I always got a crash report from libart-compiler.so in android 8.1.0 and what it's all about?
this bug can happen at any time,anyone knows how to fix it ?
--------- beginning of crash
08-03 09:50:00.972 2566 2572 F libc : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x9b045e80 in tid 2572 (Jit thread pool), pid 2566 (r.iot.show.core)
08-03 09:50:01.175 3110 3110 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-03 09:50:01.176 3110 3110 F DEBUG : Build fingerprint: 'XHF/XHF_H003/XHF_H003:8.1.0/OPM1.171019.026/20210802-152226:userdebug/test-keys'
08-03 09:50:01.176 3110 3110 F DEBUG : Revision: '0'
08-03 09:50:01.176 3110 3110 F DEBUG : ABI: 'arm'
08-03 09:50:01.176 3110 3110 F DEBUG : pid: 2566, tid: 2572, name: Jit thread pool >>> com.iflytek.cyber.iot.show.core <<<
08-03 09:50:01.176 3110 3110 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x9b045e80
08-03 09:50:01.176 3110 3110 F DEBUG : r0 9b045e80 r1 00000045 r2 fc114286 r3 ffffffff
08-03 09:50:01.176 3110 3110 F DEBUG : r4 00000045 r5 9b253c28 r6 9b045e80 r7 9b25b240
08-03 09:50:01.176 3110 3110 F DEBUG : r8 9b25e380 r9 9b25e380 sl 00000161 fp 00000000
08-03 09:50:01.176 3110 3110 F DEBUG : ip 0000000f sp 9d9122d0 lr 9dd106db pc 9dce9cea cpsr a00d0030
08-03 09:50:01.314 3110 3110 F DEBUG :
08-03 09:50:01.314 3110 3110 F DEBUG : backtrace:
08-03 09:50:01.315 3110 3110 F DEBUG : #00 pc 000f4cea /system/lib/libart-compiler.so (art::HEnvironment::RemoveAsUserOfInput(unsigned int) const+41)
08-03 09:50:01.315 3110 3110 F DEBUG : #01 pc 0011b6d7 /system/lib/libart-compiler.so (art::LiveInterval::FindFirstRegisterHint(unsigned int*, art::SsaLivenessAnalysis const&) const+222)
08-03 09:50:01.315 3110 3110 F DEBUG : #02 pc 001142f3 /system/lib/libart-compiler.so (art::RegisterAllocatorLinearScan::TryAllocateFreeReg(art::LiveInterval*)+334)
08-03 09:50:01.315 3110 3110 F DEBUG : #03 pc 00113bd5 /system/lib/libart-compiler.so (art::RegisterAllocatorLinearScan::LinearScan()+704)
08-03 09:50:01.315 3110 3110 F DEBUG : #04 pc 00112c63 /system/lib/libart-compiler.so (art::RegisterAllocatorLinearScan::AllocateRegistersInternal()+334)
08-03 09:50:01.315 3110 3110 F DEBUG : #05 pc 00112a9d /system/lib/libart-compiler.so (art::RegisterAllocatorLinearScan::AllocateRegisters()+20)
08-03 09:50:01.315 3110 3110 F DEBUG : #06 pc 00102489 /system/lib/libart-compiler.so (art::AllocateRegisters(art::HGraph*, art::CodeGenerator*, art::PassObserver*, art::RegisterAllocator::Strategy)+284)
08-03 09:50:01.315 3110 3110 F DEBUG : #07 pc 00101dc3 /system/lib/libart-compiler.so (art::OptimizingCompiler::TryCompile(art::ArenaAllocator*, art::CodeVectorAllocator*, art::DexFile::CodeItem const*, unsigned int, art::InvokeType, unsigned short, unsigned int, art::Handle<art::mirror::ClassLoader>, art::DexFile const&, art::Handle<art::mirror::DexCache>, art::ArtMethod*, bool, art::VariableSizedHandleScope*) const+2326)
08-03 09:50:01.316 3110 3110 F DEBUG : #08 pc 001032fd /system/lib/libart-compiler.so (art::OptimizingCompiler::JitCompile(art::Thread*, art::jit::JitCodeCache*, art::ArtMethod*, bool, art::jit::JitLogger*)+612)
08-03 09:50:01.316 3110 3110 F DEBUG : #09 pc 000a09b9 /system/lib/libart-compiler.so (art::jit::JitCompiler::CompileMethod(art::Thread*, art::ArtMethod*, bool)+92)
08-03 09:50:01.316 3110 3110 F DEBUG : #10 pc 00266a55 /system/lib/libart.so (art::jit::Jit::CompileMethod(art::ArtMethod*, art::Thread*, bool)+288)
08-03 09:50:01.316 3110 3110 F DEBUG : #11 pc 0026884b /system/lib/libart.so (art::jit::JitCompileTask::Run(art::Thread*)+406)
08-03 09:50:01.316 3110 3110 F DEBUG : #12 pc 003948b9 /system/lib/libart.so (art::ThreadPoolWorker::Run()+44)
08-03 09:50:01.316 3110 3110 F DEBUG : #13 pc 003944eb /system/lib/libart.so (art::ThreadPoolWorker::Callback(void*)+90)
08-03 09:50:01.316 3110 3110 F DEBUG : #14 pc 00047b93 /system/lib/libc.so (__pthread_start(void*)+22)
08-03 09:50:01.316 3110 3110 F DEBUG : #15 pc 0001b057 /system/lib/libc.so (__start_thread+32)
