Bug [libil2cpp.so] Method.cpp - il2cpp::vm::Method::GetParamCount(MethodInfo const*) crash in android

Facing a lot of crashes in android with this.
Unity Version : 2021.3.14f1
SDKs in Use : Firebase (Latest) - Analytics , RemoteConfig , Crashyltics , IronSource(Latest) - Meditated Networks (Admob , Unity , Ironsource , AppLovin , Chartboost)

StackTrace :
[libil2cpp.so] Method.cpp - il2cpp::vm::Method::GetParamCount(MethodInfo const*)
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 20101 >>> com.openworldgames.IndianBikes3D <<<

backtrace:
#00 pc 0x00000000005ceed8 /data/app/~~9HgU7es88SE_-tqQVlVDVg==/com.openworldgames.IndianBikes3D-HFyEQcpk_Yumkw5QdcrLwQ==/lib/arm64/libil2cpp.so (il2cpp::vm::Method::GetParamCount(MethodInfo const*)+88)
#01 pc 0x00000000005672c4 /data/app/~~9HgU7es88SE_-tqQVlVDVg==/com.openworldgames.IndianBikes3D-HFyEQcpk_Yumkw5QdcrLwQ==/lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool))
#02 pc 0x00000000005754cc /data/app/~~9HgU7es88SE_-tqQVlVDVg==/com.openworldgames.IndianBikes3D-HFyEQcpk_Yumkw5QdcrLwQ==/lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool))
#03 pc 0x000000000021b57c /data/app/~~9HgU7es88SE_-tqQVlVDVg==/com.openworldgames.IndianBikes3D-HFyEQcpk_Yumkw5QdcrLwQ==/lib/arm64/libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long, _jstring*, _jobjectArray*))
#04 pc 0x0000000000461554 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+148)
#05 pc 0x0000000000209a9c /apex/com.android.art/lib64/libart.so (nterp_helper+1948)
#06 pc 0x0000000000209334 /apex/com.android.art/lib64/libart.so (nterp_helper+52)
#07 pc 0x0000000000570924 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat

StackTrace(Crashlytics):
scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool)

libunity.so
scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool)

Sample crash data :

 

Please help this is urgent

 

Unfortunately @JoshPeterson, our teams have struggled to reliably reproduce this one locally too. Triggering it seems to be contingent on one or more entropic factors, perhaps OS load or system memory. We're currently tethered to Unity 2020.3.48.

Despite this, it *is* impacting thousands of our users. Live user data is currently our only null test. We're still under threshold, but obviously we'd rather not have this crash ;P

We only have a few leads:

1. Downgrading IronSource-Unity from 7.3 to 7.2 resolves the issue. Upgrading again reintroduces it (and we've already told them this too).
2. We see half the variants include the line "UnityJavaProxy_invoke" towards the beginning. We think this maps to `UnityEngine.AndroidJavaProxy`. These variants are SIGSEGV w/ fault address 0x2a (byte offset 42).
3. The other half are less symbolicated, with stackframes originating in libart.so or boot.oat before hitting libunity.so "scripting_method_invoke(...)" -> libil2cpp.so "il2cpp::vm::Method::GetParamCount(...)" -> crash. These are SIGSEGVs w/ fault address 0x4a (byte offset 74).

 

After hearing from some peers that this issue went away after they upgraded to Unity 2021+ LTS, I flipped through some changelogs and found this item (intro'd 2021.3.19):

• Android: Fixed crash if Java proxy is invoked at the same time as Unity is quit. (UUM-15968)

Based on this information and what I've seen in the crash trace patterns, this particular changelog item seems to be extremely relevant, if not ascribing the root bug fix for this issue.

@JoshPeterson, you and your colleagues are much more privy to the internals than we are—does this track?

Aside: We weren't planning on leaving Unity 2020, but if it's the only way to maintain stability w/ IronSource mediation and there's really no other alternative...
... I guess we'll just be grateful to be able to put this "crash mania" to bed haha.

 

That's a shame. Thank you for looking into it for me.

Related question: If a UUM reference doesn't have a bug tracker link, is it tracked completely internally? Or is there a way for a member of the public like myself to read up on those issues? (Only asking here because asking search engines yielded no insights.)

 

Our team is experiencing the same issue, we have many reports in addition to the one in the first message of this thread. We also have the following information from the Google console.

Code (stack):

