Android PAGSurface.freeCache 有个空指针崩溃

[1184893257]

Android v4.3.57 版本有个空指针崩溃，崩溃在 libffavc.so 中。
另外 release 版附带的obj 压缩包中的 libffavc.so 是没有 debug 符号的，无法进行堆栈还原。

---

Crash type: 'native'
Start time: '2024-12-19T14:46:05.604+0800'
Crash time: '2024-12-19T14:56:59.570+0800'
App version: '3.29.10.487_release_release_3.29.0'
Rooted: 'No'
API level: '29'
Build fingerprint: 'Xiaomi/olivelite/olivelite:10/QKQ1.191014.001/V12.5.3.0.QCPCNXM:user/release-keys'
ABI: 'arm'
pid: 10755, tid: 10755, name: cent.wemeet.app >>> com.tencent.wemeet.app <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
r0 00068f9e r1 00000000 r2 00000000 r3 00000000
r4 af903008 r5 00000003 r6 00000000 r7 00000000
r8 ac95f260 r9 af903044 r10 00000000 r11 70f8be00
ip ac95dd1c sp befcbf68 lr ac8d7c29 pc ac8f4b6c

backtrace:
#00 pc 0004cb6c /apex/com.android.runtime/lib/bionic/libc.so (je_large_dalloc+31)
#1 pc 0002fc25 /apex/com.android.runtime/lib/bionic/libc.so (je_free+1312)
#2 pc 0009ef58 /data/app/com.tencent.wemeet.app-G_0-JA6v4jU23OmnSq0FLw==/lib/arm/libffavc.so

build id:
/apex/com.android.runtime/lib/bionic/libc.so (BuildId: 940109a4b687bf19a1c73c8c92365f8c. FileSize: 993324. LastModified: 2009-01-01T08:00:00.000+0800. MD5: 74c8850ead8027b452649a011761be15)
/data/app/com.tencent.wemeet.app-G_0-JA6v4jU23OmnSq0FLw==/lib/arm/libffavc.so (BuildId: 5f02349476c291253571dfb07e0fe6e200000000. FileSize: 939844. LastModified: 1981-01-01T01:01:02.000+0800. MD5: 8bb007827669336cbe604b1e51bcee75)