Related
I want to build the React-Native code with the option to debug native code (Java & C++), what I did till now:
Clone react-native source code
Added NDK_DEBUG=1 to buildReactNdkLib gradle task - code
I had to add some files to the make file of the folly project - code
I added the command not to stip the .so files in one of the makefiles - code - actually I was sure that NDK_DEBUG=1 is doing this by default, but it wasn't
The result is that the build is passing and the so files are really not-stripped, but the app crashes in Runtime
2019-04-06 11:24:31.058 24906-24906/? A/DEBUG: pid: 24850, tid: 24890, name: mqt_js >>> com.facebook.react.uiapp <<<
2019-04-06 11:24:31.058 24906-24906/? A/DEBUG: signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
2019-04-06 11:24:31.059 24906-24906/? A/DEBUG: Abort message: 'java_vm_ext.cc:504] JNI DETECTED ERROR IN APPLICATION: JNI GetObjectRefType called with pending exception com.facebook.react.uimanager.IllegalViewOperationException: No ViewManager defined for class Text'
2019-04-06 11:24:31.059 24906-24906/? A/DEBUG: eax 00000000 ebx 00006112 ecx 0000613a edx 00000006
2019-04-06 11:24:31.059 24906-24906/? A/DEBUG: esi 0000613a edi 878553d8
2019-04-06 11:24:31.059 24906-24906/? A/DEBUG: xcs 00000073 xds 0000007b xes 0000007b xfs 0000003b xss 0000007b
2019-04-06 11:24:31.059 24906-24906/? A/DEBUG: eip ad1d7ac4 ebp 878553f8 esp 8785538c flags 00000296
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: backtrace:
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #00 pc 00000ac4 [vdso:ad1d7000] (__kernel_vsyscall+16)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #01 pc 00075b3c /system/lib/libc.so (tgkill+28)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #02 pc 0001f04e /system/lib/libc.so (abort+110)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #03 pc 0053bcbd /system/lib/libart.so (_ZN3art7Runtime5AbortEPKc+669)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #04 pc 0053c599 /system/lib/libart.so (_ZN3art7Runtime7AborterEPKc+41)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #05 pc 0011c3d3 /system/lib/libart.so (_ZNSt3__110__function6__funcIPFvPKcENS_9allocatorIS5_EES4_EclEOS3_+35)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #06 pc 0065168a /system/lib/libart.so (_ZN7android4base10LogMessageD1Ev+1034)
2019-04-06 11:24:31.070 24906-24906/? A/DEBUG: #07 pc 00386952 /system/lib/libart.so (_ZN3art9JavaVMExt8JniAbortEPKcS2_+2146)
2019-04-06 11:24:31.071 24906-24906/? A/DEBUG: #08 pc 00386bd1 /system/lib/libart.so (_ZN3art9JavaVMExt9JniAbortVEPKcS2_Pc+113)
2019-04-06 11:24:31.071 24906-24906/? A/DEBUG: #09 pc 0014ec45 /system/lib/libart.so (_ZN3art11ScopedCheck6AbortFEPKcz+69)
2019-04-06 11:24:31.072 24906-24906/? A/DEBUG: #10 pc 0014e710 /system/lib/libart.so (_ZN3art11ScopedCheck11CheckThreadEP7_JNIEnv+544)
2019-04-06 11:24:31.072 24906-24906/? A/DEBUG: #11 pc 0014d311 /system/lib/libart.so (_ZN3art11ScopedCheck22CheckPossibleHeapValueERNS_18ScopedObjectAccessEcNS_12JniValueTypeE+161)
2019-04-06 11:24:31.072 24906-24906/? A/DEBUG: #12 pc 0014c8b3 /system/lib/libart.so (_ZN3art11ScopedCheck5CheckERNS_18ScopedObjectAccessEbPKcPNS_12JniValueTypeE+1155)
2019-04-06 11:24:31.072 24906-24906/? A/DEBUG: #13 pc 0014bf36 /system/lib/libart.so (_ZN3art8CheckJNI16GetObjectRefTypeEP7_JNIEnvP8_jobject+998)
2019-04-06 11:24:31.072 24906-24906/? A/DEBUG: #14 pc 000e2fce /data/app/com.facebook.react.uiapp-uUhqD6BXzpF-7FnHQHBjIA==/lib/x86/libreactnativejni.so (_ZN7_JNIEnv16GetObjectRefTypeEP8_jobject+62)
Just found the answer, I don't need set NDK_DEBUG=1, all the not-stripped files placed under build/tmp/buildReactNdkLib/local//
You just need to configure the symbol directory in Android-Studio:
Hej
I am using yocto and meta-atmel to generate an own embedded Linux for the SAMA5D3x platform from Atmel. This includes an self written kernel module. It's a quite simple character device (chrdev), whicht toggles pins to switch on/off LEDs.
