Search Unity

  1. Megacity Metro Demo now available. Download now.
    Dismiss Notice

Bug Lot of crashes at il2cpp::vm::Object::GetClass(Il2CppObject*) 2021.3.19f1 LTS

Discussion in 'Android' started by domonyiv, Feb 23, 2023.

  1. ikuriscak

    ikuriscak

    Joined:
    Feb 15, 2018
    Posts:
    20
    @JoshPeterson okay, so a build with .net standard 2.1 and the above link.xml setup didnt help at all. So, back to square one.. I'm kinda out of options now, I think. Unless building with the link.xml setup AND .net framework could change anything.
    It seems that all that's left is to build with the completely unstripped unity assembly libraries.
    We keep trying to catch the crash on the Redmi 9A, still without luck. How does a crash like this appear in the android logcat anyway?
     
  2. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    I agree that this is the next debugging step. I don't have any other ideas.

    I'm not too familiar with Android development tools, but I think that call stacks for crashes do show up by default in the logcat output, if that is what you are asking.
     
  3. RaventurnPatrick

    RaventurnPatrick

    Joined:
    Aug 9, 2011
    Posts:
    249
    Yep I can confirm that the crashes appear in the logcat output. You might want to use "adb logcat" instead of Unity logcat though as it tends to cut off the crash texts on certain devices.
     
  4. ikuriscak

    ikuriscak

    Joined:
    Feb 15, 2018
    Posts:
    20
    The logcat that comes as a package for unity does indeed show less information as for example the one in Android Studio.

    In any case, I managed to crash the app on the Redmi 9A three times, with what I believe are reproducable steps.
    I have no idea if the crash is the same as we're discussing in this thread (or one of them), as the logcat does not contain anything resembling one of the stacktraces above.
    What I did was that during an ad I tapped on it, which opened google play. Then I went back using device back button, the ad resumed, I tapped again, google play opened again, I went back again but this time neither the ad nor the app was there (you could see the window disappearing) and it restarted.

    This is what I found interesting within the logcat:
    Code (CSharp):
    1. 2023-04-27 09:53:17.785 362-362/? I/lowmemorykiller: Kill 'com.miui.core' (2945), uid 10160, oom_adj 800 to free 36888kB; reason: device is not responding
    2. 2023-04-27 09:53:18.857 362-362/? I/lowmemorykiller: Kill 'com.google.android.ims' (2870), uid 10179, oom_adj 800 to free 64848kB; reason: device is not responding
    3. 2023-04-27 09:53:19.934 362-362/? I/lowmemorykiller: Kill 'com.xiaomi.location.fused' (3123), uid 1000, oom_adj 800 to free 59896kB; reason: device is not responding
    4. 2023-04-27 09:53:21.009 362-362/? I/lowmemorykiller: Kill 'com.google.process.gservices' (2902), uid 10184, oom_adj 700 to free 56844kB; reason: device is not responding
    5. 2023-04-27 09:53:22.092 362-362/? I/lowmemorykiller: Kill 'com.google.process.gapps' (3181), uid 10184, oom_adj 700 to free 57168kB; reason: device is not responding
    6. 2023-04-27 09:53:23.173 362-362/? I/lowmemorykiller: Kill 'com.xiaomi.bluetooth' (3228), uid 1002, oom_adj 800 to free 60196kB; reason: device is not responding
    7. 2023-04-27 09:53:24.249 362-362/? I/lowmemorykiller: Kill 'com.android.htmlviewer:remote' (3262), uid 10110, oom_adj 700 to free 46576kB; reason: device is not responding
    8. 2023-04-27 09:53:25.331 362-362/? I/lowmemorykiller: Kill 'com.google.android.googlequicksearchbox:search' (32717), uid 10185, oom_adj 500 to free 60964kB; reason: device is not responding
    9. 2023-04-27 09:53:26.405 362-362/? I/lowmemorykiller: Kill 'com.miui.core' (3369), uid 10160, oom_adj 500 to free 48704kB; reason: device is not responding
    10. 2023-04-27 09:53:28.556 362-362/? I/lowmemorykiller: Kill 'com.google.android.youtube' (3348), uid 10197, oom_adj 915 to free 115504kB; reason: device is not responding
    11. 2023-04-27 09:53:29.621 362-362/? I/lowmemorykiller: Kill 'com.google.process.gservices' (3452), uid 10184, oom_adj 905 to free 73120kB; reason: device is not responding
    12. 2023-04-27 09:53:30.708 362-362/? I/lowmemorykiller: Kill 'OUR APP' (2369), uid 10265, oom_adj 501 to free 111952kB; reason: device is not responding
    13. 2023-04-27 09:53:30.917 362-362/? W/lowmemorykiller: Failed to open /proc/2549/oom_score_adj; errno=2: process 2549 might have been killed
    14. 2023-04-27 09:53:33.389 362-362/? I/lowmemorykiller: Kill 'com.lbe.security.miui' (30904), uid 10091, oom_adj 200 to free 41088kB; reason: device is not responding
    15. 2023-04-27 09:53:34.462 362-362/? I/lowmemorykiller: Kill 'com.google.android.webview:webview_service' (3668), uid 10191, oom_adj 905 to free 77436kB; reason: device is not responding
    As I said, I have no idea if this is the same crash, but assuming it is, is it possible the ad itself caused a leak that made android kill everything above and then the callbacks from the ad window obviously couldnt reach anywhere, resulting in the crash reported in previous posts?
     
  5. actislav

    actislav

    Joined:
    Mar 2, 2018
    Posts:
    8
    I have the same issue as you, unity 2021.3.22f1, ironsource 7.3.0.1, same ~10% crash rate (correlates with how rewarded vidoes relates to interstitial) my Stack trace (interested points is com.ironsource.unity.androidbridge.AndroidBridge$4.run+24 and com.unity3d.player.ReflectionHelper$1.invoke+58):

