Bug Android + Native Crash - Mesh::CreateMesh()

Hello!

I've been implementing a feature into my game that displays a notification after an ad is shown (using Unity Ads)

It's a simple object with some Image & TextMeshPro objects (all animated with a timeline) running in a coroutinue.

Nothing fancy and it works perfectly well in the player. But I've just noticed it's started to crash on Android 10 (in a IL2CPP build). Unfortunately I'm not aware of the exact change that triggered it.

I'm using Unity 2020.3.28f1 & TextMeshPro 3.0.6

Looking at the crash report in the Unity Dashboard shows this...

Native Crash - Mesh::CreateMesh()
Mesh::CreateMesh()

Native StackTrace:

Thread 0 (crashed)
0 libunity.so 0x00000078cafb252c Mesh::CreateMesh()
1 libunity.so 0x00000078cafb3f20 Mesh::UploadMeshData(bool)
2 libunity.so 0x00000078cafb40e8 Mesh::AwakeFromLoad(AwakeFromLoadMode)
3 libunity.so 0x00000078caca9e54 Mesh_CUSTOM_Internal_Create(ScriptingBackendNativeObjectPtrOpaque*)
4 libil2cpp.so 0x00000078c98ac178 TextMeshProUGUI_Awake_m0DE2F43DC61FDDBF84F013ABDB89D59BA6EE4889 (C:\workspace\workspace\p\Library\Il2cppBuildCache\Android\arm64-v8a\il2cppOutput\Unity.TextMeshPro4.cpp:15069)
5 libil2cpp.so 0x00000078c8dfe370 RuntimeInvoker_TrueVoid_t700C6383A2A510C2CF4DD86DABD5CA9FF70ADAC5(void (*)(), MethodInfo const*, void*, void**) (C:\workspace\workspace\p\Library\Il2cppBuildCache\Android\arm64-v8a\il2cppOutput\Il2CppInvokerTable.cpp:64361)
6 libil2cpp.so 0x00000078c8f1f09c il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) (C:\Program Files\Unity\Editor\Data\il2cpp\libil2cpp\vm\Runtime.cpp:568)
7 libunity.so 0x00000078cac05f64 scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool)
8 libunity.so 0x00000078cac130e8 ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool)
9 libunity.so 0x00000078cac150a8 ScriptingInvocation::InvokeChecked(ScriptingExceptionPtr*)
10 libunity.so 0x00000078cac51368 SerializableManagedRef::CallMethod(Object&, ScriptingMethodPtr)
11 libunity.so 0x00000078cac2043c MonoBehaviour::CallAwake()
12 libunity.so 0x00000078cac20858 MonoBehaviour::AddToManager()
13 libunity.so 0x00000078cac203a4 MonoBehaviour::AwakeFromLoad(AwakeFromLoadMode)
14 libunity.so 0x00000078cac61078 AwakeFromLoadQueue::InvokeAwakeFromLoad(AwakeFromLoadQueue::Item*, unsigned int, AwakeFromLoadMode)
15 libunity.so 0x00000078cac60fa4 AwakeFromLoadQueue::AwakeFromLoadAllQueues(AwakeFromLoadMode, bool)
16 libunity.so 0x00000078caaec554 AwakeAndActivateClonedObjects(Object**, vector_map<int, int, std::__ndk1::less<int>, stl_allocator<std::__ndk1:air<int, int>, (MemLabelIdentifier)1, 16> > const&)
17 libunity.so 0x00000078caaecb64 CloneObject(Object&, Transform&, bool)

Looking further down the log (not shown here) it looks like it could have been triggered when text is assigned to the component, but can't say 100% for sure.

Disabling the notification stops the error, so I know it's related to that branch of code. But isolating it further is proving harder. It also crashes the process and hangs the OS for a while, so is proving problematic to debug on the device.

Any help would be much appreciated.

 

I have got a lot of similar crash reports on Crashlytic.

