native崩溃

Question

native崩溃

Opened this issue 3 years ago · 12 comments

你好，我在使用vnn进行facemask检测时遇到了一些native崩溃，这是我的检测代码：
``
public static Bitmap vnnFaceMask(Bitmap bitmap, boolean recycle, float[] rect) {
Bitmap result = Bitmap.createBitmap(128, 128, Bitmap.Config.ARGB_8888);
result.eraseColor(Color.BLACK);
try {
VNNHelper vnnHelper = new VNNHelper(App.appContext);
vnnHelper.createModels(VNNHelper.VNN_EFFECT_MODE.VNN_FACE_MASK);
VNN.VNN_Image inputImage = new VNN.VNN_Image();
inputImage.width = bitmap.getWidth();
inputImage.height = bitmap.getHeight();
inputImage.data = BitmapUtil.getRGBAFromBitmap(bitmap);
inputImage.ori_fmt = VNN.VNN_OrientationFormat.VNN_ORIENT_FMT_DEFAULT;
inputImage.pix_fmt = VNN.VNN_PixelFormat.VNN_PIX_FMT_RGBA8888;
inputImage.mode_fmt = VNN.VNN_MODE_FMT.VNN_MODE_FMT_PICTURE;
vnnHelper.apply(VNNHelper.VNN_EFFECT_MODE.VNN_FACE_MASK, inputImage, null);
VNN.VNN_ImageArr imageArr = vnnHelper.imageArr;
if (recycle) {
BitmapUtil.recycleBitmap(bitmap);
}
if (imageArr.imgsNum == 0) {
return result;
}
int width = imageArr.imgsArr[0].width;
int height = imageArr.imgsArr[0].height;
int[] pix = new int[width * height];
for (int j = 0; j < pix.length; j++) {
pix[j] = imageArr.imgsArr[0].data[j] == 0 ? Color.BLACK : Color.WHITE;
}
result.setPixels(pix, 0, width, 0, 0, width, height);
if (rect != null) {
System.arraycopy(imageArr.imgsArr[0].rect, 0, rect, 0, 4);
}
vnnHelper.destroyVNN(VNNHelper.VNN_EFFECT_MODE.VNN_FACE_MASK);
} catch (Error e) {
e.printStackTrace();
}
return result;
}

测试环境和崩溃信息如下：
1、
测试机型：oppo A37m
崩溃日志：
E/<<<Native_Capturer>>>: handle signal: signal=11 sigCode=1 errno=0
E/xunwind: #00 pc 00000000000171a8 /data/app/应用包名-2/lib/arm64/libvnn_face.so
E/xunwind: #1 pc 000000000000afc0 /data/app/应用包名-2/lib/arm64/libvnn_face.so
E/xunwind: #2 pc 0000000000007b44 /data/app/应用包名-2/lib/arm64/libvnn_face.so
E/xunwind: #3 pc 0000000000007974 /data/app/应用包名-2/lib/arm64/libvnn_face.so
E/xunwind: #4 pc 0000000000005620 /data/app/应用包名-2/lib/arm64/libvnn_face.so (VNN_Apply_Face_CPU+144)
E/xunwind: #5 pc 0000000000003abc /data/app/应用包名-2/lib/arm64/libvnnjni.so (Java_com_duowan_vnnlib_VNN_applyFaceCpu+580)
E/xunwind: #6 pc 000000000217dbd4 /data/dalvik-cache/arm64/data@app@应用包名-2@base.apk@classes.dex
E/NativeCapturer: crash:
####
handleThread=Thread-3177
crashThread=GLHandlerThread
####