stack:
befcbf28 afa00380 [anon:libc_malloc]
befcbf2c af903008 [anon:libc_malloc]
befcbf30 00000000
befcbf34 ac8dd28b /apex/com.android.runtime/lib/bionic/libc.so (je_arena_extents_dirty_dalloc+22)
befcbf38 45150200 [anon:libc_malloc]
befcbf3c af903008 [anon:libc_malloc]
befcbf40 ac95f260 [anon:.bss]
befcbf44 229175bb [anon:dalvik-main space (region space)]
befcbf48 af903008 [anon:libc_malloc]
befcbf4c 00000005
befcbf50 00000003
befcbf54 229175bb [anon:dalvik-main space (region space)]
befcbf58 af903008 [anon:libc_malloc]
befcbf5c 00000005
befcbf60 00000003
befcbf64 af903008 [anon:libc_malloc]
#00 befcbf68 00000003
befcbf6c 229175bb [anon:dalvik-main space (region space)]
befcbf70 af903008 [anon:libc_malloc]
befcbf74 00000003
befcbf78 00000000
befcbf7c 70c00000 /system/framework/arm/boot-framework.art
befcbf80 af90302c [anon:libc_malloc]
befcbf84 ac8d7c29 /apex/com.android.runtime/lib/bionic/libc.so (je_free+1316)
#1 befcbf88 00000001
befcbf8c 00000000
befcbf90 34318f98 [anon:libc_malloc]
befcbf94 ac95f260 [anon:.bss]
befcbf98 af903008 [anon:libc_malloc]
befcbf9c 00000001
befcbfa0 00000012
befcbfa4 ac95f260 [anon:.bss]
befcbfa8 229175bb [anon:dalvik-main space (region space)]
befcbfac 7303a089 /system/framework/arm/boot-framework.oat (android.animation.StateListAnimator.clone [DEDUPED])
befcbfb0 34689498 [anon:libc_malloc]
befcbfb4 00000000
befcbfb8 00000000
befcbfbc 50feb400 [anon:libc_malloc]
befcbfc0 53d5fdb0 [anon:libc_malloc]
befcbfc4 befcc260 [stack]
........ ........
#2 befcbfd0 00000000
befcbfd4 7303a089 /system/framework/arm/boot-framework.oat (android.animation.StateListAnimator.clone [DEDUPED])
befcbfd8 34689380 [anon:libc_malloc]
befcbfdc 546a62c0 /data/app/com.tencent.wemeet.app-G_0-JA6v4jU23OmnSq0FLw==/lib/arm/libffavc.so
befcbfe0 36cfdd68 [anon:libc_malloc]
befcbfe4 36cfdd68 [anon:libc_malloc]
befcbfe8 00000008
befcbfec befcc040 [stack]
befcbff0 befcc1e4 [stack]
befcbff4 546a6234 /data/app/com.tencent.wemeet.app-G_0-JA6v4jU23OmnSq0FLw==/lib/arm/libffavc.so
befcbff8 36cf90c0 [anon:libc_malloc]
befcbffc 546199d8 /data/app/com.tencent.wemeet.app-G_0-JA6v4jU23OmnSq0FLw==/lib/arm/libffavc.so
befcc000 38160400 [anon:libc_malloc]
befcc004 3816041c [anon:libc_malloc]
befcc008 00000000
befcc00c 54610338 /data/app/com.tencent.wemeet.app-G_0-JA6v4jU23OmnSq0FLw==/lib/arm/libffavc.so

memory near r0:
00068f7c -------- -------- -------- -------- ................
00068f8c -------- -------- -------- -------- ................
00068f9c -------- -------- -------- -------- ................
00068fac -------- -------- -------- -------- ................
00068fbc -------- -------- -------- -------- ................
00068fcc -------- -------- -------- -------- ................
00068fdc -------- -------- -------- -------- ................
00068fec -------- -------- -------- -------- ................
00068ffc -------- -------- -------- -------- ................
0006900c -------- -------- -------- -------- ................
0006901c -------- -------- -------- -------- ................
0006902c -------- -------- -------- -------- ................
0006903c -------- -------- -------- -------- ................
0006904c -------- -------- -------- -------- ................
0006905c -------- -------- -------- -------- ................
0006906c -------- -------- -------- -------- ................

memory near r4:
af902fe8 00000010 af902f88 6bc2d3e8 af97e008 ...../.....k....
af902ff8 00000004 00000000 00000001 00000000 ................
af903008 00000001 00000001 c98570d0 fb7cb645 .........p..E.|.
af903018 ca894990 00000000 a6611b58 00000000 .I......X.a.....
af903028 00000000 70000000 afa3b400 34400000 .......p......@4
af903038 451e5a00 40800000 4512cf80 50c00000 [email protected]
af903048 afabab80 51000000 afac2b80 41400000 .......Q.+....@A
af903058 45145c80 55800000 afa83500 55c00000 ..E...U.5.....U
af903068 afa90780 56000000 afa86500 96400000 .......V.e....@.
af903078 afa1f440 36800000 451b3200 4ec00000 @......6.2.E...N
af903088 afae6300 53000000 afa9f300 53400000 .c.....S......@s
af903098 afaa5300 4f800000 afae9300 53c00000 .S.....O.......S
af9030a8 afaa2300 6b800000 afa42580 34000000 .#.....k.%.....4
af9030b8 451d9400 38400000 45196600 3b000000 [email protected]...;
af9030c8 45157d80 a4000000 afa090c0 59c00000 .}.E...........Y
af9030d8 afa69c80 3b800000 45163a00 38000000 .......;.:.E...8