I'm using Unity 2021.2.8f1 & TextMeshPro 3.0.6

Code (CSharp):

1. Caused by java.lang.Error: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2. Version '2021.2.8f1 (d0e5f0a7b06a)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a'
3. Build fingerprint: 'Redmi/merlinnfc_ru/merlinnfc:11/RP1A.200720.011/V12.5.2.0.RJORUXM:user/release-keys'
4. Revision: '0'
5. ABI: 'arm64'
6. Timestamp: 2022-03-07 02:39:28+0300
7. pid: 25178, tid: 27972, name: Thread-666  >>> com.kotobagames.namelesscat <<<
8. uid: 10328
9. signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
10. Cause: null pointer dereference
11.     x0  0000007a40172d70  x1  0000000000000000  x2  000000792fcdb250  x3  0000000000000000
12.     x4  0000000000000001  x5  0000007a7b72faf5  x6  000000792fcdb270  x7  000000792fcdb220
13.     x8  0000000000000000  x9  0000000000000000  x10 0000000000000000  x11 0000000000000000
14.     x12 0000000000000000  x13 0000000000000000  x14 0000000000000000  x15 0000000000000000
15.     x16 0000007a7ba37b00  x17 0000007b7bb7c100  x18 00000078e12dc000  x19 00000079b0a01d00
16.     x20 0000000000000000  x21 0000000000000001  x22 000000792fcde000  x23 0000000000000000
17.     x24 0000000000000001  x25 0000000000000003  x26 00000079b01cf0e0  x27 0000000000000000
18.     x28 0000000000000000  x29 0000000000000000
19.     sp  000000792fcdb1c0  lr  0000007a7b184430  pc  0000007a7b184430
20. backtrace:
21.       #00 pc 00000000007c3430 (Mesh::CreateMesh() at ??:?)  /data/app/~~DMkeSUpC5Nhx3XOIK2c1Sw==/com.kotobagames.namelesscat-9EhwgvjBt9K7EKzPtuTnIg==/lib/arm64/libunity.so (BuildId: 0bd852a6f37b0e37013a46f61deaeedcd3b61067)
22.       #01 pc 00000000007c4de4 (Mesh::UploadMeshData(bool) at ??:?)  /data/app/~~DMkeSUpC5Nhx3XOIK2c1Sw==/com.kotobagames.namelesscat-9EhwgvjBt9K7EKzPtuTnIg==/lib/arm64/libunity.so (BuildId: 0bd852a6f37b0e37013a46f61deaeedcd3b61067)
23.       #02 pc 00000000007c50a0 (Mesh::AwakeFromLoad(AwakeFromLoadMode) at ??:?)  /data/app/~~DMkeSUpC5Nhx3XOIK2c1Sw==/com.kotobagames.namelesscat-9EhwgvjBt9K7EKzPtuTnIg==/lib/arm64/libunity.so (BuildId: 0bd852a6f37b0e37013a46f61deaeedcd3b61067)
24.       #03 pc 00000000000e5480 (Mesh_CUSTOM_Internal_Create(ScriptingBackendNativeObjectPtrOpaque*) at ??:?)  /data/app/~~DMkeSUpC5Nhx3XOIK2c1Sw==/com.kotobagames.namelesscat-9EhwgvjBt9K7EKzPtuTnIg==/lib/arm64/libunity.so (BuildId: 0bd852a6f37b0e37013a46f61deaeed<truncated: 5822 chars>
25.        at libunity.0x7c3430()
26.        at libunity.0x7c4de4()
27.        at libunity.0x7c50a0()
28.        at libunity.0xe5480()
29.        at libil2cpp.0x108d170()
30.        at libil2cpp.0x5bb19c()
31.        at libil2cpp.0x5baffc()
32.        at libunity.0x2c0d94()
33.        at libunity.0x2ce998()
34.        at libunity.0x2d0f8c()
35.        at libunity.0x315664()
36.        at libunity.0x2dd674()
37.        at libunity.0x2dda80()
38.        at libunity.0x2dd5dc()
39.        at libunity.0x316afc()
40.        at libunity.0x3169d8()
41.        at libunity.0x15455c()
42.        at libunity.0xefcc0()
43.        at libil2cpp.0x64d75c()
44.        at libil2cpp.0x636bc0()
45.        at libil2cpp.0x5bb19c()
46.        at libil2cpp.0x5baffc()
47.        at libil2cpp.0x5bb560()
48.        at libil2cpp.0x5b51a0()
49.        at libil2cpp.0xe0d8f0()
50.        at libil2cpp.0x10e55c0()
51.        at libil2cpp.0x10ea320()
52.        at libil2cpp.0x4cc1a0()
53.        at libil2cpp.0x5bb220()
54.        at libil2cpp.0x5baffc()
55.        at libunity.0x2c0d94()
56.        at libunity.0x2ce998()
57.  

 

Looks like it was a 'timing' issue.

I managed to work around it by yielding one frame (in my OpenNotification coroutinue) before the new notification object is instantiated.