2、这个问题比较奇怪，在某次编译出来的apk包出现这个问题，在未修改检测代码的情况下，重新编译出来的apk未复现这个问题
测试机型：小米11、红米6A
崩溃日志：
2022-02-14 15:20:47.875 30880-32060/? A/libc: Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 32060 (GLHandlerThread), pid 30880 (cordion.prettyo)
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: Build fingerprint: 'Xiaomi/venus/venus:11/RKQ1.200928.002/V12.5.13.0.RKBCNXM:user/release-keys'
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: Revision: '0'
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: ABI: 'arm64'
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: Timestamp: 2022-02-14 15:20:48+0800
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: pid: 30880, tid: 32060, name: GLHandlerThread >>> 应用包名 <<<
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: uid: 14387
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: Abort message: 'JNI DETECTED ERROR IN APPLICATION: fid == null
in call to GetLongField
from int com.duowan.vnnlib.VNN.applyFaceCpu(int, com.duowan.vnnlib.VNN$i, com.duowan.vnnlib.VNN$f)'
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x0 0000000000000000 x1 0000000000007d3c x2 0000000000000006 x3 0000007d0ce792d0
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x4 000024393f4f282a x5 000024393f4f282a x6 000024393f4f282a x7 2a284f3f3924ffff
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x8 00000000000000f0 x9 a4bd9e266b09fda5 x10 0000000000000000 x11 ffffffc0fffffbdf
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x12 0000000000000001 x13 00000000000000e2 x14 ffff000000000000 x15 ffffffffffffffff
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x16 0000007d9fbd6948 x17 0000007d9fbb5350 x18 0000000000000001 x19 00000000000078a0
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x20 0000000000007d3c x21 00000000ffffffff x22 0000000000000058 x23 0000000000000058
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x24 0000007d1bbd5157 x25 0000000000000001 x26 0000007d1bbec171 x27 0000007d1c1f2000
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: x28 b400007d1c6d1c00 x29 0000007d0ce79350
2022-02-14 15:20:48.016 32149-32149/? A/DEBUG: lr 0000007d9fb68a60 sp 0000007d0ce792b0 pc 0000007d9fb68a8c pst 0000000000001000
2022-02-14 15:20:48.018 32149-32149/? A/DEBUG: backtrace:
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: NOTE: Function names and BuildId information is missing for some frames due
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: NOTE: to unreadable libraries. For unwinds of apps, only shared libraries
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: NOTE: found under the lib/ directory are readable.
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #00 pc 0000000000089a8c /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: 5f57d25b37c043ed36c0e4147dcc8b3f)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #1 pc 000000000055de88 /apex/com.android.art/lib64/libart.so (art::Runtime::Abort(char const*)+2308) (BuildId: 5b103c304a50c13c7fbeaacc0e0df496)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #2 pc 0000000000013978 /system/lib64/libbase.so (android::base::SetAborter(std::__1::function<void (char const*)>&&)::$_3::__invoke(char const*)+76) (BuildId: 7f81cc97d60164bfae3b52a2cd822f20)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #3 pc 0000000000012fa4 /system/lib64/libbase.so (android::base::LogMessage::~LogMessage()+320) (BuildId: 7f81cc97d60164bfae3b52a2cd822f20)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #4 pc 0000000000386344 /apex/com.android.art/lib64/libart.so (art::JavaVMExt::JniAbort(char const*, char const*)+2572) (BuildId: 5b103c304a50c13c7fbeaacc0e0df496)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #5 pc 00000000003becf4 /apex/com.android.art/lib64/libart.so (art::JNI::GetLongField(_JNIEnv*, _jobject*, _jfieldID*)+1624) (BuildId: 5b103c304a50c13c7fbeaacc0e0df496)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #6 pc 0000000000003904 /data/app/~~tkynBF6I6wYFbvaZ834Qpg==/应用包名-Dgei18UFSwJBh-34YYpIig==/lib/arm64/libvnnjni.so (Java_com_duowan_vnnlib_VNN_applyFaceCpu+140) (BuildId: 7ad79b2d6a5b50e2a8bba41a5833ceae7ecdcb3d)
2022-02-14 15:20:48.019 32149-32149/? A/DEBUG: #7 pc 0000000000050360 /data/app/~~tkynBF6I6wYFbvaZ834Qpg==/应用包名-Dgei18UFSwJBh-34YYpIig==/oat/arm64/base.odex (deleted)
2022-02-14 15:20:48.024 1676-2446/? E/NsdService: id 364996 for SERVICE_GET_ADDR_SUCCESS has no client mapping
2022-02-14 15:20:48.024 1676-2446/? E/NsdService: Unhandled { when=0 what=393242 obj=com.android.server.NsdService$NativeEvent@a2708df target=com.android.internal.util.StateMachine$SmHandler }

