Il2Cpp ReadOnlySpan feilds crash

Hey! We need help from somebody who knows the details about changes in ReadOnlySpan<byte> => new byte[] pattern in il2cpp in recent unity versions.

After upgrading to a new unity version (from 2021.3.2 to 2021.3.9 and then to 2022.1.16f1) we are seeing a crash in the Global Metadata CPP file when getting these ReadOnlySpan fields. Here is the full callstack for windows platform:

https://pastebin.com/seJ5LQfb

The build was compiled with minimal stripping. When we use the debug version of il2cpp we see the error that the fieldRefSize is out of bounds, and then a crash.



We are reading lots of different read only span values from different classes during serialization and deserialization, and everything goes ok for a while, but crashes eventually. Here is the example of fields we are using:

Spoiler: Code Spoiler

Code (CSharp):

1.  
2.  public sealed class JointObjectSaveDataFormatter : global::MessagePack.Formatters.IMessagePackFormatter<global::Game.SaveSystem.DataModels.Construction.JointObjectSaveData>
3.     {
4.         // ToObjectId
5.         private static global::System.ReadOnlySpan<byte> GetSpan_ToObjectId() => new byte[1 + 10] { 170, 84, 111, 79, 98, 106, 101, 99, 116, 73, 100 };
6.         // FromObjectId
7.         private static global::System.ReadOnlySpan<byte> GetSpan_FromObjectId() => new byte[1 + 12] { 172, 70, 114, 111, 109, 79, 98, 106, 101, 99, 116, 73, 100 };
8.         // ParentId
9.         private static global::System.ReadOnlySpan<byte> GetSpan_ParentId() => new byte[1 + 8] { 168, 80, 97, 114, 101, 110, 116, 73, 100 };
10.         // LocalTransformData
11.         private static global::System.ReadOnlySpan<byte> GetSpan_LocalTransformData() => new byte[1 + 18] { 178, 76, 111, 99, 97, 108, 84, 114, 97, 110, 115, 102, 111, 114, 109, 68, 97, 116, 97 };
12.         // IsWrongOrder
13.         private static global::System.ReadOnlySpan<byte> GetSpan_IsWrongOrder() => new byte[1 + 12] { 172, 73, 115, 87, 114, 111, 110, 103, 79, 114, 100, 101, 114 };
14.         // JointType
15.         private static global::System.ReadOnlySpan<byte> GetSpan_JointType() => new byte[1 + 9] { 169, 74, 111, 105, 110, 116, 84, 121, 112, 101 };
16.         // IfCanChangeType
17.         private static global::System.ReadOnlySpan<byte> GetSpan_IfCanChangeType() => new byte[1 + 15] { 175, 73, 102, 67, 97, 110, 67, 104, 97, 110, 103, 101, 84, 121, 112, 101 };
18.         // IfAlwaysFixed
19.         private static global::System.ReadOnlySpan<byte> GetSpan_IfAlwaysFixed() => new byte[1 + 13] { 173, 73, 102, 65, 108, 119, 97, 121, 115, 70, 105, 120, 101, 100 };
20.         // JointCells
21.         private static global::System.ReadOnlySpan<byte> GetSpan_JointCells() => new byte[1 + 10] { 170, 74, 111, 105, 110, 116, 67, 101, 108, 108, 115 };
22.         // JointSides
23.         private static global::System.ReadOnlySpan<byte> GetSpan_JointSides() => new byte[1 + 10] { 170, 74, 111, 105, 110, 116, 83, 105, 100, 101, 115 };
24.         // IfAlwaysReal
25.         private static global::System.ReadOnlySpan<byte> GetSpan_IfAlwaysReal() => new byte[1 + 12] { 172, 73, 102, 65, 108, 119, 97, 121, 115, 82, 101, 97, 108 };
26.         // IfMoving
27.         private static global::System.ReadOnlySpan<byte> GetSpan_IfMoving() => new byte[1 + 8] { 168, 73, 102, 77, 111, 118, 105, 110, 103 };
28.         // IndexInOtherJoints
29.         private static global::System.ReadOnlySpan<byte> GetSpan_IndexInOtherJoints() => new byte[1 + 18] { 178, 73, 110, 100, 101, 120, 73, 110, 79, 116, 104, 101, 114, 74, 111, 105, 110, 116, 115 };
30.         // IndexInMyJoints
31.         private static global::System.ReadOnlySpan<byte> GetSpan_IndexInMyJoints() => new byte[1 + 15] { 175, 73, 110, 100, 101, 120, 73, 110, 77, 121, 74, 111, 105, 110, 116, 115 };
32.         // IndexInOtherRealJoints
33.         private static global::System.ReadOnlySpan<byte> GetSpan_IndexInOtherRealJoints() => new byte[1 + 22] { 182, 73, 110, 100, 101, 120, 73, 110, 79, 116, 104, 101, 114, 82, 101, 97, 108, 74, 111, 105, 110, 116, 115 };
34. }