    Code (CSharp):
    1.  #00  pc 0x0000000000ee5a40  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/lib/arm64/libil2cpp.so (il2cpp::vm::Method::GetParamCount(MethodInfo const*))
    2.   #01  pc 0x0000000000310850  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool))
    3.   #02  pc 0x000000000031e520  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool))
    4.   #03  pc 0x0000000000118424  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/lib/arm64/libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long, _jstring*, _jobjectArray*))
    5.   #04  pc 0x0000000000058aa0  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/oat/arm64/base.odex (art_jni_trampoline+208)
    6.   #05  pc 0x00000000001375b8  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_static_stub+568)
    7.   #06  pc 0x00000000001460cc  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+276)
    8.   #07  pc 0x00000000002e3720  /apex/com.android.runtime/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+384)
    9.   #08  pc 0x00000000002de7ac  /apex/com.android.runtime/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+900)
    10.   #09  pc 0x00000000005a54e0  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+368)
    11.   #10  pc 0x0000000000131994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20)
    12.   #11  pc 0x000000000021e62a  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper.a)
    13.   #12  pc 0x00000000005a57e0  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+1136)
    14.   #13  pc 0x0000000000131994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20)
    15.   #14  pc 0x000000000021e1ac  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper$1.invoke+58)
    16.   #15  pc 0x00000000002b4050  /apex/com.android.runtime/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13310094408155829753)+240)
    17.   #16  pc 0x0000000000593dd8  /apex/com.android.runtime/lib64/libart.so (artQuickToInterpreterBridge+1024)
    18.   #17  pc 0x0000000000140468  /apex/com.android.runtime/lib64/libart.so (art_quick_to_interpreter_bridge+88)
    19.   #18  pc 0x00000000001bdf1c  /system/framework/arm64/boot.oat (java.lang.reflect.Proxy.invoke+92)
    20.   #19  pc 0x00000000001375b8  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_static_stub+568)
    21.   #20  pc 0x00000000001460cc  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+276)
    22.   #21  pc 0x00000000004b2e78  /apex/com.android.runtime/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
    23.   #22  pc 0x00000000004b3b38  /apex/com.android.runtime/lib64/libart.so (art::InvokeWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+400)
    24.   #23  pc 0x00000000003b0db0  /apex/com.android.runtime/lib64/libart.so (art::JNI::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+616)
    25.   #24  pc 0x0000000000573ae4  /apex/com.android.runtime/lib64/libart.so (art::InvokeProxyInvocationHandler(art::ScopedObjectAccessAlreadyRunnable&, char const*, _jobject*, _jobject*, std::__1::vector<jvalue, std::__1::allocator<jvalue>>&)+660)
    26.   #25  pc 0x0000000000594df0  /apex/com.android.runtime/lib64/libart.so (artQuickProxyInvokeHandler+1056)
    27.   #26  pc 0x000000000013fefc  /apex/com.android.runtime/lib64/libart.so (art_quick_proxy_invoke_handler+76)
    28.   #27  pc 0x0000000000137334  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_stub+548)
    29.   #28  pc 0x00000000001460ac  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+244)
    30.   #29  pc 0x00000000002e3720  /apex/com.android.runtime/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+384)
    31.   #30  pc 0x00000000002de7ac  /apex/com.android.runtime/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+900)
    32.   #31  pc 0x00000000005a40d4  /apex/com.android.runtime/lib64/libart.so (MterpInvokeInterface+868)
    33.   #32  pc 0x0000000000131a14  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_interface+20)
    34.   #33  pc 0x00000000004fbe58  /data/app/*-UJRDi6Bov6yOAET9oa6o-w==/oat/arm64/base.vdex (com.ironsource.unity.androidbridge.AndroidBridge$4.run+24)
    35.   #34  pc 0x00000000002b4050  /apex/com.android.runtime/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13310094408155829753)+240)
    36.   #35  pc 0x0000000000593dd8  /apex/com.android.runtime/lib64/libart.so (artQuickToInterpreterBridge+1024)
    37.   #36  pc 0x0000000000140468  /apex/com.android.runtime/lib64/libart.so (art_quick_to_interpreter_bridge+88)
    38.   #37  pc 0x00000000001b3d98  /system/framework/arm64/boot.oat (java.lang.Thread.run+72)
    39.   #38  pc 0x0000000000137334  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_stub+548)
    40.   #39  pc 0x00000000001460ac  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+244)
    41.   #40  pc 0x00000000004b2e78  /apex/com.android.runtime/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
    42.   #41  pc 0x00000000004b3f28  /apex/com.android.runtime/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+416)
    43.   #42  pc 0x00000000004f4480  /apex/com.android.runtime/lib64/libart.so (art::Thread::CreateCallback(void*)+1176)
    44.   #43  pc 0x00000000000e55b4  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+36)
    45.   #44  pc 0x0000000000085458  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)
     
  6. ikuriscak

    ikuriscak

    Joined:
    Feb 15, 2018
    Posts:
    20
    Hi, sorry for the late reply, I didn't get a replay notification.
    Have you managed to solve it?
    Our recent test release (with a slowly increasing rollout) has a steady crash rate of ~0.1% which is a number I haven't seen in almost a year.
    TLDR of what I did: I removed everything from Ironsource constructors that we're not using. I reduced the amount of callbacks used on our side to those that were necessary. I fixed a small inconsistency in ironsource event accessor.

    Long version:
    First of all, while I was trying to reproduce the crash, I noticed a couple of logs from Ironsource during app init:
    upload_2023-5-9_9-37-5.png

    So, I went through the c# code from the Ironsource package and commented out everything in Awake methods and constructors we dont't use. Most of the ironsource code is creating (in this case unnecessary) android objects and registering events anyway.

    For example this is in Awake method of IronSourceEvents.cs:
    Code (CSharp):
    1.         initializationAndroid = new IronSourceInitializationAndroid();//sets this.initialztionAndroid as listener for initialztionAndroid events in the bridge
    2.         registerInitializationEvents(); //subscribe to initialization events from this.initializationAndroid
    3.         rewardedVideoAndroid = new IronSourceRewardedVideoAndroid();//sets this.rewardedVideoAndroid as listener for RV(Mediation& Demand Only) events in the bridge
    4.         registerRewardedVideoEvents();//subscribe to RV events from this.rewardedVideoAndroid
    5.         rewardedVideoAndroidManual = new IronSourceRewardedVideoManualAndroid();
    6.         registerRewardedVideoManualEvents();//subscribe to RV Manual events from this.rewardedVideoAndroid
    7.         registerRewardedVideoDemandOnlyEvents();//subscribe to RV Demand Only events from this.rewardedVideoAndroid
    8.         interstitialAndroid = new IronSourceInterstitialAndroid();//sets this.interstitialAndroid as listener for Interstitia(Mediation& Demand Only) events in the bridge
    9.         registerInterstitialEvents();//subscribe to Interstitial events from this.interstitialAndroid
    10.         registerInterstitialDemandOnlyEvents();//subscribe to Interstitial Demand Only events from this.interstitialAndroid
    11.         offerwallAndroid = new IronSourceOfferwallAndroid();//sets this.offerwallAndroid as listener for Offerwall(Mediation& Demand Only) events in the bridge
    12.         registerOfferwallEvents();//subscribe to Offerwall events from this.offerwallAndroid
    13.         bannerAndroid = new IronSourceBannerAndroid();//sets this.bannerAndroid as listener for Banner(Mediation& Demand Only) events in the bridge
    14.         registerBannerEvents();//subscribe to Banner events from this.bannerAndroid
    15.         impressionDataAndroid = new IronSourceImpressionDataAndroid();//sets this.impressionDataAndroid as listener for Impression Data events in the bridge
    16.         registerImpressionDataEvents();//subscribe to onImpressionSuccess event from this.impressionDataAndroid
    17.         segmentAndroid = new IronSourceSegmentAndroid();//sets this.segmentAndroid as listener for Segment events in the bridge
    18.         registerSegmentEvents();//subscribe to onSegmentRecieved event from this.segmentAndroid
    We don't use banners, we don't use offerwalls, we don't listen to impression events or segments. So I removed all of those. There's probably three classes I modified this way. Yes, as soon as there's an Ironsource update, I'd have to do it again, but a single diff patch should be enough.
    We contacted Ironsource support like two weeks ago but so far we got a single response asking for more project details, so no expectations there.