由于没有开源代码，我无法定位和修改问题，希望能够解决，谢谢！

Answer 1 · 2022-02-14T07:25:47.000Z

我们提供的demo会崩溃么？@liyizhu

Answer 2 · 2022-02-14T07:32:42.000Z

@mrbrantofgithub 会的，你们提供的demo崩溃日志如下：
02-14 15:31:07.845 18981-23460/? E/GED: Failed to get GED Log Buf, err(0)
02-14 15:31:11.521 29920-29920/com.duowan.vnndemo A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x54 in tid 29920 (.duowan.vnndemo)
02-14 15:31:12.416 23485-23485/? E/AEE/AED: request.action: 0
02-14 15:31:12.508 16442-23489/? E/ErrorSaveTask: /data/system/dropbox/data_app_native_crash@1644823872498.txt.gz log not found!
02-14 15:31:12.508 16442-23489/? E/ErrorSaveTask: verifyError(): occur time is empty or app name is empty, return false
02-14 15:31:12.957 23490-23490/com.duowan.vnndemo E/Process: android_os_Process_getProcessNameByPid pid is 23490
02-14 15:31:12.957 23490-23490/com.duowan.vnndemo E/Process: android_os_Process_getProcessNameByPid value is .duowan.vnndemo
02-14 15:31:13.366 23490-23513/com.duowan.vnndemo E/GED: Failed to get GED Log Buf, err(0)

Answer 3 · 2022-02-14T07:38:27.000Z

这个是任何手机都必崩么？还是你测试的这几个手机（oppo A37m，小米11，红米6A）才崩溃。因为我手上暂时没有对应的测试手机。

Answer 4 · 2022-02-14T07:46:01.000Z

@mrbrantofgithub
OPPO A57 android8、vivo Y51S android10、vivo Z3 android9、红米6 android9、小米11 android11、华为 nova 8pro android11我测试过在这些机型上都出现过这个问题，但是用的是我编译的apk，不是vnndemo，可以看看是否有以上机型，vnndemo目前只在oppo A37m，小米11，红米6这几个机型测试过

Answer 5 · 2022-02-14T08:58:36.000Z

我刚才找到一个OPPO A57, android 6.0.1,安装运行demos/Android)/vnn_demo.apk，face mask是正常的，没有崩溃。然后按照demos/Android/readme.md用Android Studio编译安装也是ok的，没有出现崩溃。

Answer 6 · 2022-02-14T09:44:20.000Z

刚才在OPPO A57, android 6.0.1上测试了vnn_demo.apk，确实没有出现崩溃，目前会崩溃的机型有oppo A37m，小米11，红米6，红米6A会崩溃，但只有oppo A37m的崩溃日志是native层的：
02-14 15:31:07.845 18981-23460/? E/GED: Failed to get GED Log Buf, err(0)
02-14 15:31:11.521 29920-29920/com.duowan.vnndemo A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x54 in tid 29920 (.duowan.vnndemo)
02-14 15:31:12.416 23485-23485/? E/AEE/AED: request.action: 0
02-14 15:31:12.508 16442-23489/? E/ErrorSaveTask: /data/system/dropbox/data_app_native_crash@1644823872498.txt.gz log not found!
02-14 15:31:12.508 16442-23489/? E/ErrorSaveTask: verifyError(): occur time is empty or app name is empty, return false
02-14 15:31:12.957 23490-23490/com.duowan.vnndemo E/Process: android_os_Process_getProcessNameByPid pid is 23490
02-14 15:31:12.957 23490-23490/com.duowan.vnndemo E/Process: android_os_Process_getProcessNameByPid value is .duowan.vnndemo
02-14 15:31:13.366 23490-23513/com.duowan.vnndemo E/GED: Failed to get GED Log Buf, err(0)

