SIGSEGV crash on Android 6.0.1

[eicm]

I get the following crash the first time I run safeDetector.detect(), but after the first crash I don't get it any more. And I don't get any crash on older versions of android.

A/libc: invalid address or address of corrupt block 0xab516628 passed to dlfree
Fatal signal 11 (SIGSEGV), code 1, fault addr 0xd08081c in tid 14568 (Thread-251)

Any inside on this is really appreciated.

[eicm]

12-16 17:14:52.250 218-218/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
12-16 17:14:52.250 218-218/? A/DEBUG: Build fingerprint: 'google/volantis/flounder:6.0.1/MMB29K/2419427:user/release-keys'
12-16 17:14:52.251 218-218/? A/DEBUG: Revision: '0'
12-16 17:14:52.251 218-218/? A/DEBUG: ABI: 'arm'
12-16 17:14:52.252 218-218/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x808080e
12-16 17:14:52.245 218-218/? W/debuggerd: type=1400 audit(0.0:150): avc: denied { search } for name="com.google.android.gms" dev="dm-2" ino=403 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
12-16 17:14:52.281 218-218/? A/DEBUG: Abort message: 'invalid address or address of corrupt block 0xab4dc170 passed to dlfree'
12-16 17:14:52.282 218-218/? A/DEBUG: r0 abe029c8 r1 08080808 r2 00000648 r3 0808080a
12-16 17:14:52.282 218-218/? A/DEBUG: r4 0807abd0 r5 00005c38 r6 0808080a r7 08080808
12-16 17:14:52.282 218-218/? A/DEBUG: r8 00000000 r9 00000000 sl f71f7eb8 fp ab32b424
12-16 17:14:52.282 218-218/? A/DEBUG: ip ffffa3c8 sp de6d3f80 lr c3800000 pc f71c2324 cpsr 200b0030
12-16 17:14:52.275 218-218/? W/debuggerd: type=1400 audit(0.0:151): avc: denied { search } for name="com.google.android.gms" dev="dm-2" ino=403 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
12-16 17:14:52.288 218-218/? A/DEBUG: backtrace:
12-16 17:14:52.289 218-218/? A/DEBUG: #00 pc 0002f324 /system/lib/libc.so (dlmalloc_real+1191)
12-16 17:14:52.289 218-218/? A/DEBUG: #1 pc 0002f30f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.289 218-218/? A/DEBUG: #2 pc 0008a53b /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.289 218-218/? A/DEBUG: #3 pc 0008a865 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.289 218-218/? A/DEBUG: #4 pc 00080447 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #5 pc 00080ca1 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #6 pc 00044f5f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #7 pc 00075e6f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #8 pc 0003fe91 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #9 pc 00081f61 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #10 pc 00084809 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.290 218-218/? A/DEBUG: #11 pc 000dbe1b /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.291 218-218/? A/DEBUG: #12 pc 000de591 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-16 17:14:52.291 218-218/? A/DEBUG: #13 pc 02fb527b /data/app/com.google.android.gms-1/oat/arm/base.odex (offset 0x271c000)
12-16 17:14:52.506 218-218/? A/DEBUG: Tombstone written to: /data/tombstones/tombstone_00
12-16 17:14:52.506 218-218/? E/DEBUG: AM write failed: Broken pipe
12-16 17:14:52.506 613-629/? I/BootReceiver: Copying /data/tombstones/tombstone_00 to DropBox (SYSTEM_TOMBSTONE)

[pm0733464]

Do you get this same issue when you run without safeDetector?

Note that safeDetector won't be necessary anymore in the next release.

[eicm]

It does happen with the instance of the FaceDetector as well. Since it only happens at the first run after install or clean up of the app, my guess is that even though the detector.isOperational() returns true but the library hasn't been downloaded and installed.
I'm seeing this issue on a Nexus 9 with Android 6.0.1

[eicm]

@pm0733464 any thoughts on this?

[pm0733464]

Does it always crash in the same place? That is, does it always have this line with "pc 0002f30f":

12-16 17:14:52.289 218-218/? A/DEBUG: #1 pc 0002f30f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so

I was able to track down where in the code this is occurring. As best as I can tell, I think that it looks like your app was close to running out of memory when it called the face detector, and a memory allocation failed inside the native face detector code due to OOM conditions.

A known issue is that the face detector code could be more resilient to OOM. Although it wouldn't be able to succeed if not enough memory was available, it shouldn't crash either. We will make the code more resilient in the future.

I'd suggest looking at how much memory your app is using the first time that it runs, and be careful not to hold onto too many objects in memory (especially large images).