    Next thing I did was to just go through the callbacks we used and not subscribe to those we don't actually use for anything. In our case there were three: onAdShowSucceededEvent for interstitials and onAdClickedEvent for both interstitials and regular rewarded ads.
    Assuming the minimal stripping really doesn't mess with assembly-csharp code, this probably did nothing, but since the crashes I managed to catch (described in last post) happened after I 'clicked' on the ad, I thought it was worth the shot.

    Last thing I did was a small 'fix' to an inconsistency as to how one of the events gets registered:
    upload_2023-5-9_10-2-44.png

    This probably did nothing, but I'm posting it just in case.

    Hope this helps, or at least points to a right direction.

    Also note: While the crash rate of the release decreased considerably to a relatively low number, the actual crash is still present, althought almost non-existent (2 instances during week+ running release with rollout already at 50%+).
     
  7. AlkisFortuneFish

    AlkisFortuneFish

    Joined:
    Apr 26, 2013
    Posts:
    970
    Hey Josh,

    I have been chasing a crash that presents itself exactly like this but is almost definitely caused by a library not mentioned here but I think I may have figured out precisely why this is actually crashing.

    [strike]Looking at Scripting::LogExceptionFromManaged() in libunity, it calls GetClass() on its first parameter (ScriptingExceptionPtr). It would appear that this is raised from UnityJavaProxy_LogJNIInvokeException with a ScriptingExceptionPtr that is explicitly 0, causing a read from 0 in GetClass().

    In other words, unless the disassembly lldb is feeding me with is invalid somehow, the exception logging for JNIInvoke always crashes the player. I will try and get a bug in, if I can figure out how to actually trigger this in isolation.
    [/strike]

    Edit: Looking into more detailed disassembly, my previous assessment is almost definitely incorrect. The actual first parameter being passed into LogExceptionFromManaged is Scripting*, not ScriptingExceptionPtr. Now, I can see that in that code flow Scripting can be null but I don't have the context there without the engine source, perhaps it could be a crash occurring during engine destruction? I could do a complete shot in the dark and make Object::GetClass() return 0 if obj is zero, rather than just derefencing a null pointer, at least what that returns does appear to be checked in a few places, but without a solid repro this really is not great.
     
    Last edited: May 12, 2023
  8. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    Thanks for the details about your investigation. It feels like we might be narrowing in on a cause here, although we're not quite there yet.
     
  9. AlkisFortuneFish

    AlkisFortuneFish

    Joined:
    Apr 26, 2013
    Posts:
    970
    We've taken the plunge and patched Object::GetClass() to check the pointer it derefences. We shall see what the result of that will be, best case scenario is that the crashes stop (but we won't know what is actually happening in that case), worst case is that the crash stack traces change and we get some more info about what's happening.
     
    JoshPeterson likes this.
  10. MaximPP

    MaximPP

    Joined:
    Jan 26, 2019
    Posts:
    76
    I have similar crash (Unity 2021.3.24, Android build). I'm using IronSource 7.3.0.1 and I'm getting a crash rate of around 5%. In the previous version of the game, I used Admob and the crash rate was about 0.4% (there were no other changes in the update). With both ad mediators, I move the callbacks to the main thread (I know that this can cause crashes), but in the case of IronSource, this does not help, and the crashes continue. I use only Interstitial and Rewarded ads (I don't use banners)
    The stack looks like this:
    Code (CSharp):
    1. 0 libil2cpp.so il2cpp::vm::Method::GetParamCount(MethodInfo const*)
    2. 1 libil2cpp.so il2cpp::vm::Thread::Attach(Il2CppDomain*)
    3. 2 libunity.so __ashldi3
    4. 3 libunity.so ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool)
    5. 4 libunity.so UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long long, _jstring*, _jobjectArray*)
    and from the Google Play Console:
    Code (CSharp):
    1. #00  pc 0x00000000006c5928  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/lib/arm64/libil2cpp.so (il2cpp::vm::Method::GetParamCount(MethodInfo const*))
    2.   #01  pc 0x0000000000284b6c  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool))
    3.   #02  pc 0x0000000000292878  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool))
    4.   #03  pc 0x00000000000dbda4  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/lib/arm64/libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long, _jstring*, _jobjectArray*))
    5.   #04  pc 0x00000000000e5730  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/oat/arm64/base.odex (art_jni_trampoline+208)
    6.   #05  pc 0x00000000001337e8  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568)
    7.   #06  pc 0x00000000001a9804  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228)
    8.   #07  pc 0x000000000031c4d8  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+376)
    9.   #08  pc 0x00000000003126c0  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+912)
    10.   #09  pc 0x0000000000689d84  /apex/com.android.art/lib64/libart.so (MterpInvokeStatic+548)
    11.   #10  pc 0x000000000012d994  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20)
    12.   #11  pc 0x0000000001b3e50a  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper.a)
    13.   #12  pc 0x000000000068a028  /apex/com.android.art/lib64/libart.so (MterpInvokeStatic+1224)
    14.   #13  pc 0x000000000012d994  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20)
    15.   #14  pc 0x0000000001721ab8  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper$1.invoke+58)
    16.   #15  pc 0x0000000000309968  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.10721020062547966384)+264)
    17.   #16  pc 0x0000000000675828  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+776)
    18.   #17  pc 0x000000000013cff8  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88)
    19.   #18  pc 0x0000000000165dfc  /apex/com.android.art/javalib/arm64/boot.oat (java.lang.reflect.Proxy.invoke+92)
    20.   #19  pc 0x00000000001337e8  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568)
    21.   #20  pc 0x00000000001a9804  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228)
    22.   #21  pc 0x000000000055d640  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+440)
    23.   #22  pc 0x00000000003ca658  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+640)
    24.   #23  pc 0x0000000000637588  /apex/com.android.art/lib64/libart.so (art::InvokeProxyInvocationHandler(art::ScopedObjectAccessAlreadyRunnable&, char const*, _jobject*, _jobject*, std::__1::vector<jvalue, std::__1::allocator<jvalue> >&)+656)
    25.   #24  pc 0x000000000067693c  /apex/com.android.art/lib64/libart.so (artQuickProxyInvokeHandler+1204)
    26.   #25  pc 0x000000000013ca5c  /apex/com.android.art/lib64/libart.so (art_quick_proxy_invoke_handler+76)
    27.   #26  pc 0x0000000000133564  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548)
    28.   #27  pc 0x00000000001a97e8  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
    29.   #28  pc 0x000000000031c4d8  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+376)
    30.   #29  pc 0x00000000003126c0  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+912)
    31.   #30  pc 0x0000000000688804  /apex/com.android.art/lib64/libart.so (MterpInvokeInterface+1036)
    32.   #31  pc 0x000000000012da14  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_interface+20)
    33.   #32  pc 0x0000000000d7d3c4  /data/app/~~mDEEAZwrQCJLGga8_XgkQg==/com.BrightGlade.Bouncefield-D9yevL4B8U3Lh2zieapEug==/oat/arm64/base.vdex (com.ironsource.unity.androidbridge.AndroidBridge$3.run+16)
    34.   #33  pc 0x0000000000309968  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.10721020062547966384)+264)
    35.   #34  pc 0x0000000000675828  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+776)
    36.   #35  pc 0x000000000013cff8  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88)
    37.   #36  pc 0x000000000015b358  /apex/com.android.art/javalib/arm64/boot.oat (java.lang.Thread.run+72)
    38.   #37  pc 0x0000000000133564  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548)
    39.   #38  pc 0x00000000001a97e8  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
    40.   #39  pc 0x000000000055daec  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+460)
    41.   #40  pc 0x00000000005ad96c  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1308)
    42.   #41  pc 0x00000000000ec8f8  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+64)
    43.   #42  pc 0x000000000008c190  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)
    44.  
     