When I build it into the kernel 4.1 it worked fine. But when migrating to kernel 4.4 it crashes with a "page domain fault" at the write function.
The code till it crushes is shown below:
//! reads the commands from the i/o
static ssize_t dev_write(struct file *filp, const char *buff, size_t len, loff_t *off)
{
char * szDevice;
int deviceLen;
char * szPara;
int paraLen;
char * szValue;
int valueLen;
size_t remBytes;
char * szErrorStr;
int devIndex, paraIndx;
TBoardLed_State state;
char tb[len+1];
memcpy(tb, buff, len);
tb[len] = 0;
printk(KERN_INFO "%s: dev_write: %s (%i)\n", dSEK4Dev_indi, tb, (int) len);
The error print is:
[ 107.140000] Unhandled fault: page domain fault (0x01b) at 0x00101090
[ 107.140000] pgd = d41a4000
[ 107.140000] [00101090] *pgd=346e1831, *pte=3f5ba34f, *ppte=3f5ba83f
[ 107.140000] Internal error: : 1b [#1] ARM
[ 107.140000] Modules linked in: sek4matrixled(O) sek4comconfig(O) sek4boardled(O)
[ 107.140000] CPU: 0 PID: 428 Comm: sh Tainted: G O 4.4.19-linux4sam_5.4 #1
[ 107.140000] Hardware name: Atmel SAMA5
[ 107.140000] task: d45a0040 ti: d45b4000 task.ti: d45b4000
[ 107.140000] PC is at memcpy+0x7c/0x330
[ 107.140000] LR is at dev_write+0x2c/0x25c [sek4boardled]
[ 107.140000] pc : [<c020effc>] lr : [<bf0002f8>] psr: 00020013
sp : d45b5e74 ip : 0000000c fp : d45b5efc
[ 107.140000] r10: 00000000 r9 : d45b4000 r8 : c000f564
[ 107.140000] r7 : d45b5f88 r6 : 00101090 r5 : 00000015 r4 : d45b5ea8
[ 107.140000] r3 : 00000018 r2 : fffffff5 r1 : 00101090 r0 : d45b5ea8
[ 107.140000] Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[ 107.140000] Control: 10c53c7d Table: 341a4059 DAC: 00000051
[ 107.140000] Process sh (pid: 428, stack limit = 0xd45b4208)
[ 107.140000] Stack: (0xd45b5e74 to 0xd45b6000)
[ 107.140000] 5e60: 00000015 00101090 d45b5f88
[ 107.140000] 5e80: c000f564 d45b5ea8 d45b5ea8 bf0002f8 00000000 00000000 d45b4000 00000068
[ 107.140000] 5ea0: d45b5ed8 befff3f0 befff3f0 c0219c8c d46e07fc d45b5fb0 d45a0040 d4650540
[ 107.140000] 5ec0: 00000817 0010209c d4650574 00000055 00000800 c001674c 00000006 d457e1c0
[ 107.140000] 5ee0: bf0002cc 00101090 d45b5f88 c000f564 d45b4000 00000000 00000000 c00a2ae8
[ 107.140000] 5f00: b6f627cc 00006950 00007958 c000928c 00001000 00000000 00000000 00000000
[ 107.140000] 5f20: 57dabaed 258d097f 57dabaed 258d097f 57dabaed 258d097f 000005e5 00000000
[ 107.140000] 5f40: befff3f0 b6f62d58 b6f62d58 d457e1c0 00000015 00101090 d45b5f88 c000f564
[ 107.140000] 5f60: d45b4000 c00a32b0 00000000 0fa00000 d457e1c0 d457e1c0 00101090 00000015
[ 107.140000] 5f80: c000f564 c00a3ac8 00000000 00000000 b6fd16d0 00000015 00101090 b6f62d58
[ 107.140000] 5fa0: 00000004 c000f3a0 00000015 00101090 00000001 00101090 00000015 00000000
[ 107.140000] 5fc0: 00000015 00101090 b6f62d58 00000004 00000015 000ed124 00000001 00000000
[ 107.140000] 5fe0: 00000000 befff954 b6e8fe6c b6ee8f80 60020010 00000001 00000000 00000000
[ 107.140000] [<c020effc>] (memcpy) from [<bf0002f8>] (dev_write+0x2c/0x25c [sek4boardled])
[ 107.140000] [<bf0002f8>] (dev_write [sek4boardled]) from [<c00a2ae8>] (__vfs_write+0x1c/0xd8)
[ 107.140000] [<c00a2ae8>] (__vfs_write) from [<c00a32b0>] (vfs_write+0x90/0x16c)
[ 107.140000] [<c00a32b0>] (vfs_write) from [<c00a3ac8>] (SyS_write+0x44/0x9c)
[ 107.140000] [<c00a3ac8>] (SyS_write) from [<c000f3a0>] (ret_fast_syscall+0x0/0x3c)
[ 107.140000] Code: ea000011 e320f000 e4913004 e4914004 (e4915004)
[ 107.140000] ---[ end trace 2c62698a45a8d21d ]---
For me it looks like, that my module is not allowed to read data from userspace. But I have no idea how to overcome this error.