1. java.lang.Error
2. Exception java.lang.Error: FATAL EXCEPTION [main]
3. Unity version     : 2021.3.13f1
4. Device model      : INFINIX MOBILITY LIMITED Infinix X688B
5. Device fingerprint: Infinix/X688B-GL/Infinix-X688B:11/RP1A.200720.011/221214V856:user/release-keys
6. Build Type        : Release
7. Scripting Backend : IL2CPP
8. ABI               : arm64-v8a
9. Strip Engine Code : true
10.  
11. Caused by: java.lang.reflect.UndeclaredThrowableException
12.   at $Proxy25.onConnectSuccess
13.   at com.tapjoy.internal.c6.a (SourceFile:45)
14.   at com.tapjoy.internal.q4.a (SourceFile:36)
15.   at com.tapjoy.Tapjoy.connect (SourceFile:7)
16.   at com.tapjoy.TapjoyConnectUnity$12.run (TapjoyConnectUnity.java:423)
17.   at android.os.Handler.handleCallback (Handler.java:938)
18.   at android.os.Handler.dispatchMessage (Handler.java:99)
19.   at android.os.Looper.loop (Looper.java:268)
20.   at android.app.ActivityThread.main (ActivityThread.java:8016)
21.   at java.lang.reflect.Method.invoke
22.   at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run (RuntimeInit.java:627)
23.   at com.android.internal.os.ZygoteInit.main (ZygoteInit.java:997)
24. Caused by java.lang.reflect.InvocationTargetException:
25.   at java.lang.reflect.Method.invoke
26.   at com.tapjoy.internal.o5.invoke (SourceFile:2)
27.   at java.lang.reflect.Proxy.invoke (Proxy.java:1006)
28. Caused by java.lang.Error: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
29. Version '2021.3.13f1 (9e7d58001ecf)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a'
30. Build fingerprint: 'Infinix/X688B-GL/Infinix-X688B:11/RP1A.200720.011/221214V856:user/release-keys'
31. Revision: '0'
32. ABI: 'arm64'
33. Timestamp: 2023-08-18 00:44:34+0800
34. pid: 24630, tid: 25100, name: unityCallBackTh  >>> com.company.game <<<
35. uid: 10351
36. signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x52
37. Cause: null pointer dereference
38.     x0  0000000000000000  x1  0000000000000000  x2  00000071beb801d0  x3  00000071beb80300
39.     x4  0000000000000000  x5  0000000000000004  x6  b40000763798ecd0  x7  b400007637990a50
40.     x8  000000755d21eddc  x9  0000000000000001  x10 0000000000000001  x11 0000000000000000
41.     x12 0000000000000001  x13 0000000000000001  x14 0100000000000000  x15 00000075ea64be70
42.     x16 000000755fb35c58  x17 000000789c748f70  x18 00000071b427c000  x19 00000071beb80300
43.     x20 0000000000000000  x21 0000000000000000  x22 00000071beb801d0  x23 0000000000000003
44.     x24 0000000000000000  x25 00000071beb82000  x26 0000000000000016  x27 0000000000000004
45.     x28 0000000000000000  x29 00000071beb80430
46.     sp  00000071beb80140  lr  00000075747402ec  pc  000000755d245a68
47.  
48. backtrace:
49.       #00 pc 0000000000a74a68  /data/app/~~B7TffWYE_gX0cwfXRG_JNg==/com.company.game-8s8xYyUbc-_FBW68K-LGOw==/lib/arm64/libil2cpp.so (BuildId: a49fa085817708e6b73bd3ba8d95d971e2275359)
50.       #01 pc 00000000002fb2e8  /data/app/~~B7TffWYE_gX0cwfXRG_JNg==/com.company.game-8s8xYyUbc-_FBW68K-LGOw==/lib/arm64/libunity.so (BuildId: e258f2a38a41b53c64e9d5ecaae580eb9bc4f4d4)
51.       #02 pc 0000000000309fdc  /data/app/~~B7TffWYE_gX0cwfXRG_JNg==/com.company.game-8s8xYyUbc-_FBW68K-LGOw==/lib/arm64/libunity.so (BuildId: e258f2a38a41b53c64e9d5ecaae580eb9bc4f4d4)
52.       #03 pc 0000000000119558  /data/app/~~B7TffWYE_gX0cwfXRG_JNg==/com.company.game-8s8xYyUbc-_FBW68K-LGOw==/lib/arm64/libunity.so (BuildId: e258f2a38a41b53c64e9d5ecaae580eb9bc4f4d4)
53.       #04 pc 00000000000e4a10  /data/app/~~B7TffWYE_gX0cwfXRG_JNg==/com.company.game-8s8xYyUbc-_FBW68K-LGOw==/oat/arm64/base.odex
54.   at libil2cpp
55.   at libunity
56.   at libunity
57.   at libunity
58.   at base

 

I'm also seeing this crash in Unity 2021.3.29 - We're using Unity LevelPlay with AdMob, Unity, & Ironsrc.

 

Any updates?

 

Updates?

 

@JoshPeterson I think there's a really big clue in the function that is crashing...
It's always a Java proxy callback with one of the following two signatures...

Now there just can't be too many functions with such a specific sig of

(Object, long, string, array)

(UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long long, _jstring*, _jobjectArray*)+50884608)

(UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long, _jstring*, _jobjectArray*)+50884608)

There's no function in our game which matches, so it's inside Unity somewhere.

I've actually shipped a build now withouth LevelPlay and just UnityAds, and the crash still happens, but maybe 1/10th as often which is strange...

 

It seems some data used in the

UnityJavaProxy_invoke

is initialized lazily. If

UnityJavaProxy_invoke

is called from multiple threads simultaneously, there is a race condition. Based on it, I created a minimal reproduction project, which can reproduce a similar crash in Unity 2021.3.28:

The project has been submitted to Unity: IN-53993.

Before the issue gets fixed, there seems to be a workaround: invoking AndroidJavaProxy once to make sure the internal data is initialized before multiple thread code is running.

The attached zip contains the reproduction project and the workaround, which is in the line 41 in Test.cs.

Reproduction steps:

1. Switch to Android platform
2. Open "SampleScene.unity"
3. Build and install to a Android device
4. Open a Command Prompt and run "adb logcat -s CRASH"
5. Open another Command Prompt and run auto_test.bat (It might need to change the path of adb.exe in the script)
6. Wait the application to crash (It might take a few minutes)

 

This is fantastic work! Here's hoping Unity can ship a fix for it ASAP!

 

@Alan-Liu , would the workaround do the trick globally or individually for each proxied sig?

 

Since the internal data is used globally (by all AndroidJavaProxy), I think the workaround works globally: you only need to invoke AndroidJavaProxy once at the start-up time. For example:

Code (CSharp):

1. public class LaunchScene : MonoBehaviour
2. {
3.     void Awake()
4.     {
5.         // Invoke AndroidJavaProxy once before initializing plugins
6.        
7.         // Initialize plugins
8.     }
9. }

 

Unity QA reproduced the issue: https://issuetracker.unity3d.com/is...oidjavaproxy-is-calling-from-multiple-threads

 

@Alan-Liu Will it work if my stack trace looks something like this


My Problem:
A ton of crashes are reported every single day labelled as SIGSEGV.
( [libil2cpp.so
SIGSEGV )


Unbearable amount of crashes reported every 1 out of 10 downloads.

The Ram Size and Android API level doesn't have any impact on the crashes.
Unable to reproduce locally and this is my first time facing such an issue, any help is welcome.


Crashes are somehow in direct relation with AppLovin SDK (I am only using this plugin) and Incremental GC feature of Unity.
If incremental GC is on, I see crashes
If incremental GC is off. I see ANRs
If I remove AppLovin SDK, no crashes are reported.
If I only stop the ShowInterstitial function (using API as a switch), No crashes are reported. Meaning Loading an AD or the plugin it self isn't the issue.