    Last edited: May 20, 2023
  11. MaximPP

    MaximPP

    Joined:
    Jan 26, 2019
    Posts:
    76
    How did your experiment end? If successful, could you tell me in more detail which code you removed and in which classes, in addition to IronSourceEvents.cs.
     
  12. ikuriscak

    ikuriscak

    Joined:
    Feb 15, 2018
    Posts:
    20
    Long term (last 28 days) overall (all releases together) crash rate is already at ~0.44%, but it takes time for the new release to take full effect. Seven day overall is at ~0.21%, so I'd call that success.

    Here are diffs of all changes I did:
    upload_2023-5-22_11-17-35.png

    IronSourceEvents.cs:
    upload_2023-5-22_11-18-15.png

    upload_2023-5-22_11-18-34.png

    Our code with ironsource implementation (shown mainly for the events we still use and which we don't anymore):
    upload_2023-5-22_11-19-38.png
     
    itblast and MaximPP like this.
  13. rsubedi

    rsubedi

    Joined:
    May 5, 2017
    Posts:
    1
    Which version of unity do you use?
     
  14. MaximPP

    MaximPP

    Joined:
    Jan 26, 2019
    Posts:
    76
    Thanks again! I've applied these changes except for the ones related to Rewarded ads, as I am using it. As a result, the number of crashes was reduced from 10-20% to about 0.4 - 0.8%. In the next updates, I want to gradually restore these changes and thereby find exactly the one that leads to crashes.
     
  15. teemukorh

    teemukorh

    Joined:
    Oct 28, 2014
    Posts:
    49
    We are also experiencing this same issue with IS 7.3.0.1 and 7.3.1 and unity 2021.3.20f. I also contacted IS support, let's see if they have any additional information.
     
  16. AlkisFortuneFish

    AlkisFortuneFish

    Joined:
    Apr 26, 2013
    Posts:
    970
    So, after the changes I made, which also included completely stripping out AppsFlyer MAX (which we weren't really using anymore but remained in the project), our crashes stopped and our crash rate dropped to 0.2%. However, on the next release we migrated some of our networking infrastructure to BestHTTP/2, which caused crashes on Android to start ramping up again. The new stack traces we are getting are pretty similar to the ones we had before and make very little sense.

    What appears to be common to all of them is they they are always in multithreaded code. The stack traces vary but the actual code that crashes is pretty consistent.

    One family of crashes is in:
    Code (CSharp):
    1.   #00  pc 0x0000000000a10334 (UnityPalCompareExchange(int*, int, int) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp\os/c-api/Atomic-c-api.h:55)  /data/app/~~ecB1RBUsPMH_kibdPMOppQ==/com.fortunefish.fashionar-Rwvu3uH_s-ut_lTVK6VMtw==/lib/arm/libil2cpp.so
    2.   #01  pc 0x000000000188c01c (il2cpp_codegen_runtime_class_init_inline(Il2CppClass*) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp\codegen/il2cpp-codegen-il2cpp.h:691)  /data/app/~~ecB1RBUsPMH_kibdPMOppQ==/com.fortunefish.fashionar-Rwvu3uH_s-ut_lTVK6VMtw==/lib/arm/libil2cpp.so
    The rest of the stack trace varies but is always in a Task::ExecuteWithThreadLocal context.

    Another family is in:

    Code (CSharp):
    1.   #00  pc 0x0000000001132bd0 (il2cpp::vm::Class::Init(Il2CppClass*) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp/vm/Class.cpp:1548)  /data/app/com.fortunefish.fashionar-DntEh_02ciac0xDrTApJKw==/lib/arm64/libil2cpp.so
    2.   #01  pc 0x0000000001173758 (il2cpp::vm::Type::GetNameInternal(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >&, Il2CppType const*, Il2CppTypeNameFormat, bool) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp/vm/Type.cpp:683)  /data/app/com.fortunefish.fashionar-DntEh_02ciac0xDrTApJKw==/lib/arm64/libil2cpp.so
    3.   #02  pc 0x0000000001173ba4 (il2cpp::vm::Type::GetName(Il2CppType const*, Il2CppTypeNameFormat) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp/vm/Type.cpp:772)  /data/app/com.fortunefish.fashionar-DntEh_02ciac0xDrTApJKw==/lib/arm64/libil2cpp.so
    4.   #03  pc 0x00000000010e5b2c (il2cpp::vm::RaiseExceptionForNotFoundInterface(Il2CppClass const*, Il2CppClass const*, unsigned short) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp/vm/ClassInlines.cpp:49)  /data/app/com.fortunefish.fashionar-DntEh_02ciac0xDrTApJKw==/lib/arm64/libil2cpp.so
    5.   #04  pc 0x00000000010e5afc (il2cpp::vm::ClassInlines::GetInterfaceInvokeDataFromVTableSlowPath(Il2CppObject*, Il2CppClass const*, unsigned short) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp/vm/ClassInlines.cpp:98)  /data/app/com.fortunefish.fashionar-DntEh_02ciac0xDrTApJKw==/lib/arm64/libil2cpp.so
    6.   #05  pc 0x0000000001b80e34 (il2cpp::vm::ClassInlines::GetInterfaceInvokeDataFromVTable(Il2CppObject*, Il2CppClass const*, unsigned short) at C:/BuildAgent/work/FashionAR2021Build/Build/unityLibrary/src/main/Il2CppOutputProject/IL2CPP/libil2cpp\vm/ClassInlines.h:56)  /data/app/com.fortunefish.fashionar-DntEh_02ciac0xDrTApJKw==/lib/arm64/libil2cpp.so
    7.  
    Again, the rest of the stack trace varies but is always in a Task::ExecuteWithThreadLocal context.