Any ideas?
As Tsyvarev mentioned, the input buffer needs to be copied from user space to kernel space via copy_from_user. After memcpy is replaced by copy_from_user the module works fine.
The page domain faults occurs when CONFIG_CPU_SW_DOMAIN_PAN is enabled. The CONFIG_CPU_SW_DOMAIN_PAN cannot allow the copy write directly to userspace from kernelspace.
Solution : Either remove this driver or modify your code.
I've had a kernel OOPS the other day running speaker-test on my Freescale i.MX233. Presumably happened after an attempted SIGTERM on speaker-test (it could be any other time, ). After the OOPS I could see waiting for IO running at all unused cpu time. The process invoking speaker-test couldn't be terminated either. Tried SIGKILL as well. "ps ax" was also hanging after execution.
Luckily I've managed to extract the OOPS from the messages. I've searched all over the internet but couldn't really explain everything that I'm seeing in this OOPS.
What I really can't figure out is what can actually cause this and how can I backtrace it to a specific driver. The mxs audio drivers are built-in in the kernel, so it won't be visible in the drivers list. The driver itself has been heavily modified, on request I can share parts of it.
So the kernel addresses are starting at 0xc0000000, but why is the process stack part of the kernel memory address region? Isn't that supposed to be starting downwards from kernel addresses?
Speaker-test in use is 1.0.11rc2, but I presume even if the program would end abruptly the sound architecture would close everything properly. This version of speaker-test doesn't handle signals and is not attempting to close gracefully, just gives up.
What region would 0xe1a0a024 be? Is that an ARM instruction perhaps? Meaning this will a stack overflow somewhere? I know the memory mapped registers reside in 0x80000000. What region is "pgd = c39dc000" in? Is that kernel stack?
Is it possible to get more stack dump the next time on an OOPS, so that I can possibly go further? I can change the kernel if that's necessary (I guess the I should just go to the OOPS printer to get more), but is there a configuration for this?
Any ideas? Any helps is greatly appreciated, I'm looking at this for 2 days now.
OOPS:
<1>[268811.560000] Unable to handle kernel paging request at virtual address e1a0a024
<1>[268811.560000] pgd = c39dc000
<1>[268811.560000] [e1a0a024] *pgd=00000000
<4>[268811.560000] Internal error: Oops: 5 [#1] PREEMPT
<4>[268811.560000] Modules linked in:
<4>[268811.560000] CPU: 0 Tainted: P (2.6.31-private #153)
<4>[268811.560000] PC is at vma_prio_tree_next+0x3c/0x6c
<4>[268811.560000] LR is at update_mmu_cache+0x120/0x1c4
<4>[268811.560000] pc : [<c00b98d8>] lr : [<c00611d4>] psr: a0000093
<4>[268811.560000] sp : c39c5de0 ip : c5cfa8f8 fp : c7ce7d80
<4>[268811.560000] r10: c7ce7d80 r9 : 401fb000 r8 : 401fb000
<4>[268811.560000] r7 : 00000021 r6 : c5c9b478 r5 : 00000000 r4 : 401fad94
<4>[268811.560000] r3 : e08f7007 r2 : ea00014d r1 : c39c5dec r0 : e1a0a000
<4>[268811.560000] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
<4>[268811.560000] Control: 0005317f Table: 439dc000 DAC: 00000015
<4>[268811.560000] Process speaker-test (pid: 1823, stack limit = 0xc39c4270)
<4>[268811.560000] Stack: (0xc39c5de0 to 0xc39c6000)