Here is how our call looks like from a cpp generated file:

Spoiler: il2cpp code

Code (CSharp):

1. IL2CPP_EXTERN_C IL2CPP_METHOD_ATTR ReadOnlySpan_1_tA850A6C0E88ABBA37646A078ACBC24D6D5FD9B4D LastUsedSaveDataContainerFormatter_GetSpan_Value_m6C903997D56582E16748B4F6400CFEEE2959503F (const RuntimeMethod* method)
2. {
3.     static bool s_Il2CppMethodInitialized;
4.     if (!s_Il2CppMethodInitialized)
5.     {
6.         il2cpp_codegen_initialize_runtime_metadata((uintptr_t*)&ReadOnlySpan_1__ctor_m470D1527EF015478E8677C7BCB52C8410A1DB604_RuntimeMethod_var);
7.         il2cpp_codegen_initialize_runtime_metadata((uintptr_t*)&U3CPrivateImplementationDetailsU3E_tDFF6183F1647CB4ABECDCF95F4E30358653AC416_StaticFields____FEE9E4E29E345D1FAF32A6AB1CEDB4769703E70A4688A5D122367C3AA8BC75FF_134_RVAStorage);
8.         s_Il2CppMethodInitialized = true;
9.     }
10.     {
11.         // private static global::System.ReadOnlySpan<byte> GetSpan_Value() => new byte[1 + 5] { 165, 86, 97, 108, 117, 101 };
12.         ReadOnlySpan_1_tA850A6C0E88ABBA37646A078ACBC24D6D5FD9B4D L_0;
13.         memset((&L_0), 0, sizeof(L_0));
14.         ReadOnlySpan_1__ctor_m470D1527EF015478E8677C7BCB52C8410A1DB604_inline((&L_0), (void*)((__StaticArrayInitTypeSizeU3D6_t7E0A8B1D1528CB0F606906B97D5BC2A8406346F9*)U3CPrivateImplementationDetailsU3E_tDFF6183F1647CB4ABECDCF95F4E30358653AC416_StaticFields____FEE9E4E29E345D1FAF32A6AB1CEDB4769703E70A4688A5D122367C3AA8BC75FF_134_RVAStorage), 6, /*hidden argument*/ReadOnlySpan_1__ctor_m470D1527EF015478E8677C7BCB52C8410A1DB604_RuntimeMethod_var);
15.         return L_0;
16.     }
17. }

The exact filed that fails varies depending on the platform, but consistent between runs within the one platform. Repo rate of the crash is 7/10 for windows and 10/10 for sony platforms (both ps4 and ps5).

We couldn't reproduce this crash in a separate small project yet, unfortunately.

 

Please file a bug report with the full project if possible and link this post

 

It's not possible, unfortunately.

 

Wow, cool! Thank you for your quick response. I've submitted a bug report, Case IN-17369, attached a dump file there, but its a sony platform dump file. Please let me know if you need windows-dump there as well, they don't seem to be generated every time =(

 

I managed to get it and send it to cqa-jira@unity3d.com with symbol files as an reply to an email about the bug case. Let me know if got it and if you need something else.

 

Hi!
We have same problem with il2cpp on android and MessagePack. Unity 2021.3.11f1
Crash on System.ReadOnlySpan<byte> method. Mono Android and il2cpp IOS works fine.