Upgrading unity or updating the plugin does not have any impact on crashes


P.S. Why I am writing here? Because AppLovin's support is putting this issue in Unity's basket.
I am asked to used the workaround mentioned above but I think I lack the necessary skills to deal with AndroidJavaProxy. How can I control the crashes since the app is above bad threshold of play store because of this (0.30% increment each day).

Code (CSharp):

1. *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2. pid: 0, tid: 21414 >>> com.zigZag.zuu <<<
3.  
4. backtrace:
5.   #00  pc 0x00000000006b019c  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/lib/arm/libil2cpp.so
6.   #01  pc 0x00000000003041ad  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/lib/arm/libunity.so
7.   #02  pc 0x000000000030fa91  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/lib/arm/libunity.so
8.   #03  pc 0x000000000019c9e7  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/lib/arm/libunity.so
9.   #04  pc 0x000000000001c5fd  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/oat/arm/base.odex (art_jni_trampoline+156)
10.   #05  pc 0x00000000000d7bc5  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_stub_internal+68)
11.   #06  pc 0x0000000000436ac9  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_static_stub+248)
12.   #07  pc 0x00000000000dffff  /apex/com.android.runtime/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+198)
13.   #08  pc 0x00000000002136fd  /apex/com.android.runtime/lib/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+280)
14.   #09  pc 0x000000000020f015  /apex/com.android.runtime/lib/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+716)
15.   #10  pc 0x000000000042e18d  /apex/com.android.runtime/lib/libart.so (MterpInvokeStatic+348)
16.   #11  pc 0x00000000000d2994  /apex/com.android.runtime/lib/libart.so (mterp_op_invoke_static+20)
17.   #12  pc 0x00000000004bda90  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/oat/arm/base.vdex (com.unity3d.player.ReflectionHelper.-$$Nest$smnativeProxyInvoke)
18.   #13  pc 0x000000000042e3d5  /apex/com.android.runtime/lib/libart.so (MterpInvokeStatic+932)
19.   #14  pc 0x00000000000d2994  /apex/com.android.runtime/lib/libart.so (mterp_op_invoke_static+20)
20.   #15  pc 0x00000000004bd87a  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/oat/arm/base.vdex (com.unity3d.player.ReflectionHelper$a.invoke+58)
21.   #16  pc 0x00000000001eea01  /apex/com.android.runtime/lib/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13441198129006899262)+192)
22.   #17  pc 0x00000000001f31f3  /apex/com.android.runtime/lib/libart.so (art::interpreter::EnterInterpreterFromEntryPoint(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*)+126)
23.   #18  pc 0x000000000042049d  /apex/com.android.runtime/lib/libart.so (artQuickToInterpreterBridge+852)
24.   #19  pc 0x00000000000dc5a1  /apex/com.android.runtime/lib/libart.so (art_quick_to_interpreter_bridge+32)
25.   #20  pc 0x0000000000446965  /system/framework/arm/boot.oat (java.lang.reflect.Proxy.invoke+68)
26.   #21  pc 0x00000000000d7bc5  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_stub_internal+68)
27.   #22  pc 0x0000000000436ac9  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_static_stub+248)
28.   #23  pc 0x00000000000dffff  /apex/com.android.runtime/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+198)
29.   #24  pc 0x0000000000377b0b  /apex/com.android.runtime/lib/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+54)
30.   #25  pc 0x0000000000378551  /apex/com.android.runtime/lib/libart.so (art::InvokeWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+292)
31.   #26  pc 0x00000000002b7acf  /apex/com.android.runtime/lib/libart.so (art::JNI::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+462)
32.   #27  pc 0x0000000000406fc1  /apex/com.android.runtime/lib/libart.so (art::InvokeProxyInvocationHandler(art::ScopedObjectAccessAlreadyRunnable&, char const*, _jobject*, _jobject*, std::__1::vector<jvalue, std::__1::allocator<jvalue>>&)+408)
33.   #28  pc 0x00000000004211c1  /apex/com.android.runtime/lib/libart.so (artQuickProxyInvokeHandler+844)
34.   #29  pc 0x00000000000dc375  /apex/com.android.runtime/lib/libart.so (art_quick_proxy_invoke_handler+20)
35.   #30  pc 0x00000000000d7bc5  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_stub_internal+68)
36.   #31  pc 0x00000000004369b5  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_stub+252)
37.   #32  pc 0x00000000000dffeb  /apex/com.android.runtime/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+178)
38.   #33  pc 0x00000000002136fd  /apex/com.android.runtime/lib/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+280)
39.   #34  pc 0x000000000020f015  /apex/com.android.runtime/lib/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+716)
40.   #35  pc 0x000000000042d08f  /apex/com.android.runtime/lib/libart.so (MterpInvokeInterface+814)
41.   #36  pc 0x00000000000d2a14  /apex/com.android.runtime/lib/libart.so (mterp_op_invoke_interface+20)
42.   #37  pc 0x0000000000427e5c  /data/app/com.zigZag.zuu-goZj4mUIsbaGRB5NqNvPmA==/oat/arm/base.vdex (com.applovin.mediation.unity.MaxUnityAdManager$19.run+28)
43.   #38  pc 0x00000000001eea01  /apex/com.android.runtime/lib/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13441198129006899262)+192)
44.   #39  pc 0x00000000001f31f3  /apex/com.android.runtime/lib/libart.so (art::interpreter::EnterInterpreterFromEntryPoint(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*)+126)
45.   #40  pc 0x000000000042049d  /apex/com.android.runtime/lib/libart.so (artQuickToInterpreterBridge+852)
46.   #41  pc 0x00000000000dc5a1  /apex/com.android.runtime/lib/libart.so (art_quick_to_interpreter_bridge+32)
47.   #42  pc 0x0000000000526321  /system/framework/arm/boot.oat (java.util.concurrent.Executors$RunnableAdapter.call+56)
48.   #43  pc 0x00000000007123b5  /system/framework/arm/boot.oat (java.util.concurrent.FutureTask.run+196)
49.   #44  pc 0x000000000093fbd7  /system/framework/arm/boot.oat (java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run+118)
50.   #45  pc 0x0000000000852c87  /system/framework/arm/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+1014)
51.   #46  pc 0x000000000084fac7  /system/framework/arm/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+54)
52.   #47  pc 0x0000000000433469  /system/framework/arm/boot.oat (java.lang.Thread.run+64)
53.   #48  pc 0x00000000000d7bc5  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_stub_internal+68)
54.   #49  pc 0x00000000004369b5  /apex/com.android.runtime/lib/libart.so (art_quick_invoke_stub+252)
55.   #50  pc 0x00000000000dffeb  /apex/com.android.runtime/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+178)
56.   #51  pc 0x0000000000377b0b  /apex/com.android.runtime/lib/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+54)
57.   #52  pc 0x0000000000378893  /apex/com.android.runtime/lib/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+306)
58.   #53  pc 0x00000000003a99cf  /apex/com.android.runtime/lib/libart.so (art::Thread::CreateCallback(void*)+986)
59.   #54  pc 0x00000000000a69b7  /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+20)
60.   #55  pc 0x00000000000601af  /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30)