memory near r8:
ac95f240 00000000 afe20000 00002a03 00000000 .........*......
ac95f250 afe20008 00000000 00000000 00000000 ................
ac95f260 229175bb 00000000 00000000 00000161 .u."........a...
ac95f270 00000000 00000000 00000000 00000000 ................
ac95f280 00000000 00000000 00000000 00000000 ................
ac95f290 00000000 00000000 00000000 00000000 ................
ac95f2a0 00000000 00000000 00000000 00000000 ................
ac95f2b0 00000000 00000000 00000000 00000000 ................
ac95f2c0 00000000 00000000 00000000 ffff8f80 ................
ac95f2d0 00000000 00000000 00000000 00000000 ................
ac95f2e0 00000000 7b900230 00000000 00000000 ....0..{........
ac95f2f0 00000000 00000002 00000000 0001ff80 ................
ac95f300 00020000 00000000 00000000 00000000 ................
ac95f310 00000000 00000000 ac8c5939 00000000 ........9Y......
ac95f320 00000000 00000000 00000000 00000000 ................
ac95f330 00000000 00000000 00000000 00000000 ................

memory near r9:
af903024 00000000 00000000 70000000 afa3b400 ...........p....
af903034 34400000 451e5a00 40800000 4512cf80 [email protected][email protected]
af903044 50c00000 afabab80 51000000 afac2b80 ...P.......Q.+..
af903054 41400000 45145c80 55800000 afa83500 ..@A..E...U.5..
af903064 55c00000 afa90780 56000000 afa86500 ...U.......V.e..
af903074 96400000 afa1f440 36800000 451b3200 ..@[email protected]
af903084 4ec00000 afae6300 53000000 afa9f300 ...N.c.....S....
af903094 53400000 afaa5300 4f800000 afae9300 [email protected].....O....
af9030a4 53c00000 afaa2300 6b800000 afa42580 ...S.#.....k.%..
af9030b4 34000000 451d9400 38400000 45196600 [email protected]
af9030c4 3b000000 45157d80 a4000000 afa090c0 ...;.}.E........
af9030d4 59c00000 afa69c80 3b800000 45163a00 ...Y.......;.:.E
af9030e4 38000000 45192d80 afa00380 afa00380 ...8.-.E........
af9030f4 af90a000 00000000 00000000 00000000 ................
af903104 00000000 00000000 00000000 00000000 ................
af903114 00000000 00000000 00000000 00000000 ................

memory near r11:
70f8bde0 00000000 73cdc029 70bae5e0 10081041 ....)..s...pA...
70f8bdf0 005267c8 0000e949 00000000 00000000 .gR.I...........
70f8be00 7303a089 70bae5e0 10080001 00526ac4 ...s...p.....jR.
70f8be10 0000e94a 0000000e 00000000 73cdc151 J...........Q..s
70f8be20 70bae5e0 10080001 005267e4 0000e94c ...p.....gR.L...
70f8be30 0000000f 00000000 73cdc2a9 70bae5e0 ...........s...p
70f8be40 10080001 00526800 0000e94d 00000010 .....hR.M.......
70f8be50 00000000 73cdc2f1 70bae5e0 10080001 .......s...p....
70f8be60 005266d8 0000e94e 00000011 00000000 .fR.N...........
70f8be70 73cdc3f9 70bae5e0 10080001 00526708 ...s...p.....gR.
70f8be80 0000e94f 00000012 00000000 73cdc4c1 O..............s
70f8be90 70bae5e0 00080001 00526748 0000e950 ...p....HgR.P...
70f8bea0 00000013 00000000 73cdc579 70bae5e0 ........y..s...p
70f8beb0 10080001 00526930 0000e951 00000014 ....0iR.Q.......
70f8bec0 00000000 73cdc691 70bae5e0 10080001 .......s...p....
70f8bed0 00526b60 0000e952 00000015 00000000 `kR.R...........

