mapbox / mapbox/mapbox-navigation-android

Crash from native null pointer in libmapbox-maps.so

Open
#3,970 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

blocked
Dominant language
Kotlin
Stars
651
Forks
321
No merged PRs in 30d

Description

Android API:
Mapbox Navigation SDK version: https://github.com/mapbox/mapbox-navigation-android/pull/3967

https://console.firebase.google.com/u/0/project/mapbox-navigation-android/testlab/histories/bh.a6f59f5d2c1849b4/matrices/8266098724130014556/executions/bs.2af6b5d9ccb4269b

Saving a libmapbox-maps.so stack trace from a firebase robo

Native crash of com.mapbox.navigation.test_app 
Build fingerprint: 'google/walleye/walleye:9/PQ3A.190801.002/5670241:user/release-keys'
Revision: 'MP1'
ABI: 'arm64'
pid: 21742, tid: 22081, name: MapboxRenderThr  >>> com.mapbox.navigation.test_app <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x67
Cause: null pointer dereference
    x0  0000000000000067  x1  0000007d0fb0d958  x2  0000000000000047  x3  0000007d0f223cc8
    x4  0000007d14f0dee8  x5  0000007d14f0df08  x6  0000007d07dc5480  x7  0000007d085f6540
    x8  0000007d0fb0d958  x9  0000007d085fb000  x10 0000000000000000  x11 0000000000000000
    x12 0000007d085f5680  x13 0000007d08650640  x14 0000000000000000  x15 0000000000000000
    x16 0000007dae972c00  x17 0000007dae8a1d78  x18 00000000000014a6  x19 0000000000000067
    x20 0000007d0fb0f588  x21 0000007d0c569c30  x22 0000000000000008  x23 0000007d155a4e01
    x24 0000000000000004  x25 0000007d0fb0f588  x26 0000007d219ba0a0  x27 0000000000000001
    x28 0000007d0fb0dbb0  x29 0000007d0fb0d940
    sp  0000007d0fb0d930  lr  0000007d0fcbf790  pc  0000007d0fcbf7bc
backtrace:
    #00 pc 00000000000b17bc  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #01 pc 00000000000b178c  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #02 pc 00000000000b1748  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #03 pc 0000000000142740  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #04 pc 00000000001426dc  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #05 pc 00000000001e3c58  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #06 pc 00000000000be204  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #07 pc 00000000000af6b0  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #08 pc 00000000000ac2e8  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #09 pc 000000000007ef00  /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/lib/arm64/libmapbox-maps.so
    #10 pc 0000000000565be0  /system/lib64/libart.so (art_quick_generic_jni_trampoline+144)
    #11 pc 000000000055cb88  /system/lib64/libart.so (art_quick_invoke_stub+584)
    #12 pc 00000000000cf740  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
    #13 pc 00000000002823b0  /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
    #14 pc 000000000027c36c  /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+948)
    #15 pc 000000000052d390  /system/lib64/libart.so (MterpInvokeInterface+1392)
    #16 pc 000000000054f314  /system/lib64/libart.so (ExecuteMterpImpl+14740)
    #17 pc 0000000000248690  /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/base.apk (deleted) (com.mapbox.maps.NativeMapImpl.render+4)
    #18 pc 0000000000255e68  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
    #19 pc 000000000025b9e8  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
    #20 pc 000000000027c350  /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
    #21 pc 000000000052d390  /system/lib64/libart.so (MterpInvokeInterface+1392)
    #22 pc 000000000054f314  /system/lib64/libart.so (ExecuteMterpImpl+14740)
    #23 pc 000000000034410c  /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/base.apk (deleted) (com.mapbox.maps.renderer.MapboxRenderer.onDrawFrame+8)
    #24 pc 0000000000255e68  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
    #25 pc 000000000025b9e8  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
    #26 pc 000000000027c350  /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
    #27 pc 000000000052c418  /system/lib64/libart.so (MterpInvokeVirtual+584)
    #28 pc 000000000054f114  /system/lib64/libart.so (ExecuteMterpImpl+14228)
    #29 pc 000000000034399e  /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/base.apk (deleted) (com.mapbox.maps.renderer.MapboxRenderThread.draw+42)
    #30 pc 0000000000255e68  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
    #31 pc 000000000025b9e8  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
    #32 pc 000000000027c350  /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
    #33 pc 000000000052d758  /system/lib64/libart.so (MterpInvokeDirect+296)
    #34 pc 000000000054f214  /system/lib64/libart.so (ExecuteMterpImpl+14484)
    #35 pc 000000000034395c  /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/com.mapbox.navigation.test_app-b7CgnEntKaNh6uQ9R6DweQ==/base.apk (deleted) (com.mapbox.maps.renderer.MapboxRenderThread.doFrame+24)
    #36 pc 0000000000255e68  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
    #37 pc 000000000051cb58  /system/lib64/libart.so (artQuickToInterpreterBridge+1032)
    #38 pc 0000000000565cfc  /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
    #39 pc 0000000000b6a7d8  /system/framework/arm64/boot-framework.oat (offset 0x3cd000) (android.view.Choreographer.doCallbacks+872)
    #40 pc 0000000000b6b0e8  /system/framework/arm64/boot-framework.oat (offset 0x3cd000) (android.view.Choreographer.doFrame+1400)
    #41 pc 0000000000c548b8  /system/framework/arm64/boot-framework.oat (offset 0x3cd000) (android.view.Choreographer$FrameDisplayEventReceiver.run+72)
    #42 pc 0000000000aaac1c  /system/framework/arm64/boot-framework.oat (offset 0x3cd000) (android.os.Handler.dispatchMessage+76)
    #43 pc 0000000000aadd80  /system/framework/arm64/boot-framework.oat (offset 0x3cd000) (android.os.Looper.loop+1264)
    #44 pc 0000000000aacc20  /system/framework/arm64/boot-framework.oat (offset 0x3cd000) (android.os.HandlerThread.run+544)
    #45 pc 000000000055cb88  /system/lib64/libart.so (art_quick_invoke_stub+584)
    #46 pc 00000000000cf740  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
    #47 pc 00000000004633b8  /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
    #48 pc 0000000000464480  /system/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue*)+424)
    #49 pc 000000000048f830  /system/lib64/libart.so (art::Thread::CreateCallback(void*)+1120)
    #50 pc 0000000000083114  /system/lib64/libc.so (__pthread_start(void*)+36)
    #51 pc 00000000000233bc  /system/lib64/libc.so (__start_thread+68)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Firebase Test Lab execution and the native stack trace for libmapbox-maps.so, especially the calls through com.mapbox.maps.NativeMapImpl.render and MapboxRenderer.onDrawFrame. Reproduce the crash on the reported Android configuration, identify the null-pointer path, and verify the test_app no longer crashes during rendering.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.