 

Since the callstack wasn't fully symbolicated, I'm not sure if it's the same issue with the one I reproduced.

You can take a look at the reproduction project in the attachment and use it as an example to implement the workaround in your project.

 

I can confirm that the issue might not be the same because I tried the attached project by @Alan-Liu and my application does not crash on start.

Can someone tell me how I can Symbolicate the stack Track? or please direct me where you think my issue is relevant.


To give you more insights that can help, I tried 2 apk from your attached project and both of them crashed.
1 - with Line 41 commented of Test.cs - Results : crash on start after unity splash
2- With Line 41 uncommented of Test.cs - Results : crash on start after unity splash

 

You need to upload the symbols so that the platform can symbolicate the crash for you. Here are the documentation:

• https://docs.unity3d.com/Manual/android-symbols.html
  
• https://support.google.com/googleplay/android-developer/answer/9848633?hl=en

It's strange. I couldn't reproduce the crash when Line 41 was uncommented. Can you post the symbolicated callstack of the crash when Line 41 is uncommented?

To get the symbolicated callstack locally, you need:

• generate the debug/public symbols as the documentation said
• use "adb logcat -s CRASH" to get the callstack of the crash
• use StackTrace Utility in Android Logcat package to symbolicate

 

@Alan-Liu As much as I wanna help. Unfortunately I currently have no cable available.
All I can tell that I am using Android 13 and it crashed both of the times. (with comment and uncomment)



Are you not seeing any crashes in the console (if its only play store) after invoking AndroidJavaProxy?

 

@hassan_farooqkhan Our game isn't experiencing this crash, so I can't confirm the workaround works in a real project. I just reproduced the crash and used the reproduction project to test the workaround.

BTW, which version of Unity did you use to build the reproduction project?

 

@Alan-Liu I used 2023.1.14f1 to make two APK files, one with commented and one with uncommented workaround lines.
I gave it a try on Android 13, both APK crashed for me (even before SPLASH)



I also uploaded the symbols.zip on play store and my one SIGSEGV error is switched to 3 (I guess due to more details attached)

1- [libil2cpp.so] Method.cpp - il2cpp::vm::Method::GetParamCount(MethodInfo const*)

2- [libil2cpp.so] Method.cpp - il2cpp::vm::Method::GetParamCount(MethodInfo const*)

3- [libil2cpp.so] GlobalMetadata.cpp - il2cpp::vm::GlobalMetadata::GetMethodInfoFromMethodHandle(___Il2CppMetadataMethodHandle const*)





STACK TRACES FROM PLAY CONSOLE





1- [libil2cpp.so] Method.cpp - il2cpp::vm::Method::GetParamCount(MethodInfo const*)

Code (CSharp):

1. *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2. pid: 0, tid: 11020 >>> com.zigZag.zuu <<<
3.  
4. backtrace:
5.   #00  pc 0x0000000000cbc960  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/lib/arm64/libil2cpp.so (il2cpp::vm::Method::GetParamCount(MethodInfo const*)+88)
6.   #01  pc 0x0000000000597a64  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/ com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool))
7.   #02  pc 0x00000000005a70bc  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool))
8.   #03  pc 0x00000000003b8878  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/lib/arm64/libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long, _jstring*, _jobjectArray*))
9.   #04  pc 0x0000000000461754  /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+148)
10.   #05  pc 0x0000000000209a9c  /apex/com.android.art/lib64/libart.so (nterp_helper+1948)
11.   #06  pc 0x00000000004bc2e4  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper.-$$Nest$smnativeProxyInvoke)
12.   #07  pc 0x0000000000209334  /apex/com.android.art/lib64/libart.so (nterp_helper+52)
13.   #08  pc 0x00000000004bc0ce  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper$a.invoke+58)
14.   #09  pc 0x0000000000409254  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.lang.reflect.Proxy.invoke+100)
15.   #10  pc 0x0000000000458000  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+576)
16.   #11  pc 0x00000000005cb1cc  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+1216)
17.   #12  pc 0x00000000004f5744  /apex/com.android.art/lib64/libart.so (art::InvokeProxyInvocationHandler(art::ScopedObjectAccessAlreadyRunnable&, char const*, _jobject*, _jobject*, std::__1::vector<jvalue, std::__1::allocator<jvalue> >&)+500)
18.   #13  pc 0x00000000004f39d4  /apex/com.android.art/lib64/libart.so (artQuickProxyInvokeHandler+860)
19.   #14  pc 0x000000000046136c  /apex/com.android.art/lib64/libart.so (art_quick_proxy_invoke_handler+76)
20.   #15  pc 0x000000000020b0d4  /apex/com.android.art/lib64/libart.so (nterp_helper+7636)
21.   #16  pc 0x00000000004266b0  /data/app/~~KTpzIuWOC2v1UneKyDuWWA==/com.zigZag.zuu-tqN824VVOdzVP41rXE4m_w==/oat/arm64/base.vdex (com.applovin.mediation.unity.MaxUnityAdManager$19.run+28)
22.   #17  pc 0x000000000046830c  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.util.concurrent.Executors$RunnableAdapter.call+76)
23.   #18  pc 0x000000000051616c  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.util.concurrent.FutureTask.run+188)
24.   #19  pc 0x00000000005d01e0  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run+144)
25.   #20  pc 0x0000000000587070  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+976)
26.   #21  pc 0x0000000000584258  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+72)
27.   #22  pc 0x00000000003fcf50  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.lang.Thread.run+80)
28.   #23  pc 0x0000000000457d6c  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+556)
29.   #24  pc 0x0000000000483be4  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+156)
30.   #25  pc 0x00000000004838b0  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+400)
31.   #26  pc 0x00000000005cc300  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1680)
32.   #27  pc 0x00000000000f5298  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)
33.   #28  pc 0x000000000008ebdc  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68)