memory near ip:
ac95dcfc ac94fb71 ac93f68c ac906c57 ac902e69 q.......Wl..i...
ac95dd0c adaaf03f ac94f72d acabdbe4 ac90e875 ?...-.......u...
ac95dd1c ac94eebd acabdbe4 ac94ef05 ac9505b5 ................
ac95dd2c acabdbd4 ac8d1019 ac93fdc4 ac90a23d ............=...
ac95dd3c ac90ff61 ac934fd1 ac901a6d ac8d3205 a....O..m....2..
ac95dd4c ac94f011 acabdbe4 acabdbd0 acabdbcc ................
ac95dd5c acabdbd4 acabddec ac902204 ac90fd49 ........."..I...
ac95dd6c ac934ff1 ac94ef85 ac94efab ac94ef8d .O..............
ac95dd7c ac9016ad ac912a3d ac93fa84 ac93fa04 ....=*..........
ac95dd8c ac93f89c ac901449 acabdbcc ac94ee31 ....I.......1...
ac95dd9c afe3e481 ac94c32d ac902350 ac902350 ....-...P#..P#..
ac95ddac ac9035b8 ac901415 ac93f5e4 ac910955 .5..........U...
ac95ddbc ac9109d9 ac910a99 ac910ad1 ac90309d .............0..
ac95ddcc ac922e29 ac934eb9 ac922fc9 acabd6a4 )....N.../......
ac95dddc ac9532d4 ac901ed4 8250ba99 ac93f404 .2........P.....
ac95ddec ac906dc5 ac948765 ac949df5 ac8d11cd .m..e...........

memory near sp:
befcbf48 af903008 00000005 00000003 229175bb .0...........u."
befcbf58 af903008 00000005 00000003 af903008 .0...........0..
befcbf68 00000003 229175bb af903008 00000003 .....u.".0......
befcbf78 00000000 70c00000 af90302c ac8d7c29 .......p,0..)|..
befcbf88 00000001 00000000 34318f98 ac95f260 ..........14... befcbf98 af903008 00000001 00000012 ac95f260 .0.............
befcbfa8 229175bb 7303a089 34689498 00000000 .u."...s..h4....
befcbfb8 00000000 50feb400 53d5fdb0 befcc260 .......P...S... befcbfc8 befcc1e4 546a3f5c 00000000 7303a089 ....\?jT.......s befcbfd8 34689380 546a62c0 36cfdd68 36cfdd68 ..h4.bjTh..6h..6 befcbfe8 00000008 befcc040 befcc1e4 546a6234 [email protected] befcbff8 36cf90c0 546199d8 38160400 3816041c ...6..aT...8...8 befcc008 00000000 54610338 33924190 38160400 ....8.aT.A.3...8 befcc018 00000000 befcc040 befcc1e4 5461a14c [email protected] befcc028 33924188 33924190 befcc1e4 5460eeb5 .A.3.A.3......T
befcc038 33924188 3ba2c910 befcc050 5460eeed .A.3...;P.....`T