<4>[268811.560000] 5de0: 401fad94 c00611d4 c5f351c0 c7d34c84 00000080 00000000 00000000 c747d3c0
<4>[268811.560000] 5e00: 00000021 00000021 00000000 00000000 4507630f c04a4ec0 00000000 c5c9b478
<4>[268811.560000] 5e20: 00000000 c00bbc68 c7802060 00000000 00000200 c3a22fec 00000000 00000021
<4>[268811.560000] 5e40: 401fb000 c04a4ec0 c5c9b108 c3a22800 c39dd000 c5c9b478 c5c9b478 401fb000
<4>[268811.560000] 5e60: 00000000 00000000 c7ce7d80 c00bc69c 00000021 00000000 00000000 00000000
<4>[268811.560000] 5e80: 000001fb c39dc000 00000200 000007ec c3a22fec c5c0612c 00000010 00000000
<4>[268811.560000] 5ea0: 00000000 c749b0b0 0000000a c03b030c c5de0c00 c5c9b478 c7ce7db4 401fb290
<4>[268811.560000] 5ec0: c39c5fb0 c7ce7d80 00000017 c0060a30 c7d34cb8 00000000 00000200 00000000
<4>[268811.560000] 5ee0: 00000000 c03b030c 00000006 c03b037c 00000017 c39c5fb0 0000000b 401fb290
<4>[268811.560000] 5f00: be93295c c005a228 00000000 00000000 c7ce7d80 c00bc69c 0000000a 00000000
<4>[268811.560000] 5f20: 00000000 00000000 000001b0 c39dc000 00000200 000006c0 c3a22ec0 401c3000
<4>[268811.560000] 5f40: 00000001 00000000 40025050 c00858f8 00000021 ffffffff c5de0c00 c5c9b948
<4>[268811.560000] 5f60: 00000000 c01697e8 00000200 c5de0c00 c5c9b948 c0060ac4 c005af84 be932c38
<4>[268811.560000] 5f80: 00000008 00000000 c39c4000 ffffffff 00000006 ffffffff 00000006 be9329e8
<4>[268811.560000] 5fa0: be9329e8 0000000c 403004d0 c005ad9c 00000000 00000000 0000000c 00000000
<4>[268811.560000] 5fc0: 0000000c 00000006 be9329e8 be9329e8 0000000c 0000000b 403004d0 be93295c
<4>[268811.560000] 5fe0: 0000c718 be9328f8 401fa7bc 401fadb8 20000010 ffffffff 00000000 00000000
<4>[268811.560000] [<c00b98d8>] (vma_prio_tree_next+0x3c/0x6c) from [<c00611d4>] (update_mmu_cache+0x120/0x1c4)
<4>[268811.560000] [<c00611d4>] (update_mmu_cache+0x120/0x1c4) from [<c00bbc68>] (__do_fault+0x308/0x3ec)
<4>[268811.560000] [<c00bbc68>] (__do_fault+0x308/0x3ec) from [<c00bc69c>] (handle_mm_fault+0x298/0xc14)
<4>[268811.560000] [<c00bc69c>] (handle_mm_fault+0x298/0xc14) from [<c0060a30>] (do_page_fault+0xec/0x234)
<4>[268811.560000] [<c0060a30>] (do_page_fault+0xec/0x234) from [<c005a228>] (do_DataAbort+0x30/0x90)
<4>[268811.560000] [<c005a228>] (do_DataAbort+0x30/0x90) from [<c005ad9c>] (ret_from_exception+0x0/0x10)
<4>[268811.560000] Exception stack(0xc39c5fb0 to 0xc39c5ff8)
<4>[268811.560000] 5fa0: 00000000 00000000 0000000c 00000000
<4>[268811.560000] 5fc0: 0000000c 00000006 be9329e8 be9329e8 0000000c 0000000b 403004d0 be93295c
<4>[268811.560000] 5fe0: 0000c718 be9328f8 401fa7bc 401fadb8 20000010 ffffffff
<4>[268811.560000] Code: e2430024 e5903030 e3530000 1a000001 (e5903024)
<4>[268811.560000] ---[ end trace c70c22c7b9cf390d ]---
<6>[268811.560000] note: speaker-test[1823] exited with preempt_count 2
After some torture we have realized that this was most likely a hardware issue with memory controller, so the reason why it is very hard to understand what's there and what is happening is that because it is a random memory corruption.
For a few days, I have investigated this problem, but knowing hardly could not be.
linux version : 2.6.39
board : at91sam9x25
Processor : ARM926EJ-S rev 5
After the process has been run successfully for more than one day, displays the message oops suddenly.
look at the r0. it is measns struct kmem_cache pointer.
keme_cache pointer was initialized when linux booting.