2- [libil2cpp.so] Method.cpp - il2cpp::vm::Method::GetParamCount(MethodInfo const*)

Code (CSharp):

1. *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2. pid: 0, tid: 14107 >>> com.zigZag.zuu <<<
3.  
4. backtrace:
5.   #00  pc 0x00000000006989cc  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/lib/arm/libil2cpp.so (il2cpp::vm::Method::GetParamCount(MethodInfo const*)+88)
6.   #01  pc 0x00000000002fdc45  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/lib/arm/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool))
7.   #02  pc 0x00000000003093b9  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/lib/arm/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool))
8.   #03  pc 0x0000000000196fff  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/lib/arm/libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long long, _jstring*, _jobjectArray*))
9.   #04  pc 0x000000000001c5fd  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/oat/arm/base.odex (art_jni_trampoline+156)
10.   #05  pc 0x00000000000d3bd5  /apex/com.android.art/lib/libart.so (art_quick_invoke_stub_internal+68)
11.   #06  pc 0x00000000004f7889  /apex/com.android.art/lib/libart.so (art_quick_invoke_static_stub+276)
12.   #07  pc 0x000000000012be09  /apex/com.android.art/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+160)
13.   #08  pc 0x000000000023feb7  /apex/com.android.art/lib/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+250)
14.   #09  pc 0x00000000002383bb  /apex/com.android.art/lib/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+750)
15.   #10  pc 0x00000000004eb88b  /apex/com.android.art/lib/libart.so (MterpInvokeStatic+478)
16.   #11  pc 0x00000000000ce794  /apex/com.android.art/lib/libart.so (mterp_op_invoke_static+20)
17.   #12  pc 0x00000000004bc2d4  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/oat/arm/base.vdex (com.unity3d.player.ReflectionHelper.-$$Nest$smnativeProxyInvoke)
18.   #13  pc 0x00000000004ebac3  /apex/com.android.art/lib/libart.so (MterpInvokeStatic+1046)
19.   #14  pc 0x00000000000ce794  /apex/com.android.art/lib/libart.so (mterp_op_invoke_static+20)
20.   #15  pc 0x00000000004bc0be  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/oat/arm/base.vdex (com.unity3d.player.ReflectionHelper$a.invoke+58)
21.   #16  pc 0x000000000023116f  /apex/com.android.art/lib/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.9333660432652088478)+250)
22.   #17  pc 0x0000000000237b23  /apex/com.android.art/lib/libart.so (art::interpreter::EnterInterpreterFromEntryPoint(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*)+114)
23.   #18  pc 0x00000000004da561  /apex/com.android.art/lib/libart.so (artQuickToInterpreterBridge+684)
24.   #19  pc 0x00000000000d8761  /apex/com.android.art/lib/libart.so (art_quick_to_interpreter_bridge+32)
25.   #20  pc 0x0000000000138f4d  /apex/com.android.art/javalib/arm/boot.oat (java.lang.reflect.Proxy.invoke+68)
26.   #21  pc 0x00000000000d3bd5  /apex/com.android.art/lib/libart.so (art_quick_invoke_stub_internal+68)
27.   #22  pc 0x00000000004f7889  /apex/com.android.art/lib/libart.so (art_quick_invoke_static_stub+276)
28.   #23  pc 0x000000000012be09  /apex/com.android.art/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+160)
29.   #24  pc 0x000000000040392d  /apex/com.android.art/lib/libart.so (art::JValue art::InvokeWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+348)
30.   #25  pc 0x0000000000403afb  /apex/com.android.art/lib/libart.so (art::JValue art::InvokeWithJValues<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+42)
31.   #26  pc 0x00000000002c9627  /apex/com.android.art/lib/libart.so (art::JNI<false>::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+558)
32.   #27  pc 0x00000000004acb01  /apex/com.android.art/lib/libart.so (art::InvokeProxyInvocationHandler(art::ScopedObjectAccessAlreadyRunnable&, char const*, _jobject*, _jobject*, std::__1::vector<jvalue, std::__1::allocator<jvalue> >&)+464)
33.   #28  pc 0x00000000004db39b  /apex/com.android.art/lib/libart.so (artQuickProxyInvokeHandler+1026)
34.   #29  pc 0x00000000000d8515  /apex/com.android.art/lib/libart.so (art_quick_proxy_invoke_handler+20)
35.   #30  pc 0x00000000000d3bd5  /apex/com.android.art/lib/libart.so (art_quick_invoke_stub_internal+68)
36.   #31  pc 0x00000000004f7759  /apex/com.android.art/lib/libart.so (art_quick_invoke_stub+280)
37.   #32  pc 0x000000000012bdf7  /apex/com.android.art/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+142)
38.   #33  pc 0x000000000023feb7  /apex/com.android.art/lib/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+250)
39.   #34  pc 0x00000000002383bb  /apex/com.android.art/lib/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+750)
40.   #35  pc 0x00000000004ea521  /apex/com.android.art/lib/libart.so (MterpInvokeInterface+876)
41.   #36  pc 0x00000000000ce814  /apex/com.android.art/lib/libart.so (mterp_op_invoke_interface+20)
42.   #37  pc 0x00000000004266a0  /data/app/~~NjUlkW9PFdbWompCD15GvA==/com.zigZag.zuu-J3zr9YSWXzr4PHMJkVhPLw==/oat/arm/base.vdex (com.applovin.mediation.unity.MaxUnityAdManager$19.run+28)
43.   #38  pc 0x000000000023116f  /apex/com.android.art/lib/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.9333660432652088478)+250)
44.   #39  pc 0x0000000000237b23  /apex/com.android.art/lib/libart.so (art::interpreter::EnterInterpreterFromEntryPoint(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*)+114)
45.   #40  pc 0x00000000004da561  /apex/com.android.art/lib/libart.so (artQuickToInterpreterBridge+684)
46.   #41  pc 0x00000000000d8761  /apex/com.android.art/lib/libart.so (art_quick_to_interpreter_bridge+32)
47.   #42  pc 0x000000000017d181  /apex/com.android.art/javalib/arm/boot.oat (java.util.concurrent.Executors$RunnableAdapter.call+56)
48.   #43  pc 0x00000000001f2013  /apex/com.android.art/javalib/arm/boot.oat (java.util.concurrent.FutureTask.run+194)
49.   #44  pc 0x0000000000274cef  /apex/com.android.art/javalib/arm/boot.oat (java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run+118)
50.   #45  pc 0x00000000002428d7  /apex/com.android.art/javalib/arm/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+1014)
51.   #46  pc 0x0000000000240127  /apex/com.android.art/javalib/arm/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+54)
52.   #47  pc 0x000000000012fb41  /apex/com.android.art/javalib/arm/boot.oat (java.lang.Thread.run+64)
53.   #48  pc 0x00000000000d3bd5  /apex/com.android.art/lib/libart.so (art_quick_invoke_stub_internal+68)
54.   #49  pc 0x00000000004f7759  /apex/com.android.art/lib/libart.so (art_quick_invoke_stub+280)
55.   #50  pc 0x000000000012bdf7  /apex/com.android.art/lib/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+142)
56.   #51  pc 0x0000000000403c7d  /apex/com.android.art/lib/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+372)
57.   #52  pc 0x0000000000403d8b  /apex/com.android.art/lib/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+42)
58.   #53  pc 0x0000000000445b1b  /apex/com.android.art/lib/libart.so (art::Thread::CreateCallback(void*)+1090)
59.   #54  pc 0x00000000000aaeff  /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+40)
60.   #55  pc 0x0000000000063bfd  /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30)