Spoiler: backtrace

2022.10.12 00:17:25.010 11793 11837 Error CRASH backtrace:
2022.10.12 00:17:25.010 11793 11837 Error CRASH #00 pc 0000000000a5f928 (il2cpp::vm::GlobalMetadata::GetMethodInfoFromMethodDefinitionIndex(int) at C:/Program Files/Unity/Hub/Editor/2021.3.11f1/Editor/Data/il2cpp/libil2cpp/vm/GlobalMetadata.cpp:139) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)
2022.10.12 00:17:25.010 11793 11837 Error CRASH #01 pc 0000000000a5ff98 (il2cpp::vm::GlobalMetadata::InitializeRuntimeMetadata(unsigned long*, bool) at C:/Program Files/Unity/Hub/Editor/2021.3.11f1/Editor/Data/il2cpp/libil2cpp/vm/GlobalMetadata.cpp:404) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)
2022.10.12 00:17:25.010 11793 11837 Error CRASH #02 pc 0000000000c52674 (AuthMessageResponseFormatter_GetSpan_ReproduceContext_mD7C358A5FD51265C7F9C3134632219A0B457E507 at C:/Users/Alex/Development/GitHub/game/Library/Bee/artifacts/Android/il2cppOutput/cpp/Assembly-CSharp15.cpp:9683) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)
2022.10.12 00:17:25.010 11793 11837 Error CRASH #03 pc 0000000000c52fe8 (AuthMessageResponseFormatter_Deserialize_m1629793AFF65FB01EC282B2A84AF2FE935CB4B33 at C:/Users/Alex/Development/GitHub/game/Library/Bee/artifacts/Android/il2cppOutput/cpp/Assembly-CSharp15.cpp:10142) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)
2022.10.12 00:17:25.010 11793 11837 Error CRASH #04 pc 0000000000c60b2c (BaseMessageFormatter_Deserialize_m560029A0F23F60EF33EA82D9713F3D9DFBD85947 at :?) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)
2022.10.12 00:17:25.010 11793 11837 Error CRASH #05 pc 00000000011e24e4 (InterfaceFuncInvoker2<Il2CppObject*, MessagePackReader_t238E166350BD38E3C9B9ED5E84CA48B4C689BEDC*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*>::Invoke(unsigned short, Il2CppClass*, Il2CppObject*, MessagePackReader_t238E166350BD38E3C9B9ED5E84CA48B4C689BEDC*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*) at C:/Users/Alex/Development/GitHub/game/Library/Bee/artifacts/Android/il2cppOutput/cpp/GenericMethods20.cpp:132) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)
2022.10.12 00:17:25.010 11793 11837 Error CRASH #06 pc 00000000011e31e8 (MessagePackSerializer_DeserializeFromSequenceAndRewindStreamIfPossible_TisRuntimeObject_mC4CB40A7BC94D64F06696042E54B0A15AACECA49_gshared at C:/Users/Alex/Development/GitHub/game/Library/Bee/artifacts/Android/il2cppOutput/cpp/GenericMethods20.cpp:27684) /data/app/com.CompanyName.Game-MTBYFtO0UiWQixwPO9CHyQ==/lib/arm64/libil2cpp.so (BuildId: 09c3efdf02e9edb81212e26da91287daa37baf10)

Code (CSharp):

1. // ReproduceContext
2.         private static global::System.ReadOnlySpan<byte> GetSpan_ReproduceContext() => new byte[1 + 16] { 176, 82, 101, 112, 114, 111, 100, 117, 99, 101, 67, 111, 110, 116, 101, 120, 116 };

I would really appreciate for any updates!

 

Make a bug report

 

Hello,

I have the exact same error which occurs only on Android (ex: Galaxy S10) + IL2CPP, after updating from 2021.3.9f1 to 2021.3.10f1

More info about the context

1. App launches a UnityWebRequest via a coroutine
2. The request succeed, payload is messagePack encoded
3. Crash during the deserialization of the payload
4. The crash is always in

   il2cpp:os::CpuInfo::Create()

5. it seems that when a method is called for the first time, IL2CPP calls InitializeRuntimeMetadata() then somewhere inside the code tries to get info about the cpu, causing an abort from libc.so

Here is the generated IL2CPP code crashing:

Code (CSharp):

1. static bool s_Il2CppMethodInitialized;
2. if (!s_Il2CppMethodInitialized)
3. {
4.   // crash here
5.   il2cpp_codegen_initialize_runtime_metadata((uintptr_t*)&ReadOnlySpan_1__ctor_m470D1527EF015478E8677C7BCB52C8410A1DB604_RuntimeMethod_var);
6.   il2cpp_codegen_initialize_runtime_metadata((uintptr_t*)&U3CPrivateImplementationDetailsU3E_t0F5473E849A5A5185A9F4C5246F0C32816C49FCA_StaticFields____A85C5F49F5F22C0EDEB0DCB39C4409CE26612BE5E8C64608DAB570DC283A99AC_128_RVAStorage);
7.   s_Il2CppMethodInitialized = true;
8. }

