Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Debuggable模式下，12系统崩溃 #165

Open
shuajinanhai opened this issue Feb 17, 2022 · 6 comments
Open

Debuggable模式下，12系统崩溃 #165

shuajinanhai opened this issue Feb 17, 2022 · 6 comments

Comments

@shuajinanhai
Copy link

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
Cause: null pointer dereference
x0 0000007fcda60a00 x1 000000722dc489c0 x2 0000000000000000 x3 0000000000000000
x4 0000000000000000 x5 0000000000000000 x6 4b5502ff484b5502 x7 0000000000000000
x8 0000000000000000 x9 0000000000000000 x10 0000007fcda60919 x11 0000007fcda60a00
x12 0000007fcda60b48 x13 0000007fcda6095c x14 000000722dc18b80 x15 0000000000000000
x16 000000722e211ae8 x17 00000072aff41fc0 x18 00000072d5e74000 x19 00000072d5796000
x20 0000000000000000 x21 00000072d5412a00 x22 00000072d5476c00 x23 0000007fcda60b74
x24 0000007fcda60b58 x25 0000007fcda60b40 x26 0000000000000000 x27 000000722e417000
x28 0000000000000000 x29 0000007fcda60990
lr 000000722dc24bdc sp 0000007fcda607f0 pc 000000722dc48b30 pst 0000000020000000
backtrace:
#00 pc 0000000000248b30 /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<true, false>(art::interpreter::SwitchImplContext*)+368) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#1 pc 0000000000224bd8 /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#2 pc 00000000003e0cf0 /apex/com.android.art/lib64/libart.so (art::interpreter::ExecuteSwitch(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#3 pc 00000000003d8eb8 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+216) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#4 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#5 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#6 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#7 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#8 pc 00000000003e6720 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+400) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#9 pc 00000000003e131c /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+804) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#10 pc 000000000022cbc8 /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false, false>(art::interpreter::SwitchImplContext*)+23256) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#11 pc 0000000000224bd8 /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#13 pc 00000000003e0cf0 /apex/com.android.art/lib64/libart.so (art::interpreter::ExecuteSwitch(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#14 pc 00000000003d8eb8 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+216) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#15 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#16 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#17 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#18 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#19 pc 00000000003e6720 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+400) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#20 pc 00000000003e131c /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+804) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#21 pc 000000000075ef14 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+980) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#22 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#24 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#25 pc 00000000003e0884 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+204) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#26 pc 00000000003e12f8 /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+768) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#27 pc 0000000000753ea4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+1164) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#28 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#29 pc 00000000001c695c /system/framework/framework.jar (android.app.Application.attach+0)
#30 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#31 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#32 pc 000000000021be78 /system/framework/framework.jar (android.app.Instrumentation.newApplication+24)
#33 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#34 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#35 pc 0000000000220ddc /system/framework/framework.jar (android.app.LoadedApk.makeApplication+204)
#36 pc 00000000007546c4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3244) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#37 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#38 pc 00000000001a5848 /system/framework/framework.jar (android.app.ActivityThread.handleBindApplication+1388)
#39 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#40 pc 00000000003e0884 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+204) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#41 pc 00000000003e1cdc /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, true>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+1676) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#42 pc 000000000075d1f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeDirect+1068) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#43 pc 0000000000203914 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_direct+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#44 pc 00000000001a27cc /system/framework/framework.jar (android.app.ActivityThread.access$1500+0)
#45 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#46 pc 00000000003e0884 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+204) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#47 pc 00000000003e12f8 /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+768) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#48 pc 000000000075ef14 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+980) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#49 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#50 pc 000000000019f228 /system/framework/framework.jar (android.app.ActivityThread$H.handleMessage+1536)
#51 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#52 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#53 pc 0000000000430df2 /system/framework/framework.jar (android.os.Handler.dispatchMessage+38)
#54 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#55 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#56 pc 0000000000459b20 /system/framework/framework.jar (android.os.Looper.loopOnce+312)
#57 pc 000000000075f3a8 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+2152) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#58 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#59 pc 000000000045a0bc /system/framework/framework.jar (android.os.Looper.loop+152)
#60 pc 000000000075f470 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+2352) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#61 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#62 pc 00000000001a8cde /system/framework/framework.jar (android.app.ActivityThread.main+202)
#63 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#64 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#65 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#66 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#67 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#68 pc 0000000000625688 /apex/com.android.art/lib64/libart.so!libart.so (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+1384) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#69 pc 0000000000595cb8 /apex/com.android.art/lib64/libart.so!libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*)+48) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#70 pc 00000000000b2f74 /apex/com.android.art/javalib/arm64/boot.oat (art_jni_trampoline+132) (BuildId: e9be90d95f3564cc2743d102f4b805e39746b915)
#71 pc 0000000000218964 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#72 pc 00000000002851f0 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+184) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#73 pc 00000000003e6720 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+400) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#74 pc 00000000003e131c /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+804) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#75 pc 0000000000753ea4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+1164) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#76 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#77 pc 0000000000239ec2 /system/framework/framework.jar (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+22)
#78 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#79 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#80 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#81 pc 00000000008579ec /system/framework/arm64/boot-framework.oat (com.android.internal.os.ZygoteInit.main+2172) (BuildId: 132cf3687181c15b3a66f37a365dfcd52870cc43)
#82 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#83 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#84 pc 0000000000625de8 /apex/com.android.art/lib64/libart.so!libart.so (art::JValue art::InvokeWithVarArgsart::ArtMethod*(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+448) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#85 pc 00000000006262bc /apex/com.android.art/lib64/libart.so!libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+92) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#86 pc 0000000000500324 /apex/com.android.art/lib64/libart.so!libart.so (art::JNI::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+612) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)
#87 pc 00000000000aeb28 /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+120) (BuildId: 16239c6d7fe55bcf8081fd34e682de81)
#88 pc 00000000000ba1ac /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vectorandroid::String8 const&, bool)+844) (BuildId: 16239c6d7fe55bcf8081fd34e682de81)
#89 pc 0000000000002580 /system/bin/app_process64 (main+1320) (BuildId: 1410b6f6903418cf8ba5b10d7f351072)
#90 pc 0000000000082098 /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+96) (BuildId: 4c5e8a526aee4654389c4f3c4d7219aa)
@shuajinanhai
Copy link
Author

canyie/pine#25

canyie/pine@b971bf6

@shuajinanhai
Copy link
Author

https://cs.android.com/android/platform/superproject/+/master:art/runtime/art_method.h;drc=c226211ebcf8e0185d4e46376bff6468d0c6967f;l=589

https://cs.android.com/android/platform/superproject/+/master:art/runtime/class_linker.cc;drc=5171813632baff231dc2a9b0e794a13c908ab344;l=3706

@rk700
Copy link
Member

rk700 commented Feb 25, 2022

Yes it's a known bug.

b15b08a

@shuajinanhai
Copy link
Author

but do not set native flag，hook will fail

@shuajinanhai
Copy link
Author

but do not set native flag，hook will fail in debuggable

@ghost
Copy link

ghost commented Feb 28, 2022

和Pending Hook有关，安卓12的调试模式必须使用Pending Hook，否则崩溃。
Pending Hook太麻烦，你在项目设置debuggable为false即可

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@rk700 @shuajinanhai