3- [libil2cpp.so] GlobalMetadata.cpp - il2cpp::vm::GlobalMetadata::GetMethodInfoFromMethodHandle(___Il2CppMetadataMethodHandle const*)

Code (CSharp):

1. *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2. pid: 0, tid: 18389 >>> com.zigZag.zuu <<<
3.  
4. backtrace:
5.   #00  pc 0x0000000000cbb960  /data/app/com.zigZag.zuu-HOfCgxBlQTkq-CQQCQW4kA==/lib/arm64/libil2cpp.so (il2cpp::vm::GlobalMetadata::GetMethodInfoFromMethodHandle(___Il2CppMetadataMethodHandle const*)+1492)
6.   #01  pc 0x0000000000596a64  /data/app/com.zigZag.zuu-HOfCgxBlQTkq-CQQCQW4kA==/lib/arm64/libunity.so (PlayableOutput::RemoveDeletedReceivers())
7.   #02  pc 0x0000000000004e9c

 

@hassan_farooqkhan The first and second call stack seem to be the same with the crash I reproduced. I think my workaround can avoid these crashes.

Can you try to comment the workaround line and the next line(two lines with

CallStatic

) and test again?

If the application still crashes, there might be other issues in the reproduction project itself, e.g doesn’t work on Android 13 or doesn’t work with Unity 2023 etc. If so, to investigate it further, the symbolicated call stack is needed.

If the application doesn’t crash after commenting these two lines, it might prove my workaround cannot avoid the crash, at least not 100%.

Edit:
If the reproduction project crashes due to the issue of UnityJavaProxy while the workaround line is uncommented, it won’t crash in the second launch. Instead, it will show “Crashed” text in the window. This can be used to determine if the workaround works.

 

@Alan-Liu I am Sorry brother. I am so dumb, I didn't realize there's a Application.Quit in the start function. I wasn't using the cable to connect my phone for the adb logcat and I thought its crashing Sorry for all the fuss





I just gave it another test following the same instructions that you gave us. I can see the blue screen and crashed written on my screen when the line is commented.


There are no crashes when the line is uncommented.






Now that you know I am not very got at this stuff, I never worked with AndroidJavaProxy before this. Will it be too much of a bother if I ask you how I can invoke AndroidJavaProxy before initializing the plugins? Any help is appreciated.

 

Hello everyone!
We've also encountered such an issue.
We've been experiencing a lot of crashes lately on Android devices.
We can't pinpoint exactly what's causing them because they occur in completely different places.

However, we've noticed a certain pattern - often there was a display of ads in the logs, or a log related to the plugin associated with advertising.
It's also worth noting that the crashes started with the release where we updated IronSource to version 7.3.1.1 - I can't confirm if this is the cause, but it's all we have for now.

Our QA team was able to reproduce the crashes on our dev builds.
I'll attach excerpts from the stack traces to the post.
I see that all the errors are related to memory.
SIGABRT
SIGSEGV
SEGV_MAPERR
We haven't found any leaks in our project in terms of the game. There's a suspicion that it might be leaking in the native part.

We initially thought the error was due to some ad network and suspected Pangle, but even if we leave only Unity Ads, the error still occurs.

Here are a few examples of crashes extracted from the stack traces. The complete traces are attached to the message.