    We're also getting things like List::Add() crashing in a similar context in totally trivial code.

    All in all, the only thing I can conclude from this is that either the scripting runtime has been completely corrupted, or the engine is tearing down the scripting runtime before background threads have been terminated, causing random code to crash.

    We're not sure where to go from this, beyond modifying the runtime and hoping for the best, we have never reproduced this locally, or at least not knowingly, if it is a crash on exit we may have without realising.

    We're now tracking to go back above the bad behaviour threshold within the month, which is a business problem.

    Any suggestions? The way this has been approached by Unity is really rather unhelpful. Some classes of bugs cannot ever be tracked down by expecting developers to provide repros, they require investigation on Unity's side. While I can certainly patch bits of the runtime, us as developers do not have the systemic visibility of how the entire system works and how these crashes relate to each other across multiple customers' projects. It is very clear that this is happening across the board.
     
    RaventurnPatrick likes this.
  17. RaventurnPatrick

    RaventurnPatrick

    Joined:
    Aug 9, 2011
    Posts:
    249
    Yes this seems to be very familiar. As soon as we started introducing our own multi-threaded code with Il2cpp many similar crashes started occurring on Android and iOS - mostly when memory is allocated for some operation - thus pre-allocating memory can help alleviate the crashes.
     
  18. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    I agree with this. Because of the large number of bugs that come into our bug tracking system, our QA team has to be pretty strict about requiring cases to reproduce them, so that we can find valuable signals from which to work.

    With that said, this situation does require different debugging techniques. I'd love to track down the cause (or causes) of these issues.

    For cases of multithreading, do you gave access to call stacks from all threads when this happens? If you can send those to me via direct message, I'll start to collect and analyze them. Maybe we will see some pattern emerge.
     
  19. IgorGalimskiy

    IgorGalimskiy

    Joined:
    May 30, 2017
    Posts:
    31
    We have the same stack trace, and high crash rate
    F fix of wrapping callback to the main thread didn't help

    Any more ideas?

    Code (CSharp):
    1. *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
    2. pid: 0, tid: 16280 >>> com.test.test <<<
    3.  
    4. backtrace:
    5. #00  pc 0x0000000001925094  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/lib/arm64/libil2cpp.so (il2cpp::vm::Method::GetParamCount(MethodInfo const*)+88)
    6. #01  pc 0x00000000005745ec  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/lib/arm64/libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool))
    7. #02  pc 0x0000000000582824  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/lib/arm64/libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool))
    8. #03  pc 0x000000000021fc8c  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/lib/arm64/libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long, _jstring*, _jobjectArray*))
    9. #04  pc 0x000000000011e900  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/oat/arm64/base.odex (art_jni_trampoline+208)
    10. #05  pc 0x00000000001347e8  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568)
    11. #06  pc 0x0000000000198eb0  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
    12. #07  pc 0x000000000030c254  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+376)
    13. #08  pc 0x000000000030736c  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+884)
    14. #09  pc 0x000000000063de5c  /apex/com.android.art/lib64/libart.so (MterpInvokeStatic+548)
    15. #10  pc 0x000000000012e994  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20)
    16. #11  pc 0x00000000012e5c32  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper.a)
    17. #12  pc 0x000000000063e098  /apex/com.android.art/lib64/libart.so (MterpInvokeStatic+1120)
    18. #13  pc 0x000000000012e994  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20)
    19. #14  pc 0x00000000012e5a44  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/oat/arm64/base.vdex (com.unity3d.player.ReflectionHelper$1.invoke+58)
    20. #15  pc 0x00000000002fed48  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.18441993989064323955)+268)
    21. #16  pc 0x0000000000629a84  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+796)
    22. #17  pc 0x000000000013dff8  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88)
    23. #18  pc 0x0000000000167a0c  /apex/com.android.art/javalib/arm64/boot.oat (java.lang.reflect.Proxy.invoke+92)
    24. #19  pc 0x00000000001347e8  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568)
    25. #20  pc 0x0000000000198eb0  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
    26. #21  pc 0x0000000000532198  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
    27. #22  pc 0x0000000000532ec8  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+420)
    28. #23  pc 0x00000000003b1e24  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+644)
    29. #24  pc 0x000000000060796c  /apex/com.android.art/lib64/libart.so (art::InvokeProxyInvocationHandler(art::ScopedObjectAccessAlreadyRunnable&, char const*, _jobject*, _jobject*, std::__1::vector<jvalue, std::__1::allocator<jvalue> >&)+660)
    30. #25  pc 0x000000000062ab2c  /apex/com.android.art/lib64/libart.so (artQuickProxyInvokeHandler+1104)
    31. #26  pc 0x000000000013da5c  /apex/com.android.art/lib64/libart.so (art_quick_proxy_invoke_handler+76)
    32. #27  pc 0x0000000000134564  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548)
    33. #28  pc 0x0000000000198e94  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+204)
    34. #29  pc 0x000000000030c254  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+376)
    35. #30  pc 0x000000000030736c  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+884)
    36. #31  pc 0x000000000063c9d8  /apex/com.android.art/lib64/libart.so (MterpInvokeInterface+1124)
    37. #32  pc 0x000000000012ea14  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_interface+20)
    38. #33  pc 0x00000000012e4224  /data/app/~~CkR5_1nte6sscbtr3MK9Aw==/com.test.test-wsqB3J0zf156_s1NSeHSRQ==/oat/arm64/base.vdex (com.ironsource.unity.androidbridge.LevelPlayRewardedVideoWrapper$2.run+12)
    39. #34  pc 0x00000000002fed48  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.18441993989064323955)+268)
    40. #35  pc 0x0000000000629a84  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+796)
    41. #36  pc 0x000000000013dff8  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88)
    42. #37  pc 0x000000000015ced8  /apex/com.android.art/javalib/arm64/boot.oat (java.lang.Thread.run+72)
    43. #38  pc 0x0000000000134564  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548)
    44. #39  pc 0x0000000000198e94  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+204)
    45. #40  pc 0x0000000000532198  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
    46. #41  pc 0x0000000000533398  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+440)
    47. #42  pc 0x00000000005808b8  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1272)
    48. #43  pc 0x00000000000f40c4  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+64)
    49. #44  pc 0x000000000008ed10  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)
     
  20. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    Unfortunately we still don't know what causes this, nor have we been able to reproduce it locally. So if you have a case you can reproduce and provide it via a bug report, we would be very grateful.
     