Also here is the full stack trace:

Code (CSharp):

1. libc.so (abort+176)
2. libil2cpp.so (il2cpp::os::CpuInfo::Create()) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
3. libil2cpp.so (il2cpp::vm::GlobalMetadata::GetMethodInfoFromMethodDefinitionIndex(int)+132) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
4. libil2cpp.so (GetMethodInfoFromEncodedIndex(unsigned int)+128) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
5. libil2cpp.so (il2cpp::vm::GlobalMetadata::InitializeRuntimeMetadata(unsigned long*, bool)+212) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
6. libil2cpp.so (il2cpp::vm::MetadataCache::InitializeRuntimeMetadata(unsigned long*)+32) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
7. libil2cpp.so (il2cpp_codegen_initialize_runtime_metadata(unsigned long*)+20) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
8. libil2cpp.so (NetworkManager_ServerSideMMParamsRequestDataFormatter_GetSpan_version_m7CC7BE992DD9C44492A105C0795AFC46C20416F1+52) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
9. libil2cpp.so (NetworkManager_ServerSideMMParamsRequestDataFormatter_Serialize_mCF08FD27BEA97AA1F3C601A7E4FA8CCF1D41DA61+396) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
10. libil2cpp.so (InterfaceActionInvoker3<MessagePackWriter_tAEB19098BDB46D2DDB7DD19FB9CC5A5649C1B172*, Il2CppObject*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*>::Invoke(unsigned short, Il2CppClass*, Il2CppObject*, MessagePackWriter_tAEB19098BDB46D2DDB7DD19FB9CC5A5649C1B172*, Il2CppObject*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*)+656) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
11. lib/arm64/libil2cpp.so (MessagePackSerializer_Serialize_TisRuntimeObject_m779EC6F1EBF91BD2448225E0073171B60E54EC40_gshared+2832) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
12. lib/arm64/libil2cpp.so (MessagePackSerializer_Serialize_TisRuntimeObject_m958A0A6BA73028F102E4045703451EC7DED52572_gshared+788) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
13. lib/arm64/libil2cpp.so (U3CCallU3Ed__10_2_MoveNext_mB0EC9AEDA93C777B676F28910F5B161AE2C290C8_gshared+1744) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
14. lib/arm64/libil2cpp.so (InterfaceFuncInvoker0<bool>::Invoke(unsigned short, Il2CppClass*, Il2CppObject*)+632) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
15. lib/arm64/libil2cpp.so (SetupCoroutine_InvokeMoveNext_m72FC77384CAC3133B6EE650E0581D055B34B2F5F+400) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
16. lib/arm64/libil2cpp.so (RuntimeInvoker_FalseVoid_t4861ACF8F4594C3437BB48B6E56783494B843915_RuntimeObject_IntPtr_t(void (*)(), MethodInfo const*, void*, void**, void*)+60) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
17. lib/arm64/libil2cpp.so (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**)+96) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
18. lib/arm64/libil2cpp.so (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**)+228) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
19. lib/arm64/libil2cpp.so (il2cpp_runtime_invoke+44) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
20. lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool)+164) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
21. lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool)+156) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
22. lib/arm64/libunity.so (Coroutine::InvokeMoveNext(ScriptingExceptionPtr*)+156) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
23. lib/arm64/libunity.so (Coroutine::Run(bool*)+44) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
24. lib/arm64/libunity.so (MonoBehaviour::TryCreateAndRunCoroutine(ScriptingObjectPtr, ScriptingMethodPtr, Coroutine**)+292) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
25. lib/arm64/libunity.so (MonoBehaviour::StartCoroutineManaged2(ScriptingObjectPtr)+68) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
26. lib/arm64/libunity.so (MonoBehaviour_CUSTOM_StartCoroutineManaged2(ScriptingBackendNativeObjectPtrOpaque*, ScriptingBackendNativeObjectPtrOpaque*)+228) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
27. lib/arm64/libil2cpp.so (MonoBehaviour_StartCoroutineManaged2_m55C19C5C5C65E9883E12101A46F37AB1172C73E8+92) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
28. lib/arm64/libil2cpp.so (MonoBehaviour_StartCoroutine_m4CAFF732AA28CD3BDC5363B44A863575530EC812+472) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
29. lib/arm64/libil2cpp.so (CloudFunctionService_CallCore_TisRuntimeObject_TisRuntimeObject_mCCC171458AD9DDDB5C7FA8B529211997D2C19890_gshared+540) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
30. lib/arm64/libil2cpp.so (CloudFunctionService_CallNamed_TisRuntimeObject_TisRuntimeObject_m3794D94858A7733AC27027A333772C3F5F792D24_gshared+236) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
31. lib/arm64/libil2cpp.so (CloudFunctionService_CallNamed_TisServerSideMMParamsRequestData_t2B51B8CDA3A0CE6894810C81EED852C4ABAB715D_TisServerSideMMParamsRequestData_t2B51B8CDA3A0CE6894810C81EED852C4ABAB715D_m4F9FCEDA371305E65C5106BA7A53E57E9A75BBAD(String_t*, ServerSideMMParamsRequestData_t2B51B8CDA3A0CE6894810C81EED852C4ABAB715D*, Action_1_tEF1C54DA1384E85A4C9FF6E1FB06C0AFF1F8CC4E*, MethodInfo const*)+52) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
32. lib/arm64/libil2cpp.so (NetworkManager_FetchMMFiltersFromCloud_mA7C76C001F2D7C5272BF725B821EF94FC5BC7AEF+1664) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
33. lib/arm64/libil2cpp.so (U3CIFetchMMFiltersU3Ed__161_MoveNext_mD171DEF2416BC3D26E29C9C9E5732F662C1086E4+1016) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
34. lib/arm64/libil2cpp.so (InterfaceFuncInvoker0<bool>::Invoke(unsigned short, Il2CppClass*, Il2CppObject*)+632) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
35. lib/arm64/libil2cpp.so (SetupCoroutine_InvokeMoveNext_m72FC77384CAC3133B6EE650E0581D055B34B2F5F+400) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
36. lib/arm64/libil2cpp.so (RuntimeInvoker_FalseVoid_t4861ACF8F4594C3437BB48B6E56783494B843915_RuntimeObject_IntPtr_t(void (*)(), MethodInfo const*, void*, void**, void*)+60) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
37. lib/arm64/libil2cpp.so (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**)+96) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
38. lib/arm64/libil2cpp.so (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**)+228) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
39. lib/arm64/libil2cpp.so (il2cpp_runtime_invoke+44) (BuildId: 7e2857b1349e437c208696b047f707beb02793ff)
40. lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool)+164) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)
41. lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool)+156) (BuildId: 36b24bbded95209a02895137812bdd4a1fff9144)

