Calculates luma with approximation of Rec. 709 primaries
215 for (int32_t row = sample_area.top; row < sample_area.bottom; ++row) {
216 const uint32_t* rowBase = data + row * stride;
217 for (int32_t column = sample_area.left; column < sample_area.right; ++column) { //Error location
218 uint32_t pixel = rowBase[column]; //Error location
219 const uint32_t r = pixel & 0xFF;
220 const uint32_t g = (pixel >> 8) & 0xFF;
221 const uint32_t b = (pixel >> 16) & 0xFF;
222 const uint32_t luma = (r * 7 + b * 2 + g * 23) >> 5;
223 accumulatedLuma += luma;
224 }
225 }
226
227 return accumulatedLuma / (255.0f * pixelCount);
228 }
230 std::vector<float> RegionSamplingThread::sampleBuffer(
231 const sp<GraphicBuffer>& buffer, const Point& leftTop,
232 const std::vector<RegionSamplingThread::Descriptor>& descriptors, uint32_t orientation) {
233 void* data_raw = nullptr;
234 buffer->lock(GRALLOC_USAGE_SW_READ_OFTEN, &data_raw);
235 std::shared_ptr<uint32_t> data(reinterpret_cast<uint32_t*>(data_raw),
236 [&buffer](auto) { buffer->unlock(); });
237 if (!data) return {};
238
239 const int32_t width = buffer->getWidth();
240 const int32_t height = buffer->getHeight();
241 const int32_t stride = buffer->getStride();
242 std::vector<float> lumas(descriptors.size());
243 std::transform(descriptors.begin(), descriptors.end(), lumas.begin(),
244 [&](auto const& descriptor) {
245 return sampleArea(data.get(), width, height, stride, orientation, //Call the above function from here
246 descriptor.area - leftTop);
247 });
248 return lumas;
249 }