Also note that there is no benefit to passing large images to the face detector. Any image whose width or height is greater than 1280 will be scaled down to between 640 - 1280 before face detection is performed. If it is possible for your app to work with smaller images, I think that you'd be less likely to hit this issue and the app would also run a little bit faster.

[eicm]

@pm0733464

• I'm down sampling the images as long as width or height is greater than 400, and also load images in RGB_565 (assuming it doesn't affect the detection).
• I don't have anything loaded in the app at that time (user is on log in screen and I start running detection in my service as soon as user grants Read/Write permissions), the memory foot print is around 14MB at crash time.
• The crash only happens the first time I run the app and only on Android 6.
• And It crashes on the first call to the detect().

Here is log for few crashes:

12-21 14:29:15.107 218 218 F DEBUG : backtrace:
12-21 14:29:15.107 218 218 F DEBUG : #00 pc 0002f532 /system/lib/libc.so (dlmalloc_real+1717)
12-21 14:29:15.107 218 218 F DEBUG : #1 pc 0008c5df /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.107 218 218 F DEBUG : #2 pc 0008c813 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.107 218 218 F DEBUG : #3 pc 0008d803 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.107 218 218 F DEBUG : #4 pc 00044f89 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.107 218 218 F DEBUG : #5 pc 00075e6f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.107 218 218 F DEBUG : #6 pc 0003fe91 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.108 218 218 F DEBUG : #7 pc 00081f61 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.108 218 218 F DEBUG : #8 pc 00084809 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.108 218 218 F DEBUG : #9 pc 000dbe1b /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.108 218 218 F DEBUG : #10 pc 000de591 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:29:15.108 218 218 F DEBUG : #11 pc 02fb527b /data/app/com.google.android.gms-1/oat/arm/base.odex (offset 0x271c000)
12-21 14:29:15.613 218 218 F DEBUG :
12-21 14:29:15.613 218 218 F DEBUG : Tombstone written to: /data/tombstones/tombstone_07
12-21 14:29:15.614 218 218 E DEBUG : AM write failed: Broken pipe
12-21 14:30:01.201 2387 2387 I GAv4 : adb shell setprop log.tag.GAv4 DEBUG
12-21 14:30:06.805 218 218 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
12-21 14:30:06.806 218 218 F DEBUG : Build fingerprint: 'google/volantis/flounder:6.0.1/MMB29K/2419427:user/release-keys'
12-21 14:30:06.806 218 218 F DEBUG : Revision: '0'
12-21 14:30:06.806 218 218 F DEBUG : ABI: 'arm'
12-21 14:30:06.809 218 218 F DEBUG : pid: 2322, tid: 2444, name: Thread-1439 >>> com.famsee.android <<<
12-21 14:30:06.811 218 218 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x808080e
12-21 14:30:06.843 218 218 F DEBUG : Abort message: 'invalid address or address of corrupt block 0xab814e78 passed to dlfree'
12-21 14:30:06.843 218 218 F DEBUG : r0 ab7270f8 r1 08080808 r2 00000d68 r3 0808080a
12-21 14:30:06.843 218 218 F DEBUG : r4 0807e1b8 r5 00002650 r6 0808080a r7 08080808
12-21 14:30:06.843 218 218 F DEBUG : r8 00000000 r9 00000000 sl f71f7eb8 fp ffffffff
12-21 14:30:06.843 218 218 F DEBUG : ip ffffd9b0 sp ef5d9ac8 lr 94000000 pc f71c2324 cpsr 200b0030
12-21 14:30:06.848 218 218 F DEBUG :
12-21 14:30:06.848 218 218 F DEBUG : backtrace:
12-21 14:30:06.848 218 218 F DEBUG : #00 pc 0002f324 /system/lib/libc.so (dlmalloc_real+1191)
12-21 14:30:06.848 218 218 F DEBUG : #1 pc 0008c5df /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.848 218 218 F DEBUG : #2 pc 0008caf5 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.848 218 218 F DEBUG : #3 pc 0008d80f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.849 218 218 F DEBUG : #4 pc 00044f89 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.849 218 218 F DEBUG : #5 pc 00075e6f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.849 218 218 F DEBUG : #6 pc 0003fe91 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.849 218 218 F DEBUG : #7 pc 00081f61 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.849 218 218 F DEBUG : #8 pc 00084809 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.850 218 218 F DEBUG : #9 pc 000dbe1b /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.850 218 218 F DEBUG : #10 pc 000de591 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:30:06.850 218 218 F DEBUG : #11 pc 02fb527b /data/app/com.google.android.gms-1/oat/arm/base.odex (offset 0x271c000)
12-21 14:30:07.059 218 218 F DEBUG :
12-21 14:30:07.059 218 218 F DEBUG : Tombstone written to: /data/tombstones/tombstone_08
12-21 14:30:07.059 218 218 E DEBUG : AM write failed: Broken pipe
12-21 14:40:41.157 11909 11923 I GAv4 : adb shell setprop log.tag.GAv4 DEBUG
12-21 14:40:52.571 218 218 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
12-21 14:40:52.572 218 218 F DEBUG : Build fingerprint: 'google/volantis/flounder:6.0.1/MMB29K/2419427:user/release-keys'
12-21 14:40:52.573 218 218 F DEBUG : Revision: '0'
12-21 14:40:52.573 218 218 F DEBUG : ABI: 'arm'
12-21 14:40:52.574 218 218 F DEBUG : pid: 11954, tid: 12052, name: Thread-1455 >>> com.famsee.android <<<
12-21 14:40:52.575 218 218 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xd08080c
12-21 14:40:52.642 218 218 F DEBUG : Abort message: 'invalid address or address of corrupt block 0xab831f68 passed to dlfree'
12-21 14:40:52.643 218 218 F DEBUG : r0 ab0e8e60 r1 0000000c r2 00000005 r3 0d080808
12-21 14:40:52.643 218 218 F DEBUG : r4 ab60a868 r5 000057b8 r6 00000058 r7 017fffff
12-21 14:40:52.643 218 218 F DEBUG : r8 00000000 r9 ab60a868 sl ffffffe3 fp ef5d9b28
12-21 14:40:52.644 218 218 F DEBUG : ip 000001f0 sp ef5d9ab8 lr dc000000 pc f71c228c cpsr 600b0030
12-21 14:40:52.652 218 218 F DEBUG :
12-21 14:40:52.652 218 218 F DEBUG : backtrace:
12-21 14:40:52.654 218 218 F DEBUG : #00 pc 0002f28c /system/lib/libc.so (dlmalloc_real+1039)
12-21 14:40:52.654 218 218 F DEBUG : #1 pc 0002f30f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.654 218 218 F DEBUG : #2 pc 0008c7ed /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.654 218 218 F DEBUG : #3 pc 0008d803 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.655 218 218 F DEBUG : #4 pc 00044f89 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.655 218 218 F DEBUG : #5 pc 00075e6f /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.655 218 218 F DEBUG : #6 pc 0003fe91 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.655 218 218 F DEBUG : #7 pc 00081f61 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.655 218 218 F DEBUG : #8 pc 00084809 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.655 218 218 F DEBUG : #9 pc 000dbe1b /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.656 218 218 F DEBUG : #10 pc 000de591 /data/data/com.google.android.gms/files/com.google.android.gms.vision/face/libs/armeabi-v7a/libmobile_vision_face.so
12-21 14:40:52.656 218 218 F DEBUG : #11 pc 02fb527b /data/app/com.google.android.gms-1/oat/arm/base.odex (offset 0x271c000)