 

Find here another backtrace we have on our Android builds.
Unity2021.3.10f1 on arm64-v8a.
We have one library which rely heavily on 'global::System.ReadOnlySpan<byte>'

Code (CSharp):

1.      #00 pc 0000000000ae5714 (il2cpp::vm::GlobalMetadata::GetTypeInfoFromTypeIndex(int, bool) at C:/Program Files\Unity\Hub\Editor\2021.3.10f1\Editor\Data\il2cpp\libil2cpp\vm/GlobalMetadata.cpp:1582)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
2.       #01 pc 0000000000ae55ac (il2cpp::vm::GlobalMetadata::InitializeRuntimeMetadata(unsigned long*, bool) at C:/Program Files\Unity\Hub\Editor\2021.3.10f1\Editor\Data\il2cpp\libil2cpp\vm/GlobalMetadata.cpp:397)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
3.       #02 pc 0000000000da97c4 (SendEventResponseFormatter_GetSpan_ExternalEventResults_mAABDD4A075E1DFA3FC204C05454649094372F9CD at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/Fidelio-Framework11.cpp:23768)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
4.       #03 pc 0000000000daa244 (SendEventResponseFormatter_Deserialize_mA7DA5DC6D4F60D5C62B267A8A5643EFA0E346B08 at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/Fidelio-Framework11.cpp:24095)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
5.       #04 pc 0000000000929cf8 (RuntimeInvoker_TrueRuntimeObject_VoidU2A_t104EAEFBD2D237A8C29618913DA9B4D99355E965_RuntimeObject(void (*)(), MethodInfo const*, void*, void**, void*) at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/Il2CppInvokerTable.cpp:43457)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
6.       #05 pc 0000000000ffb610 (InterfaceActionInvoker3Invoker<MessagePackReader_t238E166350BD38E3C9B9ED5E84CA48B4C689BEDC*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*, void**>::Invoke(unsigned short, Il2CppClass*, Il2CppObject*, MessagePackReader_t238E166350BD38E3C9B9ED5E84CA48B4C689BEDC*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*, void**) at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/GenericMethods2.cpp:247)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
7.       #06 pc 0000000000ffbac8 (InvokerActionInvoker3<MessagePackReader_t238E166350BD38E3C9B9ED5E84CA48B4C689BEDC*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*, void**>::Invoke(void (*)(), MethodInfo const*, void*, MessagePackReader_t238E166350BD38E3C9B9ED5E84CA48B4C689BEDC*, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*, void**) at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/GenericMethods2.cpp:381)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
8.       #07 pc 0000000000ffac64 (InvokerActionInvoker4<ReadOnlyMemory_1_t63F301BF893B0AB689953D86A641168CA66D2399, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*, CancellationToken_t51142D9C6D7C02D314DA34A6A7988C528992FFED, void**>::Invoke(void (*)(), MethodInfo const*, void*, ReadOnlyMemory_1_t63F301BF893B0AB689953D86A641168CA66D2399, MessagePackSerializerOptions_t6356E2266D4FA5A0334004939D1C37D105B23356*, CancellationToken_t51142D9C6D7C02D314DA34A6A7988C528992FFED, void**) at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/GenericMethods2.cpp:408)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
9.       #08 pc 00000000010180b0 (Serialization_Deserialize_TisIl2CppFullySharedGenericAny_mE9C25A5715F4092A5E61ECAE3DCB0352438347C5_gshared at :?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
10.       #09 pc 0000000001209370 (InvokerFuncInvoker4<Il2CppObject*, String_t*, String_t*, String_t*, ByteU5BU5D_tA6237BF417AE52AD70CFB4EF24A7A82613DF9031*>::Invoke(void (*)(), MethodInfo const*, void*, String_t*, String_t*, String_t*, ByteU5BU5D_tA6237BF417AE52AD70CFB4EF24A7A82613DF9031*) at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/Generics7.cpp:608)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
