Crash on all 32bit Unisoc & JLQ Android Go devices
OfficialKatana opened this issue · 4 comments
Both test cases and app with lsplant initializer were crashed on start up.
e.g. POCO C40 / Nokia C2
Logs may looks like these:
2023-06-16 20:32:56.884 10343-10365/? A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xb22018a8 in tid 10365 (pool-2-thread-1), pid 10343 (com.whatsapp)
2023-06-16 20:32:56.946 10368-10368/? I/crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstone
2023-06-16 20:32:56.946 358-358/? I//system/bin/tombstoned: received crash request for pid 10365
2023-06-16 20:32:56.950 10368-10368/? I/crash_dump32: performing dump of process 10343 (target tid = 10365)
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: Native Crash TIME: 75389841
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: Build fingerprint: 'PSZ/alsgs8990_io09/alsgs8990_io09_go:9/PPR1.180610.011/372:user/release-keys'
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: Revision: '0'
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: ABI: 'arm'
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: pid: 10343, tid: 10365, name: pool-2-thread-1 >>> com.whatsapp <<<
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xb22018a8
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: r0 b22018a8 r1 4731a6b1 r2 9c20e2b2 r3 0000001a
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: r4 9c225954 r5 9bd806f0 r6 0000001c r7 9c20ea87
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: r8 aa25d700 r9 9c225ac8 r10 aa25d700 r11 9c225b40
2023-06-16 20:32:56.974 10368-10368/? A/DEBUG: ip b22018a8 sp 9bd7f498 lr b2aedaa7 pc 9c21230c
2023-06-16 20:32:56.975 10368-10368/? A/DEBUG: backtrace:
2023-06-16 20:32:56.975 10368-10368/? A/DEBUG: #00 pc 0000630c /data/app/com.whatsapp-DIUPK6U6RRcSp-EVXuCxBA==/lib/arm/liblsplant.so (lsplant::v2::Init(_JNIEnv*, lsplant::v2::InitInfo const&)+3952)
看起来并没有在主线程掉用 Init,这不是正确使用。应该要在主线成调用。并且没看到 JniOnLoad 的 native 调用栈,可能并没有 bypass 掉 Non-SDK API restriction 而引发崩溃。
看起来并没有在主线程掉用 Init,这不是正确使用。应该要在主线成调用。并且没看到 JniOnLoad 的 native 调用栈,可能并没有 bypass 掉 Non-SDK API restriction 而引发崩溃。
The probable was found, devices carrying UniSoc may miss this function: _ZN3artL18DexFile_setTrustedEP7_JNIEnvP7_jclassP8_jobject
Which may cause initialization failed, searching this function will lead to collapse, maybe due to the malformed functions on Android Go devices.
Changing code below may fix:
if (sdk_int >= __ANDROID_API_P__) [[likely]] {
if (!RETRIEVE_FUNC_SYMBOL(DexFile_setTrusted,
"_ZN3artL18DexFile_setTrustedEP7_JNIEnvP7_jclassP8_jobject",
true)) {
return false;
}
}
to
if (sdk_int >= __ANDROID_API_P__) [[likely]] {
if (!RETRIEVE_FUNC_SYMBOL(DexFile_setTrusted,
"_ZN3artL18DexFile_setTrustedEP7_JNIEnvP7_jclassP8_jobject",
true)) {
LOGE("Dex files trusting method not found?");
}
}
The actual reason may cause by the compiler's InstrProfSymtab pass which may modify specific (libart) functions and cause bugs.
Your fix is correct. Since this function is not mandatory.
Can you provide libart.so?