红米6和红米6A的崩溃日志如下：
2022-02-14 17:43:04.588 15287-15555/? E/AndroidRuntime: FATAL EXCEPTION: GLThread 848
Process: com.duowan.vnndemo, PID: 15287
java.lang.ArrayIndexOutOfBoundsException: src.length=1382402 srcPos=1382400 dst.length=921600 dstPos=0 length=460800
at java.lang.System.arraycopy(Native Method)
at com.duowan.vnndemo.CameraActivity.onDrawFrame(CameraActivity.java:287)
at android.opengl.GLSurfaceView$GLThread.guardedRun(GLSurfaceView.java:1575)
at android.opengl.GLSurfaceView$GLThread.run(GLSurfaceView.java:1271)
2022-02-14 17:43:04.620 607-15650/? E/Hal3Av3: [setIsp] NG (no caminfo) (setIsp){#5125:vendor/mediatek/proprietary/hardware/mtkcam/aaa/source/mt6765/Hal3AAdapter3.cpp}
2022-02-14 17:43:04.626 607-15649/? E/MDP: DpIspStream::waitComplete m_DREPABufferStartIndexList empty
2022-02-14 17:43:04.639 1103-1192/? E/InputDispatcher: channel '36fe401 com.duowan.vnndemo/com.duowan.vnndemo.StreamProducers (server)' ~ Channel is unrecoverably broken and will be disposed!
2022-02-14 17:43:04.639 1103-1192/? E/InputDispatcher: channel '798ab3e com.duowan.vnndemo/com.duowan.vnndemo.CameraActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
2022-02-14 17:43:04.639 1103-1192/? E/InputDispatcher: channel '4267670 com.duowan.vnndemo/com.duowan.vnndemo.MainActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
2022-02-14 17:43:04.640 576-1865/? E/Surface: queueBuffer: error queuing buffer to SurfaceTexture, -32

Answer 7 · 2022-02-14T11:08:24.000Z

我找到红米6测试了一下，相机模式会崩溃，这个是因为用cameraX开发的，可能因为cameraX不稳定，或者是demo开发问题导致相机模式在有些手机上黑屏有些手机上崩溃，这个属于demo的问题不影响vnn sdk的使用。图片模式是正常的，因为face mask的demo当时因为开发时间比较赶，没有图片模式，你可以用disney face的图片模式验证一下（其中用到了face mask的功能），或者demo中仿照disney face补充一下face mask的图片模式。oppo A37m这个手机，我看看明天能不能找到测试机验证一下。@liyizhu

Answer 8 · 2022-02-14T12:07:02.000Z

我测试了一下相机模式崩溃原因：是因为demo中使用的cameraX在不同的手机上取得的数据不一样
ByteBuffer bufferY = image.getPlanes()[0].getBuffer();
ByteBuffer bufferU = image.getPlanes()[1].getBuffer();
ByteBuffer bufferV = image.getPlanes()[2].getBuffer();
int ySize = bufferY.remaining();
int uSize = bufferU.remaining();
int vSize = bufferV.remaining();
比如这段取数据的代码，分辨率是720*1280，
三星s10上，ySize = 921600, uSize = 460799, vSize = 460799
在红米6上，ySize = 921600, uSize = 230400, vSize = 230400
这样的数据格式是不一致的，开发demo时是用三星s10开发的，当时手上的测试机没有红米6这样的情况出现。后面会抽空修复一下这个demo问题。

Answer 9 · 2022-02-15T01:20:28.000Z

好的，前面native的问题麻烦也尽可能看看。

Answer 10 · 2022-02-15T10:12:51.000Z

@liyizhu
native的问题已经定位到了，原因是dynamic_pointer_cast返回nullptr，该问题出现在Android5及以下系统的手机上，预计这周内更新Android端的so修复这个bug。

Answer 11 · 2022-02-16T01:38:02.000Z

好的，麻烦更新so之后提醒一下我，谢谢！

Answer 12 · 2022-02-16T03:26:18.000Z

@liyizhu 你好，已经完成so的更新，demo也简单的更新了一下，修复部分手机如红米6使用相机模式时出现的崩溃。