11.       #10 pc 0000000001080148 (U3CRunRequestU3Ed__22_2_MoveNext_m2D90CCF5FE7002DFA23E5DFB3448AD223B87054E_gshared at :?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
12.       #11 pc 00000000020c0e4c (InterfaceFuncInvoker0<bool>::Invoke(unsigned short, Il2CppClass*, Il2CppObject*) at D:/My/Game/Library/Bee/artifacts/Android/il2cppOutput/cpp/UnityEngine.CoreModule3.cpp:97)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
13.       #12 pc 0000000000a4f138 (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**) at C:/Program Files\Unity\Hub\Editor\2021.3.10f1\Editor\Data\il2cpp\libil2cpp\vm/Runtime.cpp:576)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
14.       #13 pc 0000000000a4ef98 (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) at C:/Program Files\Unity\Hub\Editor\2021.3.10f1\Editor\Data\il2cpp\libil2cpp\vm/Runtime.cpp:562)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libil2cpp.so (BuildId: 0b1b8a8895a3b1390c2fb920e0f774bf50c96552)
15.       #14 pc 00000000003e818c (SceneLoadedAfterAwake(int, AwakeFromLoadQueue&, SceneLoadingMode) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
16.       #15 pc 00000000003f6034 (ShaderScripting::SetGlobalConstantBuffer(int, GraphicsBuffer*, int, int) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
17.       #16 pc 0000000000402a58 (Texture::ReloadAll(bool, bool, bool, bool) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
18.       #17 pc 0000000000402634 (Texture::Texture(MemLabelId, ObjectCreationMode) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
19.       #18 pc 00000000002f42f4 (Terrain_Set_Custom_PropGroupingID(ScriptingBackendNativeObjectPtrOpaque*, int) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
20.       #19 pc 00000000005cdafc (void std::__ndk1::__sort<std::__ndk1::__less<ObjectLoadData, ObjectLoadData>&, ObjectLoadData*>(ObjectLoadData*, ObjectLoadData*, std::__ndk1::__less<ObjectLoadData, ObjectLoadData>&) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
21.       #20 pc 00000000005ce7b4 (bool std::__ndk1::__insertion_sort_incomplete<std::__ndk1::__less<ObjectLoadData, ObjectLoadData>&, ObjectLoadData*>(ObjectLoadData*, ObjectLoadData*, std::__ndk1::__less<ObjectLoadData, ObjectLoadData>&) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
22.       #21 pc 00000000002e7338 (BuoyancyEffector2D_Get_Custom_PropFlowVariation(ScriptingBackendNativeObjectPtrOpaque*) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
23.       #22 pc 00000000003081a4 (TilemapCollider2D_CUSTOM_ProcessTilemapChanges(ScriptingBackendNativeObjectPtrOpaque*) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
24.       #23 pc 00000000003081e4 (TilemapCollider2D_CUSTOM_ProcessTilemapChanges(ScriptingBackendNativeObjectPtrOpaque*) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
25.       #24 pc 000000000030841c (Marshalling::ContainerFromArray<Marshalling::UnityObjectArrayElement<Object>, PPtr<Object>, Marshalling::UnityObjectArrayElement<Object>, true>::Marshal(dynamic_array<PPtr<Object>, 0ul>&, ScriptingArrayPtr, ScriptingExceptionPtr*) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
26.       #25 pc 0000000000473e2c (GetSceneBuildInfo(core::basic_string<char, core::StringStorageDefault<char> > const&, int, SceneBuildInfo&) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
27.       #26 pc 000000000048a56c (ShaderPropertySheet::SetInt(ShaderLab::FastPropertyName, int, ShaderPropertySheet::SetFlags) at ??:?)  /data/app/com.my.game-mjFlZHnLs0ZFhcpggObkyA==/lib/arm64/libunity.so (BuildId: 025888516122ffc4ec00bc3227cd32d6b611731f)
28.  