Then the r0 is should never change.
but the oops message, the r0 is 0.. it is impossible
i don't know why the r0 was changed to 0.
i want how to debugging or answer
please help me.
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = cfb1c000
[00000000] *pgd=2fbfa831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1]
last sysfs file:
Modules linked in:
CPU: 0 Not tainted (2.6.39 #216)
PC is at kmem_cache_alloc+0x24/0x98
LR is at getname_flags+0x20/0xe8
pc : [] lr : [] psr: 40000093
sp : cfbb5f40 ip : 00000000 fp : 00000000
r10: 00000000 r9 : cfbb4000 r8 : ffffff9c
r7 : 00000000 r6 : 00000000 r5 : 40000013 r4 : 40202e7e
r3 : 40000093 r2 : 00000100 r1 : 000000d0 r0 : 00000000
Flags: nZcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control: 0005317f Table: 2fb1c000 DAC: 00000015
Process MEG (pid: 589, stack limit = 0xcfbb4270)
Stack: (0xcfbb5f40 to 0xcfbb6000)
5f40: 00000000 40202e7e 00000000 00000000 00000000 c00a1e9c 00014220 00000001
5f60: 00000000 00000000 00000005 c0094efc 00000000 00000011 00000000 00000000
5f80: 00000024 00000100 00000000 00000000 4020e040 4020dee0 00000005 c0030b28
5fa0: 00000000 c0030980 00000000 4020e040 40202e7e 00000000 00000000 00000050
5fc0: 00000000 4020e040 4020dee0 00000005 402123dc 00000000 be3ffea0 00000000
5fe0: 40202e87 be3ffd58 401d949c 401c3010 60000010 40202e7e 00000000 00000000
[] (kmem_cache_alloc+0x24/0x98) from [] (getname_flags+0x20/0xe8)
[] (getname_flags+0x20/0xe8) from [] (do_sys_open+0xa8/0x1ac)
[] (do_sys_open+0xa8/0x1ac) from [] (ret_fast_syscall+0x0/0x2c)
Code: e0016003 e10f5000 e3853080 e121f003 (e5901000)
---[ end trace d33e1f5c547d52cb ]---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 17 [#2]
last sysfs file:
Modules linked in:
CPU: 0 Tainted: G D (2.6.39 #216)
PC is at kmem_cache_free+0x18/0xcc
LR is at rcu_process_callbacks+0x6c/0x84
Blockquote
pc : [] lr : [] psr: 20000093
sp : cf833f68 ip : cf833f30 fp : 00000000
r10: 00000000 r9 : c0058dc4 r8 : cfbff540
r7 : 20000013 r6 : c042df1c r5 : cfbff540 r4 : cfbbf760
r3 : 20000093 r2 : 00000000 r1 : cfbff540 r0 : 00000000
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 0005317f Table: 2fb1c000 DAC: 00000017
Process rcu_kthread (pid: 6, stack limit = 0xcf832270)
Stack: (0xcf833f68 to 0xcf834000)
3f60: cfbbf760 cfbff540 c042df1c cf833f94 cf833fa0 c00705d0
3f80: cf815040 cf815040 cf832000 c00706a4 c031057c 00000000 cf815040 c0058dc4
3fa0: cf833fa0 cf833fa0 cf833fd4 cf81bf74 00000000 c00705e8 00000000 00000000
3fc0: 00000000 c0058a04 c003185c 00000000 00000000 00000000 cf833fd8 cf833fd8
3fe0: 00000000 cf81bf74 c0058984 c003185c 00000013 c003185c 00020018 18000004
[] (kmem_cache_free+0x18/0xcc) from [] (rcu_process_callbacks+0x6c/0x84)
[] (rcu_process_callbacks+0x6c/0x84) from [] (rcu_kthread+0xbc/0xe4)
[] (rcu_kthread+0xbc/0xe4) from [] (kthread+0x80/0x88)
[] (kthread+0x80/0x88) from [] (kernel_thread_exit+0x0/0x8)
Code: e1a08001 e10f7000 e3873080 e121f003 (e5904000)
---[ end trace d33e1f5c547d52cc ]---
Kernel panic - not syncing: Fatal exception in interrupt
[] (unwind_backtrace+0x0/0xec) from [] (panic+0x4c/0x180)
[] (panic+0x4c/0x180) from [] (die+0x180/0x1c4)
[] (die+0x180/0x1c4) from [] (__do_kernel_fault+0x64/0x84)
[] (__do_kernel_fault+0x64/0x84) from [] (do_page_fault+0x1b8/0x1d0)
[] (do_page_fault+0x1b8/0x1d0) from [] (do_DataAbort+0x34/0x94)
[] (do_DataAbort+0x34/0x94) from [] (__dabt_svc+0x4c/0x60)
Exception stack(0xcf833f20 to 0xcf833f68)
3f20: 00000000 cfbff540 00000000 20000093 cfbbf760 cfbff540 c042df1c 20000013
3f40: cfbff540 c0058dc4 00000000 00000000 cf833f30 cf833f68 c00705d0 c0093080
3f60: 20000093 ffffffff
[] (__dabt_svc+0x4c/0x60) from [] (kmem_cache_free+0x18/0xcc)
[] (kmem_cache_free+0x18/0xcc) from [] (rcu_process_callbacks+0x6c/0x84)
[] (rcu_process_callbacks+0x6c/0x84) from [] (rcu_kthread+0xbc/0xe4)
[] (rcu_kthread+0xbc/0xe4) from [] (kthread+0x80/0x88)
[] (kthread+0x80/0x88) from [] (kernel_thread_exit+0x0/0x8)
I try to work with android-ndk use. Faced such problem:
It is necessary to allocate the buffer for use on jni part, and then to release it.