Code (CSharp):

1. 2023-09-28 15:51:33.924 19645-19645/zombie.survival.craft.z E/ironSourceSDK: ADAPTER_CALLBACK: AdMobRewardedVideoAdLoadListener onAdFailedToLoad - adapterError = Network error.( 2 )
2. 2023-09-28 15:51:33.925 19645-19645/zombie.survival.craft.z E/ironSourceSDK: ADAPTER_CALLBACK: AdMobRewardedVideoAdLoadListener onAdFailedToLoad - adapterError = Network error.( 2 )
3. 2023-09-28 15:51:33.930 19645-19645/zombie.survival.craft.z I/Ads: Ad failed to load : 2
4. .
5. .
6. 2023-09-28 15:51:34.609 19645-19657/zombie.survival.craft.z W/System: A resource failed to call destroy.
7. 2023-09-28 15:51:34.802 19645-19741/zombie.survival.craft.z E/npth: [B]Native crash was detected![/B]
8. 2023-09-28 15:51:38.242 23234-23234/? I/urvival.craft.z: Late-enabling -Xcheck:jni
9. 2023-09-28 15:51:38.498 23234-23234/? I/urvival.craft.z: Using CollectorTypeCC GC.
10. .
11. .
12. 2023-09-28 15:51:42.674 23234-23234/zombie.survival.craft.z E/ActivityThread: Service com.bytedance.sdk.openadsdk.multipro.aidl.BinderPoolService has leaked IntentReceiver com.bytedance.sdk.openadsdk.core.settings.n$b@9eda524 that was originally registered here. Are you missing a call to unregisterReceiver()?
13.     android.app.IntentReceiverLeaked: Service com.bytedance.sdk.openadsdk.multipro.aidl.BinderPoolService has leaked IntentReceiver com.bytedance.sdk.openadsdk.core.settings.n$b@9eda524 that was originally registered here. Are you missing a call to unregisterReceiver()?
14.         at android.app.LoadedApk$ReceiverDispatcher.<init>(LoadedApk.java:1828)
15.         at android.app.LoadedApk.getReceiverDispatcher(LoadedApk.java:1601)
16.         at android.app.ContextImpl.registerReceiverInternal(ContextImpl.java:1798)
17.         at android.app.ContextImpl.registerReceiver(ContextImpl.java:1750)
18.         at android.app.ContextImpl.registerReceiver(ContextImpl.java:1738)
19.         at android.content.ContextWrapper.registerReceiver(ContextWrapper.java:747)
20.         at com.bytedance.sdk.openadsdk.core.settings.n.c(TTSdkSettings.java:1270)
21.         at com.bytedance.sdk.openadsdk.multipro.aidl.BinderPoolService.onCreate(BinderPoolService.java:43)
22.         at android.app.ActivityThread.handleCreateService(ActivityThread.java:4485)
23.         at android.app.ActivityThread.-$$Nest$mhandleCreateService(Unknown Source:0)
24.         at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2160)
25.         at android.os.Handler.dispatchMessage(Handler.java:106)
26.         at android.os.Looper.loopOnce(Looper.java:201)
27.         at android.os.Looper.loop(Looper.java:288)
28.         at android.app.ActivityThread.main(ActivityThread.java:7918)
29.         at java.lang.reflect.Method.invoke(Native Method)
30.         at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
31.         at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)

Code (CSharp):

1. 2023-09-29 11:07:41.656 25706-25706/zombie.survival.craft.z D/UnityAds: com.unity3d.services.core.webview.WebViewApp.invokeJavascriptMethod() (line:134) :: Invoking javascript: javascript:window.nativebridge.handleEvent(["ADUNIT","ON_STOP",2]);
2. 2023-09-29 11:07:41.660 25706-25706/zombie.survival.craft.z D/UnityAds: com.unity3d.services.core.webview.WebViewApp.invokeJavascriptMethod() (line:134) :: Invoking javascript: javascript:window.nativebridge.handleEvent(["ADUNIT","ON_DESTROY",true,2]);
3. 2023-09-29 11:07:41.862 25706-26179/zombie.survival.craft.z D/UnityAds: com.unity3d.services.core.webview.WebViewApp.invokeJavascriptMethod() (line:134) :: Invoking javascript: javascript:window.nativebridge.handleEvent(["REQUEST","COMPLETE","36","https:\/\/httpkafka.unityads.unity3d.com\/v1\/events","",200,[["X-Android-Selected-Protocol","http\/1.1"],["Alt-Svc","h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"],["Access-Control-Allow-Origin","*"],["X-Android-Response-Source","NETWORK 200"],["X-Android-Sent-Millis","1695974861552"],["X-Android-Received-Millis","1695974861860"],["Content-Length","0"],["Date","Fri, 29 Sep 2023 08:07:39 GMT"],["Via","1.1 google"],["Content-Type","text\/plain; charset=utf-8"]]]);
4. 2023-09-29 11:07:42.201 25706-28750/zombie.survival.craft.z I/sentry-native: entering signal handler
5. 2023-09-29 11:07:42.220 25706-28750/zombie.survival.craft.z D/sentry-native: captured backtrace with 4 frames
6. 2023-09-29 11:07:42.220 25706-28750/zombie.survival.craft.z D/sentry-native: merging scope into event
7. 2023-09-29 11:07:42.220 25706-28750/zombie.survival.craft.z D/sentry-native: trying to read modules from /proc/self/maps
8. 2023-09-29 11:07:42.412 25706-28750/zombie.survival.craft.z D/sentry-native: read 314 modules from /proc/self/maps
9. 2023-09-29 11:07:42.414 25706-28750/zombie.survival.craft.z D/sentry-native: adding attachments to envelope
10. 2023-09-29 11:07:42.415 25706-28750/zombie.survival.craft.z D/sentry-native: sending envelope
11. 2023-09-29 11:07:42.415 25706-28750/zombie.survival.craft.z D/sentry-native: serializing envelope into buffer
12. 2023-09-29 11:07:42.415 25706-28750/zombie.survival.craft.z I/sentry-native: crash has been captured

Code (CSharp):