 

Hi Josh, do you have any follow up or bug tracking url for this investigation? thank you

 

ok thanks for your answer. Can we expect it for 2021.3.14f1?

 

Hi, is it fixed in Unity2021.3.12f1?

 

Exactly the same issue. We use MessagePack, too~

 

Code (Log):

1. Fatal Exception: Tombstone :  Version '2021.3.11f1 (0a5ca18544bf)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a'
2. Build fingerprint: 'Xiaomi/star_global/star:12/SKQ1.211006.001/V13.0.4.0.SKAMIXM:user/release-keys'
3. Revision: '0'
4. ABI: 'arm64'
5. Timestamp: 2022-10-27 19:39:04+0800
6. pid: 23460, tid: 23558, name: UnityMain  >>> com.bitfungame.destiny <<<
7. uid: 10615
8. signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7d712e97a8
9.     x0  000000000754ab8d  x1  0000000000000001  x2  0000007d36695518  x3  0000007bde46bfc0
10.     x4  0000007d2dd01310  x5  0000007d2dd01310  x6  0000007d2dd00ac0  x7  0000007bf19c7040
11.     x8  0000007d36893b40  x9  0000007d2cdc6aa9  x10 0000007d2a238748  x11 0000000000000000
12.     x12 0000000000000018  x13 0000000000000005  x14 0000007bde46c000  x15 0000000000000000
13.     x16 0000007d2d9cf928  x17 0000007e76754eb4  x18 0000007ca0eaa678  x19 000000000754ab8d
14.     x20 0000007c6ea9571b  x21 0000007d2dd00000  x22 0000007d2c98f0e6  x23 0000000000000005
15.     x24 0000007d2dbfa0d8  x25 0000007d2dbf7668  x26 0000000000000000  x27 0000007d2dbf2c58
16.     x28 0000000000000009  x29 0000007db8381022
17.     sp  0000007d505fa5f0  lr  0000007d2a238750  pc  0000007d2a2380b4
18.  
19.  
20. #00 pc 0xd370b4 libil2cpp.so (il2cpp::vm::GlobalMetadata::GetMethodInfoFromMethodDefinitionIndex(int) [GlobalMetadata.cpp:136])
21. #01 pc 0xd3774c libil2cpp.so (il2cpp::vm::GlobalMetadata::InitializeRuntimeMetadata(unsigned long*, bool) [GlobalMetadata.cpp:404])
22. #02 pc 0x180fc88 libil2cpp.so
23. #03 pc 0x1810564 libil2cpp.so
24. #04 pc 0x1434250 libil2cpp.so (MessagePackSerializer_Deserialize_TisRuntimeObject_m5140E1AAEC42BBA535EAB51D3B22E586C3A54142_gshared [GenericMethods38.cpp:154])
25. #05 pc 0x14345b0 libil2cpp.so (MessagePackSerializer_Deserialize_TisRuntimeObject_mE5078C508FFCB3C7B8F35BF27D79A0CA67CC1E40_gshared [GenericMethods38.cpp:26464])
26. #06 pc 0x10222d8 libil2cpp.so
27. #07 pc 0x2a44020 libil2cpp.so
28. #08 pc 0xce3f08 libil2cpp.so (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**) [Runtime.cpp:576])
29. #09 pc 0xce3d68 libil2cpp.so (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) [Runtime.cpp:562])
30. #10 pc 0x5605f4 libunity.so
31. #11 pc 0x56e79c libunity.so
32. #12 pc 0x57b2e8 libunity.so
33. #13 pc 0x57aec4 libunity.so
34. #14 pc 0x447b7c libunity.so
35. #15 pc 0x7cbef0 libunity.so
36. #16 pc 0x7ccc70 libunity.so
37. #17 pc 0x43a6e0 libunity.so
38. #18 pc 0x45bc8c libunity.so
39. #19 pc 0x45bccc libunity.so
40. #20 pc 0x45bf04 libunity.so
41. #21 pc 0x5f45b4 libunity.so
42. #22 pc 0x60b838 libunity.so
43. #23 pc 0x440554 libart.so (art_quick_generic_jni_trampoline + 148)
44. #24 pc 0x20a2b0 libart.so (nterp_helper + 4016)
45. #25 pc 0x209334 libart.so (nterp_helper + 52)
46. #26 pc 0x20b074 libart.so (nterp_helper + 7540)
47. #27 pc 0x201672c memfd:jit-cache