memory near lr:
ac8d7c08 9000f8ca f3cb6281 eb003009 eb010040 .....b...0..@...
ac8d7c18 28000080 ae88f47f 46202100 ff92f01c ...(.....! F....
ac8d7c28 48cae620 4478212c fb066800 48c80101 ..H,!xD.h.....H
ac8d7c38 68004478 46586802 e6d24790 f8504620 xD.h.hXF.G.. FP.
ac8d7c48 42b91fac 809af040 eb042101 f85303c1 ...B@....!....S.
ac8d7c58 2a002fa8 aeaef43f 01c1eb08 60066f8e ./.*?........o. ac8d7c68 60186fc8 0000f8d9 f8d96788 67c80004 .o......g.....g
ac8d7c78 7200e9c9 3009f3cb 0040eb00 0080eb02 ...r...0..@.....
ac8d7c88 f47f2800 e695ada4 10a4f8d4 f04042b9 .(...........B@.
ac8d7c98 f8d48083 b19110a8 00a4f8c4 00c5eb04 ................
ac8d7ca8 f8c46a82 f8c920a8 62817000 3009f3cb .j... ...p.b...0
ac8d7cb8 0040eb00 0080eb01 f47f2800 f8d9aecd ..@......(......
ac8d7cc8 42b80000 ae21f43f 10a4f8d4 f04042b9 ...B?.!......B@.
ac8d7cd8 f8d480a2 290010a8 f8c4d09e eb0400a4 .......)........
ac8d7ce8 6a8200c5 20a8f8c4 7000f8c9 46a4e78a ...j... ...p...F
ac8d7cf8 0fb4f85c d1744548 eb042102 f85303c1 ...HEt..!....S.

memory near pc:
ac8f4b4c 41f0e92d 4604b082 460e4828 27002300 -..A...F(H.F.#.'
ac8f4b5c 44784632 8000f8d0 0000f8d8 48249001 2FxD..........$H
ac8f4b6c 44786809 311ff36f eb006800 e8d00081 .hxDo..1.h......
ac8f4b7c 46205faf f7ff4629 466aff49 46294620 ._ F)F..I.jF F)F
ac8f4b8c 97004633 fb70f7e8 f643b19c 58283030 3F....p...C.00(X
ac8f4b9c f8d46801 280000ec 6862bf18 428abf18 .h.....(..bh...B
ac8f4bac eb00d90f b12000c1 1e4a6801 60022900 ...... ..hJ..). ac8f4bbc f8d8dd0d 99010000 d1151a40 e8bdb002 ........@....... ac8f4bcc 462081f0 f81cf7df d1ed2800 6841e7f1 .. F.....(....Ah ac8f4bdc 23002200 46206001 f7e84629 f8d8ff5d .".#. F)F..]...
ac8f4bec 99010000 d0e91a40 ef44f060 00068eee ....@....D..... ac8f4bfc 00068f9e 4604b510 4478480a 68026800 .......F.HxD.h.h ac8f4c0c 2000b122 e8bd4621 47104010 f0604620 ".. [email protected] F.
ac8f4c1c 4603ef1a 21022004 e8bd4622 f0604010 ...F. .!"F...@. ac8f4c2c bf00ba53 00068f2e 4608b510 f060460c S..........F.F.
ac8f4c3c 4603ef0a 21022004 e8bd4622 f0604010 ...F. .!"F...@`.

memory info:
System Summary (From: /proc/meminfo)
MemTotal: 3719964 kB
MemFree: 118548 kB
MemAvailable: 1062912 kB
Buffers: 19644 kB
Cached: 1078844 kB
SwapCached: 14224 kB
Active: 1721880 kB
Inactive: 844244 kB
Active(anon): 1148460 kB
Inactive(anon): 407360 kB
Active(file): 573420 kB
Inactive(file): 436884 kB
Unevictable: 83412 kB
Mlocked: 83412 kB
HighTotal: 3049468 kB
HighFree: 16268 kB
LowTotal: 670496 kB
LowFree: 102280 kB
SwapTotal: 1572860 kB
SwapFree: 825124 kB
Dirty: 600 kB
Writeback: 0 kB
AnonPages: 1549504 kB
Mapped: 356784 kB
Shmem: 4452 kB
Slab: 195772 kB
SReclaimable: 54936 kB
SUnreclaim: 140836 kB
KernelStack: 28312 kB
PageTables: 86180 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 3432840 kB
Committed_AS: 43820960 kB
VmallocTotal: 307200 kB
VmallocUsed: 0 kB
VmallocChunk: 0 kB
CmaTotal: 184320 kB
CmaFree: 0 kB