  21. Alan-Liu

    Alan-Liu

    Joined:
    Jan 23, 2014
    Posts:
    391
    I reproduced a crash in
    il2cpp::vm::Method::GetParamCount
    when
    AndroidJavaProxy
    is called from multiple threads. The details and a workaround are posted here.
     
  22. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    I tried workaround in Unity 2021.3.33 and Unity 2022.3.15.
    In Unity 2021 crash "__Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C" is still there with too many occurrences.
    In Unity 2022 crash "libc.so" also with too many occurrences.
    So the workaround doesn't connected to the crashes.
    Still need the fix.
     
  23. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
  24. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson stacktrace from Crashlytics is attached.
    Unity 2021.3.33
    Happens on all Android OSs, from 5 and above.
    On almost all devices in foreground(based on Crashlytics data).
    And based on the logs, it happens after watching interstitial or rewarded ad. But I'm not sure.
    In project there are Admob SDK with the mediation plugins and Unity Legacy Advertisment.
     

    Attached Files:

  25. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    I'm having some trouble understanding that stacktrace.txt file, sorry. Can you point me to the specific line numbers where the call stack for the crashing thread is listed?
     
  26. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson you can search this: "Il2CppComDelegate_Finalize". Line 605.
     
  27. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    Thanks - I see that frame in three threads, starting on lines 601, 769, and 789 of the log file. I'm not sure how to tell which is the thread that crashed. Can you let me know how to determine that?
     
  28. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson I can see such crashes in my Crashlytic console. Here is a screenshot:
     

    Attached Files:

  29. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    I'm not too familiar with the Crashlytics UI, but I read this screen shot as indicating that the crash happened on thread #1. It looks like thread #2 might just be shown for additional context. Am I interpreting that screen shot correctly?
     
  30. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson I'm not sure, I just point, that the Crashlytics has the same lines as there before workaround.
    Also Crashlytics points that the crash on the 1st thread happened while the second thread was doing it's job. Probably they are connected.
    Here's another screenshot.
     

    Attached Files:

  31. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    Thanks for the details. I do think this might be a different issue than the one being discussed on this thread, unfortunately. I don't see enough similarities in the call stacks. But I might be missing something - why do you feel it is the same issue?
     
  32. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson because the first message in this thread has these logs:
    Code (CSharp):
    1. libil2cpp.so __Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C
    2. 7 libil2cpp.so __Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C
     
  33. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    I'm not seeing that part of the call stack in any of the other messages in this thread though. Maybe I'm missing something. Is there a message in this thread that links the call stacks you are seeing to the problem we are discussing here?

    I suspect that you are seeing a problem, but I'm trying to understand how or why it is linked to this issue.
     
  34. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson here is screenshot of the first message in this thread:
     

    Attached Files:

    • dasd.png
      dasd.png
      File size:
      230.5 KB
      Views:
      23
  35. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    Ahh thank you - this thread is long enough that I had missed that.

    Ok - so I don't think your crash is the same as this one. This crash was really about the UnityJavaProxy - the fact that Il2CppComDelegate_Finalize show up in both is probably a red herring, as that frame is pretty general.

    With that said, I'm not sure what is causing the crash in your case unfortunately. I'm guessing you cannot reproduce this locally - but I need to ask. Is this something you can reproduce?
     
  36. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson it's a pity but can't reproduce locally. But it happens in all my projects which use Unity 2021.3.x
    Regarding the "finalize" lines and "UnityJavaProxy" there is also such crash for my project, maybe it is connected to the thread:

    Code (CSharp):
    1. Crashed: Thread: SIGSEGV  0x00000000e59f0958
    2. #00 pc 0x45714c libil2cpp.so (il2cpp::vm::GlobalMetadata::InitializeRuntimeMetadata(unsigned int*, bool)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    3. #01 pc 0x18f0902 libil2cpp.so (_AndroidJNIHelper_Unbox_m7D786B14E4A90E5411FC9AA7F985451DEBC95731) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    4. #02 pc 0x207623a libil2cpp.so (__Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    5. #03 pc 0x18f0916 libil2cpp.so (_AndroidJNIHelper_Unbox_m7D786B14E4A90E5411FC9AA7F985451DEBC95731) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    6. #04 pc 0x2117086 libil2cpp.so (__Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    7. #05 pc 0x2117086 libil2cpp.so (__Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    8. #06 pc 0x18f077a libil2cpp.so (AndroidJavaProxy.Invoke) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    9. #07 pc 0x18f068e libil2cpp.so (AndroidReflection.SetNativeExceptionOnProxy) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    10. #08 pc 0x2076df2 libil2cpp.so (__Il2CppComDelegate_Finalize_mC9F8EA94444C3AF0A43CC723A23EE4D8B7984F8C) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    11. #09 pc 0x18f52a6 libil2cpp.so (_AndroidJNIHelper_InvokeJavaProxyMethod_mCA9BD35B5AE99B6DFABBFE9968DD1EBE931F70C2) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    12. #10 pc 0x2e5f2a libil2cpp.so (RuntimeInvoker_FalseIntPtr_t_RuntimeObject_IntPtr_t_Int32(void (*)(), MethodInfo const*, void*, void**, void*)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    13. #11 pc 0x98216 libc.so (BuildId: e8a95d2a73171dc45000479abefe26f8)
    14. #12 pc 0x2e5f4a libil2cpp.so (RuntimeInvoker_FalseIntPtr_t_RuntimeObject_IntPtr_t_IntPtr_t(void (*)(), MethodInfo const*, void*, void**, void*)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    15. #13 pc 0x398a4a libil2cpp.so (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    16. #14 pc 0x398a16 libil2cpp.so (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    17. #15 pc 0x39880a libil2cpp.so (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    18. #16 pc 0x19ace9 libunity.so (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool)) (BuildId: 36586185819407e573546ee834d2d0a0a3e51597)
    19. #17 pc 0x48b2d9 libil2cpp.so (operator new(unsigned int)) (BuildId: 3607538d41a6d0cc203f8868cd94f0116aed7f58)
    20. #18 pc 0xa629a2 libunity.so (__ashldi3) (BuildId: 36586185819407e573546ee834d2d0a0a3e51597)
    21. #19 pc 0x1a5357 libunity.so (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool)) (BuildId: 36586185819407e573546ee834d2d0a0a3e51597)
    22. #20 pc 0x720a3 libunity.so (UnityJavaProxy_invoke(_JNIEnv*, _jobject*, long long, _jstring*, _jobjectArray*)) (BuildId: 36586185819407e573546ee834d2d0a0a3e51597)
    23. #21 pc 0xabf2d2c1
    24. #22 pc 0x401975 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    25. #23 pc 0xcce89365
    26. #24 pc 0x401975 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    27. #25 pc 0x406bed libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    28. #26 pc 0x1f8643 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    29. #27 pc 0xa465f libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    30. #28 pc 0x1f8643 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    31. #29 pc 0x1cc1dd boot.oat (BuildId: 309c554a1e6b8a1a080ada6549fe151075fa023e)
    32. #30 pc 0x1f3b8b libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    33. #31 pc 0x1f3a59 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    34. #32 pc 0x3ecb93 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    35. #33 pc 0x3f067e libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    36. #34 pc 0x3f3f16 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    37. #35 pc 0x1db1ff libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    38. #36 pc 0xa4635 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    39. #37 pc 0x1df9ad libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    40. #38 pc 0x1f8643 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    41. #39 pc 0x1f3b73 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    42. #40 pc 0x1f3a59 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    43. #41 pc 0x3ecb93 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    44. #42 pc 0x3f067e libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    45. #43 pc 0x3f3f16 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    46. #44 pc 0x1db1ff libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    47. #45 pc 0x1df8fb libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    48. #46 pc 0x3e15ad libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    49. #47 pc 0x3e1247 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    50. #48 pc 0x380372 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    51. #49 pc 0x45fc06 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    52. #50 pc 0x405ef3 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    53. #51 pc 0x2417a3f libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
    54. #52 pc 0x241766d libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
    55. #53 pc 0x2ae8b7 boot.oat (BuildId: 309c554a1e6b8a1a080ada6549fe151075fa023e)
    56. #54 pc 0x401975 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    57. #55 pc 0x406bed libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    58. #56 pc 0x2417a3f libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
    59. #57 pc 0x241766d libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
    60. #58 pc 0x245fa99 libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
    61. #59 pc 0xa465f libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    62. #60 pc 0x35458b libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    63. #61 pc 0x245f9c3 libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
    64. #62 pc 0x37c8a3 libart.so (BuildId: 7d2204ce250005a94e8fa26e1e656404)
    65. #63 pc 0x41e70a libmonochrome.so (BuildId: d3adb075d9cfcf21163320e2bb84e7f4e73c43cf)
     
  37. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    This does look closer to the issue that was corrected. Does this happen with 2021.3.33, where the issue discussed here should be corrected?
     
  38. Shefich

    Shefich

    Joined:
    May 23, 2013
    Posts:
    143
    @JoshPeterson yes this happens on Unity 2021.3.33. Can't be reproduced locally.
     