Crash View in Firebase console:

 

So, maybe we can get the fix in one month?(If you publish a latest LTS version every two weeks)

 

Sounds great! Long for it!

 

Hello, is there any beta version for 2021.3.14? I can test it for you.

 

Updates:
We tried Unity versions from 2021.3.2f1 to 2021.3.11f1.
Unity 2021.3.6f1 is the last version that dont crash with this issue.
But they have another critical issue on Android when targeting to Android 12 or above(android phone permissions issue)
Downgrade failed.

 

What worked for us as a solution, we stopped using read only span values in message pack completely, changed our keys to integer values. Message pack supports two types of mapping, and only strings are bugged.

 

Fantastic!

 

Encountered this same problem on 2022.2.0b11 building for Magic Leap 2 (Android) device and using MessagePack. Working around the crash for now by using integer keys for any MessagePack objects that have strings in them.

Spent a week trying various things (unsuccessfully) until I found this thread.

 

We are still waiting for the new release that fixes this issue.

 

Hi there,

I think we've run into this problem as well in our Android 64bit IL2CPP build.

We're currently using Unity 2021.3.13f1 and are also using MessagePack for serialisation.

Code (CSharp):

1. #00 pc 00000000009eeacc GetGenericMethodFromIndex(int)
2. #01 pc 00000000009ee5ec GetMethodInfoFromEncodedIndex(unsigned int)
3. #02 pc 00000000009ee408 il2cpp::vm::GlobalMetadata::InitializeRuntimeMetadata(unsigned long*, bool)
4. #03 pc 0000000000fdf36c FTUEFlowProgressFormatter_GetSpan_Started_m8A1E34F86F0642E91D559451FD178257F5D4CCE6
5. #04 pc 0000000000fdf574 FTUEFlowProgressFormatter_Serialize_m6E362B2A46F7274E0C88BD39C9C80D809DB03613
6. #05 pc 000000000119f144 DictionaryFormatterBase_5_Serialize_mA6F737D7597CB93BCAF065876B356B9B71E4CBC5_gshared
7. #06 pc 0000000001f73ca8 MessagePackSerializer_Serialize_TisRuntimeObject_mF8C1C403A6547DEDA612B0E76FCAA6754329CBA7_gshared
8. #07 pc 0000000001f73a44 MessagePackSerializer_Serialize_TisRuntimeObject_m7B4324D570103332A58C6B2324291D6CCC81A5B1_gshared
9. #08 pc 0000000001f70530 MessagePackSave_EncapsulateData_TisRuntimeObject_m72FD8ACCE0DC8EAC57F5CFC19A46C3D4907E2EAE_gshared

Was there any news on the fix for this being released?

Many thanks

Steve

 

Thanks @JoshPeterson!

 

There is at least one IL2CPP fix in Unity 2022.2.0b16 changelog that seems to match with some similar fixes in 2021.3.14. Does that mean this version has the same fix for this issue?

https://unity.com/releases/editor/beta/2022.2.0b16

 

I think it is

Code (CSharp):

1. IL2CPP: Fixed crash in IL2CPP metadata code when loading a field RVA value (UUM-17473)

 

Fantastic!