Process Status (From: /proc/PID/status)
Name: cent.wemeet.app
Umask: 0077
State: t (tracing stop)
Tgid: 10755
Ngid: 0
Pid: 10755
PPid: 531
TracerPid: 13356
Uid: 10140 10140 10140 10140
Gid: 10140 10140 10140 10140
FDSize: 1024
Groups: 3001 3002 3003 9997 20140 50140
VmPeak: 2604224 kB
VmSize: 2526088 kB
VmLck: 100 kB
VmPin: 0 kB
VmHWM: 387076 kB
VmRSS: 315596 kB
RssAnon: 174020 kB
RssFile: 141088 kB
RssShmem: 488 kB
VmData: 1261440 kB
VmStk: 8192 kB
VmExe: 20 kB
VmLib: 402576 kB
VmPTE: 1494 kB
VmPMD: 0 kB
VmSwap: 17172 kB
Threads: 180
SigQ: 0/27454
SigPnd: 0000000000000000
ShdPnd: 0000000000000000
SigBlk: 0000000080001600
SigIgn: 0000000000000001
SigCgt: 0000000e400084fc
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 0000000000000000
CapAmb: 0000000000000000
Seccomp: 2
Speculation_Store_Bypass: unknown
Cpus_allowed: ff
Cpus_allowed_list: 0-7
Mems_allowed: 1
Mems_allowed_list: 0
voluntary_ctxt_switches: 87926
nonvoluntary_ctxt_switches: 71825

Process Limits (From: /proc/PID/limits)
Limit Soft Limit Hard Limit Units
Max cpu time unlimited unlimited seconds
Max file size unlimited unlimited bytes
Max data size unlimited unlimited bytes
Max stack size 8388608 unlimited bytes
Max core file size 0 unlimited bytes
Max resident set unlimited unlimited bytes
Max processes 27454 27454 processes
Max open files 32768 32768 files
Max locked memory 67108864 67108864 bytes
Max address space unlimited unlimited bytes
Max file locks unlimited unlimited locks
Max pending signals 27454 27454 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 40 40
Max realtime priority 0 0
Max realtime timeout unlimited unlimited us

Process Details (From: /proc/PID/smaps)
Pss Pss Shared Private Shared Private SwapPss
Total Clean Dirty Dirty Clean Clean Dirty
------ ------ ------ ------ ------ ------ ------
Native Heap 103597 0 736 103492 0 0 5846
Dalvik Heap 0 0 0 0 0 0 0
Stack 80 0 0 80 0 0 0
Ashmem 176 0 44 160 0 0 0
Gfx dev 6244 0 0 6244 0 0 0
Other dev 72 0 216 0 0 64 0
.so mmap 63558 53700 1016 7468 16612 53700 276
.jar mmap 3099 1668 0 0 10776 1668 0
.apk mmap 18245 16604 0 148 5456 16604 0
.ttf mmap 1083 796 0 0 780 796 0
.dex mmap 17238 7824 0 8268 2308 7824 612
.oat mmap 1804 68 0 0 19044 68 0
.art mmap 2086 16 10232 1672 100 16 16
Other mmap 599 0 132 192 480 312 0
Unknown 47242 0 696 47196 0 0 369
TOTAL 272242 80676 13072 174920 55556 81052 7119

Process Dalvik Details (From: /proc/PID/smaps)
.Boot vdex 1 0 0 0 12 0 0
.App dex 17031 7628 0 8268 2276 7628 612
.App vdex 206 196 0 0 20 196 0
.App art 4 4 0 0 0 4 0
.Boot art 2082 12 10232 1672 100 12 16

Process Summary (From: /proc/PID/smaps)
Pss(KB)
------
Java Heap: 1688
Native Heap: 103492
Code: 96544
Stack: 80
Private Other: 54168
System: 16270
TOTAL: 272242 TOTAL SWAP PSS: 7119