This is an app demo to reproduce the bug I found in AOSP. When we call a function which uses _Unwind_Backtrace
to generate stack backtrace in armv7a
native .so
via JNI
when our app is not compiled to .oat
file, we'll get a looping output pointing to art_quick_generic_jni_trampoline + 42
. The deadloop will make our app OOM
if we don't set limit to the depth of backtrace in rust when using backtrace::Backtrace::new()
to capture a new backtrace.
You can reproduce the bug easily by downloading demo apk and install it on any arm/aarch android device.
When you find the following output in your device, you've successfully reproduce the bug:
If your device shows a normal output like...
Try adb shell cmd package compile --reset com.example.myapplication
and re-open the app.
Since art_quick_generic_jni_trampoline
is only used by art's interpret mode, we can bypass this bug by force our device to compile the app:
adb shell cmd package compile -m speed -f com.example.myapplication
Open app/
folder in Android Studio and click run
.
The pn/
folder contains source code of the native binady libpn.so
in the android project. You can build the binary using cargo dinghy
(https://github.com/sonos/dinghy), and move the target binary to app/app/src/main/jniLibs/<arch>
to use them.
Android 7.0 ~ master