[pm0733464]

Thanks, I'll look at this some more. I wonder if the .so file is just corrupted on the device?

You might try clearing the library from the device and downloading again, to see if you still get the same issue. Try this:

adb root
adb shell rm -rf /data/data/com.google.android.gms/files/com.google.android.gms.vision

[eicm]

@pm0733464
I'll root my device and will test that, unfortunately on the emulator using the marshmallow image w google API, the "dev tools" app crashes when I try to load media store w test images so I'm not able to test it on the emulator.

Looks like permission is not granted.
Either enable permission in app info or request for permission at runtime.

12-16 17:14:52.245 218-218/? W/debuggerd: type=1400 audit(0.0:150): avc: denied { search } for name="com.google.android.gms" dev="dm-2" ino=403 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0

[silentnuke]

Hi there,

I faced the similar issue on Android 4.4.4 with latest vision library (9.6.1).
10-11 00:43:42.749 10590-10590/? I/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad
10-11 00:43:42.749 10590-10590/? I/DEBUG: Abort message: 'invalid address or address of corrupt block 0x63c1c0f0 passed to dlfree'

As per my investigations, I noticed that the problem occurs when image height is not a multiple of two (probably 4). e.g. 102x1295.

[pm0733464]

We'll have to look into this. In the mean time, I'd suggest adapting this class to work around specific image sizes that are problematic for you:

https://github.com/googlesamples/android-vision/blob/9278a0cfc7074846834dbfbded967c7fe8fafe23/visionSamples/photo-demo/app/src/main/java/com/google/android/gms/samples/vision/face/patch/SafeFaceDetector.java

This class wraps the face detector and can pad the size of the image to avoid problems like this.

[silentnuke]

@pm0733464 yeah, that was my plan.
I just wanted to let you know about repros ;-)