I found here such realization:
functions on jni part:
jobject Java_com_domain_applicationname_FFMpegWrapper_allocNative(JNIEnv* env, jobject thiz, jlong size)
{
void* buffer = malloc(size);
jobject directBuffer = (*env)->NewDirectByteBuffer(env, buffer, size);
jobject globalRef = (*env)->NewGlobalRef(env, directBuffer);
return globalRef;
}
void Java_com_domain_applicationname_FFMpegWrapper_freeNative(JNIEnv* env, jobject thiz, jobject globalRef)
{
void *buffer = (*env)->GetDirectBufferAddress(env, globalRef);
free(buffer);
(*env)->DeleteGlobalRef(env, globalRef);
}
On the Java part I do so:
public class FFMpegWrapper {
.........
/** allocate buffer*/
public static native ByteBuffer allocNative(long bufferSize);
/** free buffer*/
public static native void freeNative(ByteBuffer buffer);
}
onCreate in MainActivity:
long bufferSize = 1024;
ByteBuffer my_buffer = FFMpegWrapper.allocNative(bufferSize);
FFMpegWrapper.logFileInfo("/storage/sdcard0/movies/126_3_17.avi");//this function I won't describe it business doesn't treat but it works it is visible from logs below
//to here everything works well
FFMpegWrapper.freeNative(my_buffer);//and here we receive a departure from the program and even the window of an exception isn't shown simply is closed activity.
LogCat:
01-14 17:53:06.924: I/com.domain.tag(22249): initialize_passed
01-14 17:53:06.964: I/com.domain.tag(22249): openened
01-14 17:53:06.964: I/ttag(22249): 3270391527096277528
01-14 17:53:06.984: I/com.domain.tag(22249): File was opened
01-14 17:53:06.984: I/com.domain.tag(22249): File '/storage/sdcard0/Movies/126_3_17.avi', Codec avi
01-14 17:53:06.984: W/dalvikvm(22249): JNI WARNING: DeleteGlobalRef on non-global 0x4780001d (type=1)
01-14 17:53:06.984: I/dalvikvm(22249): "main" prio=5 tid=1 NATIVE
01-14 17:53:06.984: I/dalvikvm(22249): | group="main" sCount=0 dsCount=0 obj=0x41065568 self=0x40ebe9a0
01-14 17:53:06.984: I/dalvikvm(22249): | sysTid=22249 nice=0 sched=0/0 cgrp=apps handle=1074450224
01-14 17:53:06.984: I/dalvikvm(22249): | schedstat=( 74908625 168640538 138 ) utm=4 stm=2 core=0
01-14 17:53:06.999: I/dalvikvm(22249): #00 pc 00001260 /system/lib/libcorkscrew.so (unwind_backtrace_thread+27)
01-14 17:53:06.999: I/dalvikvm(22249): #01 pc 0005f904 /system/lib/libdvm.so (dvmDumpNativeStack(DebugOutputTarget const*, int)+35)
01-14 17:53:06.999: I/dalvikvm(22249): #02 pc 000537ac /system/lib/libdvm.so (dvmDumpThreadEx(DebugOutputTarget const*, Thread*, bool)+303)
01-14 17:53:06.999: I/dalvikvm(22249): #03 pc 00053846 /system/lib/libdvm.so (dvmDumpThread(Thread*, bool)+25)
01-14 17:53:06.999: I/dalvikvm(22249): #04 pc 00038e02 /system/lib/libdvm.so
01-14 17:53:06.999: I/dalvikvm(22249): #05 pc 000414da /system/lib/libdvm.so
01-14 17:53:06.999: I/dalvikvm(22249): #06 pc 0002f728 /data/data/ru.dzakhov.ffmpeg.test/lib/libmylib.so (Java_ru_dzakhov_ffmpeg_test_FFMpegWrapper_freeNative+25)
01-14 17:53:06.999: I/dalvikvm(22249): #07 pc 0001de70 /system/lib/libdvm.so (dvmPlatformInvoke+112)
01-14 17:53:06.999: I/dalvikvm(22249): #08 pc 0004d0c2 /system/lib/libdvm.so (dvmCallJNIMethod(unsigned int const*, JValue*, Method const*, Thread*)+393)
01-14 17:53:06.999: I/dalvikvm(22249): #09 pc 0004f1dc /system/lib/libdvm.so (dvmResolveNativeMethod(unsigned int const*, JValue*, Method const*, Thread*)+171)
01-14 17:53:06.999: I/dalvikvm(22249): #10 pc 000272a0 /system/lib/libdvm.so