1. 2023-09-28 15:02:24.395 9476-9476/zombie.survival.craft.z D/AppLovinSdk: [AppLovinAdView] Destroying...
2. 2023-09-28 15:02:24.400 9476-9476/zombie.survival.craft.z D/AppLovinSdk: [AppLovinAdView] onDetachedFromWindowCalled without an expanded ad present
3. 2023-09-28 15:02:24.400 9476-9476/zombie.survival.craft.z D/AppLovinSdk: [AppLovinFullscreenActivity] Ad engaged at 100%
4. 2023-09-28 15:02:24.408 1221-4077/? D/CoreBackPreview: Window{537bd9b u0 zombie.survival.craft.z/com.applovin.adview.AppLovinFullscreenActivity}: Setting back callback null
5. 2023-09-28 15:02:24.419 1221-4077/? W/InputManager-JNI: Input channel object '537bd9b zombie.survival.craft.z/com.applovin.adview.AppLovinFullscreenActivity (client)' was d
6. .
7. .
8. 2023-09-28 15:02:25.066 13906-13906/? E/chromium: [0928/150225.065916:ERROR:process_memory_range.cc(75)] read out of range
9. .
10. .
11. 2023-09-28 15:02:25.263 13908-13908/? W/linker64: type=1400 audit(0.0:1909486): avc: denied { search } for name="tests" dev="dm-46" ino=106 scontext=u:r:untrusted_app:s0:c69,c257,c512,c768 tcontext=u:object_r:shell_test_data_file:s0 tclass=dir permissive=0 app=zombie.survival.craft.z
12. 2023-09-28 15:02:25.298 13908-13908/? E/chromium: [13908:13908:20230928,150225.298383:ERROR process_memory_range.cc:75] read out of range
13. 2023-09-28 15:02:25.343 13908-13908/? W/chromium: [13908:13908:20230928,150225.343640:WARNING thread_snapshot_linux.cc:112] Unknown scheduling policy 1073741825
14. 2023-09-28 15:02:25.383 13908-13908/? E/chromium: [13908:13908:20230928,150225.383090:ERROR process_memory_range.cc:75] read out of range
15. 2023-09-28 15:02:25.383 13908-13908/? E/chromium: [13908:13908:20230928,150225.383138:ERROR process_memory_range.cc:75] read out of range
16. .
17. .
18. 2023-09-28 15:02:25.604 9476-13896/zombie.survival.craft.z I/sentry-native: crash has been captured
19. 2023-09-28 15:02:25.604 9476-13896/zombie.survival.craft.z A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x4ee0f9c818 in tid 13896 (UnityMain), pid 9476 (urvival.craft.z)
20. 2023-09-28 15:02:25.650 953-1152/? D/CHRE: @ 1036748.139: [ActivityPlatform] type 6, confidence 41
21. .
22. .
23. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG: tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
24. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000004ee0f9c818
25. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x0  0000000000000000  x1  0000000000000000  x2  0000000009988ec0  x3  0000000000000000
26. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x4  0000006ee0f9c588  x5  0000000000000000  x6  a4e15b2282dd0002  x7  0000000000000000
27. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x8  00000000dbab2b04  x9  0000000000000000  x10 0000000000000254  x11 00000000000003e8
28. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x12 0000000000000000  x13 0000000028b0aaab  x14 0000000000000018  x15 0000172c56e537d5
29. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x16 00ffffffffffffff  x17 002348778f2a1644  x18 0000006bb3602000  x19 0000000000000000
30. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x20 b400007239d21ae0  x21 00000000dbab2b0e  x22 0000006fdd9da000  x23 b400007239d225a8
31. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x24 0000000005265bff  x25 0000000000000000  x26 0000006fdd762e98  x27 0000006fdd773300
32. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     x28 4e1f5574757e942f  x29 0000004ee0f9c870
33. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:     lr  0000006fce61fbc0  sp  0000006ee0f9c740  pc  0000006fce61fc14  pst 0000000080001000
34. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG: backtrace:
35. 2023-09-28 15:02:26.304 13912-13912/? A/DEBUG:       #00 pc 0000000000007c14  /data/app/~~40wppQEkNr0lU4GxUzyMIw==/zombie.survival.craft.z-7W1sANAzOrQrehPInr77HA==/lib/arm64/libenet.so (enet_host_service+5972) (BuildId: faa2534cb0ff83b36f46c8891b52e92e205c297f)

 

I would like to point out an error about IntetReceiver.
This can lead us to think about the nature of crashes.

Code (CSharp):

1. Service com.bytedance.sdk.openadsdk.multipro.aidl.BinderPoolService has leaked IntentReceiver com.bytedance.sdk.openadsdk.core.settings.n$b@9eda524 that was originally registered here. Are you missing a call to unregisterReceiver()?
2.     at android.app.LoadedApk$ReceiverDispatcher.<init>(LoadedApk.java:1828)
3.     at android.app.LoadedApk.getReceiverDispatcher(LoadedApk.java:1601)

 

@hassan_farooqkhan
Basically, you need to

• copy

  MyCallback

  in Test.cs to your project
• copy java files in Assets/Plugins to your project, put them in the same folder structure as the reproduction project
• copy three lines in

  Test.Start

  to your project, execute them before initializing any plugin
  • Using var klass = …
  • var callback = …
    
  • The workaround line

You can confirm the code runs correctly by checking if the log in

MyCallback.Foo

is output:

 

@Alan-Liu Thank you so much Sir, I can not thank you enough.



I will post the results after a few days of checking statistics.

 

We have been experiencing similar crashes in our app and it looks like invoking JavaProxy at the start has solved the issue for some devices, but looks like not completely. Could it be a symptom of some other issue? Low available RAM for instance?
I've been analyzing the crashlytics and in our latest build, at around 5% user crash rate, average available RAM at the time of the crash is around 65 MB.

 

Lack of available RAM - the same representation.
We are faced with the fact that almost all crashes have a symptom of low memory.
It is about 30-100 Mb of free RAM

 

The AndroidJavaProxyCrash project is also crashing on Unity 2020.3.48f1.
Uncommenting line 41 fixes this crash.

 

On our end bytedance.sdk also shows in the stack traces, maybe some issue with that provider?