diagnosing segv_accerr in shared library

[r0l...@freemail.hu]

Hi All,

I'm trying to figure out why I get a SEGV_ACCERR in my app when the shared library called via ndk and jni throws an exception. The same library works fine when it throws exception when called from a native desktop app.

I upgraded my ndk to r25 but it crashed with r23 as well. I went through this page to get started:

https://source.android.com/devices/tech/debug/native-crash

The strangest thing is that in android studio I don't get such detailed dumps what that webpage presents as examples. I wanted to use addr2line to find out where things go wrong in my library but the dump contains only the runtime addresses and afaik addr2line cannot do much with that. So here is what I get in android studio:

stack:

art_sigsegv_fault 0x0000006f2a44b58c
art::FaultManager::HandleFault(int, siginfo*, void*) 0x0000006f2a44b3f8
art::SignalChain::Handler(int, siginfo*, void*) 0x00000071c40cc328
<unknown> 0x00000071ec845668
__cxxabiv1::set_registers(_Unwind_Exception*, _Unwind_Context*, __cxxabiv1::(anonymous namespace)::scan_results const&) 0x0000006e893c8c90
::__gxx_personality_v0(int, _Unwind_Action, uint64_t, _Unwind_Exception *, _Unwind_Context *) 0x0000006e893c8c78
__cxxabiv1::set_registers(_Unwind_Exception*, _Unwind_Context*, __cxxabiv1::(anonymous namespace)::scan_results const&) 0x0000006e893c8c90
::__gxx_personality_v0(int, _Unwind_Action, uint64_t, _Unwind_Exception *, _Unwind_Context *) 0x0000006e893c8c78
unwind_phase2 0x0000006e8c8f8d40
_Unwind_Resume 0x0000006e8c8f8e10
interpreter::combine_nodes(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const&, node_info const&, node_info const&) 0x0000006e8c8737c0
yy::parser::parse() 0x0000006e8c81dc98
hi(char const*, char const*, unsigned char, char const*, char const*, _JavaVM*, _jobject*, char const*, unsigned char) 0x0000006e8c822988
::Java_com_bitroller_hi_MainActivity_jhi(JNIEnv *, jclass, jstring, jstring, jstring, int, int) jhi.cpp:20
art_quick_generic_jni_trampoline 0x0000006f2a2d4048
<unknown> 0x0000006f2a2d4390

logcat:

2022-08-03 10:46:56.600 2770-2770/com.bitroller.hi A/libc: Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x6e8c909e60 in tid 2770 (om.bitroller.hi), pid 2770 (om.bitroller.hi)
2022-08-03 10:46:56.647 3108-3108/? A/libc: failed to exec crash_dump helper: Operation not permitted
2022-08-03 10:46:56.648 927-927/? E/audit: type=1400 audit(1659516416.643:128328): avc:  denied  { ptrace } for  pid=3108 comm="om.bitroller.hi" scontext=u:r:runas_app:s0:c57,c257,c512,c768 tcontext=u:r:crash_dump:s0:c57,c257,c512,c768 tclass=process permissive=0 SEPF_SM-A725F_12_0001 audit_filtered
2022-08-03 10:46:56.664 2770-2770/com.bitroller.hi A/libc: crash_dump helper failed to exec, or was killed
2022-08-03 10:46:56.665 2770-2770/com.bitroller.hi A/libc: failed to wait for crash_dump helper: No child processes

In the call stack, the method interpreter::combine_nodes throws an exception which leads to the crash. I could put some log points in the constructor of the exception and its corresponding catch block which showed that the constructor gets called but the catch block is never reached so as the call stack shows, something happens during unwind.

I tried to narrow it down if the issue is related to the execute-only memory violation which the webpage cited mentions but I debugged the app on an android 7.0 device and the same happens there so I guess, it's not the issue.

Could anyone please, help me how to figure out where the crash happens?

Thanks&regards,

r0ller

[r0l...@freemail.hu]

It turns out after two months of investigation (one before reporting this and one after that) that this unwinding problem only occurs if the native code is cross-compiled by a standalone toolchain. I had the chance to import the cpp source code of the library that crashes in android studio, compile it there and there's no more crash during unwind.