01-14 17:53:06.999: I/dalvikvm(22249): #11 pc 0002bba8 /system/lib/libdvm.so (dvmInterpret(Thread*, Method const*, JValue*)+180)
01-14 17:53:06.999: I/dalvikvm(22249): #12 pc 0005faf6 /system/lib/libdvm.so (dvmInvokeMethod(Object*, Method const*, ArrayObject*, ArrayObject*, ClassObject*, bool)+373)
01-14 17:53:06.999: I/dalvikvm(22249): #13 pc 0006709c /system/lib/libdvm.so
01-14 17:53:06.999: I/dalvikvm(22249): #14 pc 000272a0 /system/lib/libdvm.so
01-14 17:53:06.999: I/dalvikvm(22249): #15 pc 0002bba8 /system/lib/libdvm.so (dvmInterpret(Thread*, Method const*, JValue*)+180)
01-14 17:53:06.999: I/dalvikvm(22249): #16 pc 0005f830 /system/lib/libdvm.so (dvmCallMethodV(Thread*, Method const*, Object*, bool, JValue*, std::__va_list)+271)
01-14 17:53:06.999: I/dalvikvm(22249): #17 pc 000496b2 /system/lib/libdvm.so
01-14 17:53:06.999: I/dalvikvm(22249): #18 pc 0004c44e /system/lib/libandroid_runtime.so
01-14 17:53:06.999: I/dalvikvm(22249): #19 pc 0004d556 /system/lib/libandroid_runtime.so (android::AndroidRuntime::start(char const*, char const*)+389)
01-14 17:53:07.004: I/dalvikvm(22249): #20 pc 00000dce /system/bin/app_process
01-14 17:53:07.004: I/dalvikvm(22249): #21 pc 00017120 /system/lib/libc.so (__libc_init+35)
01-14 17:53:07.004: I/dalvikvm(22249): at ru.dzakhov.ffmpeg.test.FFMpegWrapper.freeNative(Native Method)
01-14 17:53:07.004: I/dalvikvm(22249): at ru.dzakhov.ffmpeg.test.MainActivity.onCreate(MainActivity.java:39)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.Activity.performCreate(Activity.java:5184)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1083)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2064)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2125)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.ActivityThread.access$600(ActivityThread.java:140)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1227)
01-14 17:53:07.004: I/dalvikvm(22249): at android.os.Handler.dispatchMessage(Handler.java:99)
01-14 17:53:07.004: I/dalvikvm(22249): at android.os.Looper.loop(Looper.java:137)
01-14 17:53:07.004: I/dalvikvm(22249): at android.app.ActivityThread.main(ActivityThread.java:4898)
01-14 17:53:07.004: I/dalvikvm(22249): at java.lang.reflect.Method.invokeNative(Native Method)
01-14 17:53:07.004: I/dalvikvm(22249): at java.lang.reflect.Method.invoke(Method.java:511)
01-14 17:53:07.004: I/dalvikvm(22249): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1006)
01-14 17:53:07.004: I/dalvikvm(22249): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:773)
01-14 17:53:07.004: I/dalvikvm(22249): at dalvik.system.NativeStart.main(Native Method)
01-14 17:53:07.004: E/dalvikvm(22249): VM aborting
01-14 17:53:07.004: A/libc(22249): Fatal signal 11 (SIGSEGV) at 0xdeadd00d (code=1), thread 22249 (hov.ffmpeg.test)
What I do incorrectly?
About JNI: http://docs.oracle.com/javase/6/docs/technotes/guides/jni/spec/design.html#wp16785
Objects are passed to native methods as local references. This means that you must store global ref on native side, if you pass global ref back to java it will be wrapped as local object. So when you try to free it later this local object passed to you code.
When you create global ref from local - free local ref if you don't need it anymore.
So you can maintain some sort of map for allocated global objects ( or for allocated buffers ) and return local reference to jobject returned by NewDirectByteBuffer.