  39. Alan-Liu

    Alan-Liu

    Joined:
    Jan 23, 2014
    Posts:
    391
    I made a small modification to my original reproducible project for UUM-49357. It can now reproduce two new crashes in Unity 2021.3.33, which might be related to the crash discussed above:
    Code (CSharp):
    1. Version '2021.3.33f1 (ee5a2aa03ab2)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'armeabi-v7a'
    2. Build fingerprint: 'Redmi/dandelion_cn/dandelion:11/RP1A.200720.011/V12.5.4.0.RCZCNXM:user/release-keys'
    3. Revision: '0'
    4. ABI: 'arm'
    5. pid: 15914, tid: 16007, name: Thread-23  >>> com.DefaultCompany.AndroidJavaProxyCrash <<<
    6. uid: 10233
    7. signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
    8. Cause: null pointer dereference
    9.     r0  00000000  r1  bfee4e50  r2  00000001  r3  aff21ddc
    10.     r4  c13fc626  r5  00000000  r6  00000000  r7  00000000
    11.     r8  00000000  r9  aff21df8  r10 00000000  r11 00000000
    12.     ip  c154abcc  sp  aff21dc0  lr  c0f1b845  pc  bfec1690
    13. backtrace:
    14.       #00 pc 001ef690 (il2cpp::metadata::CustomAttributeDataReader::GetCtorIterator() at C:/Program Files\Unity\Hub\Editor\2021.3.33f1\Editor\Data\il2cpp\libil2cpp\metadata/CustomAttributeDataReader.cpp:116)  /data/app/~~T2m0Xs5RYAc0TEn8CBDRmg==/com.DefaultCompany.AndroidJavaProxyCrash-58p-2GYsNn2NO5ZEsJrNog==/lib/arm/libil2cpp.so (jinfo_get_method) (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    15.       #01 pc 00189841 (Scripting::LogExceptionFromManaged(ScriptingExceptionPtr, int, char const*, bool, Scripting::LogExceptionFromMangedSettings const*) at libgcc2.c:?)  /data/app/~~T2m0Xs5RYAc0TEn8CBDRmg==/com.DefaultCompany.AndroidJavaProxyCrash-58p-2GYsNn2NO5ZEsJrNog==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    16.       #02 pc 00188fbb (Scripting::LogException(ScriptingExceptionPtr, int, char const*, bool) at libgcc2.c:?)  /data/app/~~T2m0Xs5RYAc0TEn8CBDRmg==/com.DefaultCompany.AndroidJavaProxyCrash-58p-2GYsNn2NO5ZEsJrNog==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    17.       #03 pc 000672bb (UnityJavaProxy_LogJNIInvokeException(_JNIEnv*, _jobject*, long long) at libgcc2.c:?)  /data/app/~~T2m0Xs5RYAc0TEn8CBDRmg==/com.DefaultCompany.AndroidJavaProxyCrash-58p-2GYsNn2NO5ZEsJrNog==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    18.       #04 pc 000035df  /data/app/~~T2m0Xs5RYAc0TEn8CBDRmg==/com.DefaultCompany.AndroidJavaProxyCrash-58p-2GYsNn2NO5ZEsJrNog==/oat/arm/base.odex
    Code (CSharp):
    1. Version '2021.3.33f1 (ee5a2aa03ab2)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'armeabi-v7a'
    2. Build fingerprint: 'Redmi/dandelion_cn/dandelion:11/RP1A.200720.011/V12.5.4.0.RCZCNXM:user/release-keys'
    3. Revision: '0'
    4. ABI: 'arm'
    5. pid: 16592, tid: 16679, name: Thread-17  >>> com.DefaultCompany.AndroidJavaProxyCrash <<<
    6. uid: 10235
    7. signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x40003bf1
    8.     r0  40003bed  r1  00000001  r2  00000000  r3  00000005
    9.     r4  cf5f3288  r5  b451f920  r6  40003bed  r7  00000000
    10.     r8  c00e38c4  r9  cf5eea08  r10 cf5fbcc0  r11 00000000
    11.     ip  00000000  sp  af6a49c8  lr  bf4cd5e0  pc  bf41c138
    12. backtrace:
    13.       #00 pc 0020b138 (il2cpp::vm::Class::FromIl2CppType(Il2CppType const*, bool) at C:/Program Files\Unity\Hub\Editor\2021.3.33f1\Editor\Data\il2cpp\libil2cpp\vm/Class.cpp:65)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    14.       #01 pc 002bc5dc (il2cpp::vm::Type::GetTypeFromHandle(int) at C:/Program Files\Unity\Hub\Editor\2021.3.33f1\Editor\Data\il2cpp\libil2cpp\vm/Type.cpp:1115)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    15.       #02 pc 008b1464 (Type_internal_from_handle_m0747FFFEFFCA22D764E069CA2EC64E666294D7E5 at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__4.cpp:13906)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    16.       #03 pc 008d54cc (MonoCustomAttrs_GetCustomAttributes_m77AB7AE8BA867E111261F1A957316CB088887999 at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    17.       #04 pc 008e6910 (MonoCustomAttrs_RetrieveAttributeUsageNoCache_mAB4FF4CAF843663D4C83948F991560C985AEBA7D at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__5.cpp:35364)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    18.       #05 pc 008e3bd0 (MonoCustomAttrs_RetrieveAttributeUsage_m6F89E13BBFC1325FBDB3F17C2462C80FD98FA18F at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__5.cpp:35497)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    19.       #06 pc 008d5d88 (MonoCustomAttrs_IsDefined_m5A1B0621CF7CC74C9B7544071FBB46A7074A477D at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__5.cpp:34672)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    20.       #07 pc 0085fc64 (StackTrace_GetFullNameForStackTrace_m4B2BACBB18F8441E1D601567D3A9E7D6E2B16F01 at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__17.cpp:9228)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    21.       #08 pc 0085f5b8 (StackTrace_AddFrames_mFD2C38B4281C8B800FC463FD96DF39DA57BF13A9 at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__17.cpp:8911)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    22.       #09 pc 00860958 (StackTrace_ToString_m46323EE6573660B32A02BA5BC774FC1D1F529717 at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__17.cpp:9838)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    23.       #10 pc 008caabc (Environment_GetStackTrace_m4EAE34F63F727FCECFFF4BAC4514B9374E94A468 at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/mscorlib__5.cpp:26677)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    24.       #11 pc 009dd3a0 (VirtualFuncInvoker0<String_t*>::Invoke(unsigned short, Il2CppObject*) at D:/Downloads/AndroidJavaProxyCrash/Library/Bee/artifacts/Android/il2cppOutput/cpp/UnityEngine.CoreModule.cpp:42)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    25.       #12 pc 001f688c (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**) at C:/Program Files\Unity\Hub\Editor\2021.3.33f1\Editor\Data\il2cpp\libil2cpp\vm/Runtime.cpp:580)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    26.       #13 pc 001f66e8 (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) at C:/Program Files\Unity\Hub\Editor\2021.3.33f1\Editor\Data\il2cpp\libil2cpp\vm/Runtime.cpp:566)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libil2cpp.so (BuildId: 019c9e0e4249532d72e7015393acfceb0a44745b)
    27.       #14 pc 0017e199 (scripting_method_invoke(ScriptingMethodPtr, ScriptingObjectPtr, ScriptingArguments&, ScriptingExceptionPtr*, bool) at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    28.       #15 pc 0018865d (ScriptingInvocation::Invoke(ScriptingExceptionPtr*, bool) at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    29.       #16 pc 0017e7f5 (scripting_stack_trace_info_for(ScriptingExceptionPtr, StackTraceInfo&) at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    30.       #17 pc 001897d1 (Scripting::LogExceptionFromManaged(ScriptingExceptionPtr, int, char const*, bool, Scripting::LogExceptionFromMangedSettings const*) at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    31.       #18 pc 00188fbb (Scripting::LogException(ScriptingExceptionPtr, int, char const*, bool) at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    32.       #19 pc 000672bb (UnityJavaProxy_LogJNIInvokeException(_JNIEnv*, _jobject*, long long) at libgcc2.c:?)  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/lib/arm/libunity.so (BuildId: 4b2ca256b00c651f3345be43b4c2b81d2e5ad45f)
    33.       #20 pc 000035df  /data/app/~~ph4dYeGdzmgqQKr0a0Mzsw==/com.DefaultCompany.AndroidJavaProxyCrash-gXTdeKmxVHBvr9LtjecOmQ==/oat/arm/base.odex
    The diff of the reproducible project which was posted here:
    Code (CSharp):
    1. Assets/Test.cs | 2 +-
    2. 1 file changed, 1 insertion(+), 1 deletion(-)
    3.  
    4. diff --git a/Assets/Test.cs b/Assets/Test.cs
    5. index b9ea18e..76fd05e 100644
    6. --- a/Assets/Test.cs
    7. +++ b/Assets/Test.cs
    8. @@ -11,7 +11,7 @@ public class MyCallback : AndroidJavaProxy
    9.      public void Foo()
    10.      {
    11. -        Debug.Log("Foo");
    12. +        throw new System.Exception("xxx");
    13.      }
    14. }
    15.  
    The new reproducible project has been submitted: IN-65195

    UPDATE:
    After further investigation, it seems the first crash happened because AndroidJavaProxy itself is not thread safe when processing the thrown exception, not sure if it's by design. And the second crash seems to be the same as this issue.

    UPDATE 2:
    Unity QA has reproduced the the crash: https://issuetracker.unity3d.com/is...-an-exception-is-called-from-multiple-threads
     
    Last edited: Jan 11, 2024
  40. JoshPeterson

    JoshPeterson

    Unity Technologies

    Joined:
    Jul 21, 2014
    Posts:
    6,926
    Excellent! So the second crash is one we are actively working to correct now.

    For the first one, I'm not sure about the thread safety guarantees of AndroidJavaProxy. I'll see if we can check into that though.
     
  41. MaximPP

    MaximPP

    Joined:
    Jan 26, 2019
    Posts:
    76
    I updated to Unity 2022.3.16 and LevelPlay 7.7.0 and it looks like the number of "GetParamCount" crashes has decreased significantly
     
    JoshPeterson likes this.