Bug report - dex2oat crashed

someone27281

type: crash
osVersion: google/bluejay/bluejay:15/AP3A.241105.007/2024110700:user/release-keys
uid: 1082 (u:r:dex2oat:s0)
cmdline: /apex/com.android.art/bin/dex2oat64 --zip-fd=5 --zip-location=/data/app/~~ROPZH56YGQBxsiAoqqzPBA==/com.snapwork.hdfc-fa9D3E6Q5n1TTsn8UROrxQ==/base.apk --oat-fd=6 --oat-location=/data/app/~~ROPZH56YGQBxsiAoqqzPBA==/com.snapwork.hdfc-fa9D3E6Q5n1TTsn8UROrxQ==/oat/arm64/base.odex --output-vdex-fd=7 --swap-fd=8 --class-loader-context-fds=9 --class-loader-context=PCL[]{PCL[/system/framework/org.apache.http.legacy.jar]} --classpath-dir=/data/app/~~ROPZH56YGQBxsiAoqqzPBA==/com.snapwork.hdfc-fa9D3E6Q5n1TTsn8UROrxQ== --dm-fd=10 --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a76 --compiler-filter=speed --compilation-reason=install-dm --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:33 --runtime-arg -Xhidden-api-policy:enabled --cpu-set=0,1,2,3 -j4 --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-name:com.snapwork.hdfc,app-version-name:11.2.4,app-version-code:181,art-version:352090000
processUptime: 88s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 30
cause: null pointer dereference
threadName: dex2oat

backtrace:
    /apex/com.android.art/lib64/libart.so (void art::HInstructionBuilder::Binop_12x<art::HAnd>(art::Instruction const&, art::DataType::Type, unsigned int)+576, pc 276070)
    /apex/com.android.art/lib64/libart.so (art::HInstructionBuilder::Build()+47260, pc 29cdac)
    /apex/com.android.art/lib64/libart.so (art::HGraphBuilder::BuildGraph()+8684, pc 2d352c)
    /apex/com.android.art/lib64/libart.so (art::HInliner::TryBuildAndInline(art::HInvoke*, art::ArtMethod*, art::ReferenceTypeInfo, art::HInstruction**, bool)+2992, pc 3fb250)
    /apex/com.android.art/lib64/libart.so (art::HInliner::TryInline(art::HInvoke*)+368, pc 3f5ad0)
    /apex/com.android.art/lib64/libart.so (art::HInliner::TryBuildAndInline(art::HInvoke*, art::ArtMethod*, art::ReferenceTypeInfo, art::HInstruction**, bool)+27020, pc 40102c)
    /apex/com.android.art/lib64/libart.so (art::HInliner::TryInline(art::HInvoke*)+368, pc 3f5ad0)
    /apex/com.android.art/lib64/libart.so (art::HInliner::Run()+312, pc 6f7578)
    /apex/com.android.art/lib64/libart.so (art::OptimizingCompiler::RunOptimizations(art::HGraph*, art::CodeGenerator*, art::DexCompilationUnit const&, art::PassObserver*, art::OptimizationDef const*, unsigned long) const+196, pc 4d1664)
    /apex/com.android.art/lib64/libart.so (art::OptimizingCompiler::RunOptimizations(art::HGraph*, art::CodeGenerator*, art::DexCompilationUnit const&, art::PassObserver*) const+816, pc 3ccc20)
    /apex/com.android.art/lib64/libart.so (art::OptimizingCompiler::TryCompile(art::ArenaAllocator*, art::ArenaStack*, art::DexCompilationUnit const&, art::ArtMethod*, art::CompilationKind, art::VariableSizedHandleScope*) const+1088, pc 3cafe0)
    /apex/com.android.art/lib64/libart.so (art::OptimizingCompiler::Compile(art::dex::CodeItem const*, unsigned int, art::InvokeType, unsigned short, unsigned int, art::Handle<art::mirror::ClassLoader>, art::DexFile const&, art::Handle<art::mirror::DexCache>) const+736, pc 71d870)
    /apex/com.android.art/bin/dex2oat64 (art::CompileMethodQuick(art::Thread*, art::CompilerDriver*, art::dex::CodeItem const*, unsigned int, art::InvokeType, unsigned short, unsigned int, art::Handle<art::mirror::ClassLoader>, art::DexFile const&, art::Handle<art::mirror::DexCache>, unsigned short)+2240, pc 7fd90)
    /apex/com.android.art/bin/dex2oat64 (art::ParallelCompilationManager::ForAllClosureLambda<void art::CompileDexFile<void (*)(art::Thread*, art::CompilerDriver*, art::dex::CodeItem const*, unsigned int, art::InvokeType, unsigned short, unsigned int, art::Handle<art::mirror::ClassLoader>, art::DexFile const&, art::Handle<art::mirror::DexCache>, unsigned short)>(art::CompilerDriver*, _jobject*, art::DexFile const&, art::ThreadPool*, unsigned long, art::TimingLogger*, char const*, void (*)(art::Thread*, art::CompilerDriver*, art::dex::CodeItem const*, unsigned int, art::InvokeType, unsigned short, unsigned int, art::Handle<art::mirror::ClassLoader>, art::DexFile const&, art::Handle<art::mirror::DexCache>, unsigned short))::'lambda'(unsigned long)>::Run(art::Thread*) (.2e6cf1bb1aa0bfa8f48ed13b3a3c8812)+3248, pc 8ace0)
    /apex/com.android.art/lib64/libart.so (art::AbstractThreadPool::Wait(art::Thread*, bool, bool)+160, pc 6649b0)
    /apex/com.android.art/bin/dex2oat64 (art::CompilerDriver::CompileAll(_jobject*, std::__1::vector<art::DexFile const*, std::__1::allocator<art::DexFile const*>> const&, art::TimingLogger*)+440, pc 77388)
    /apex/com.android.art/bin/dex2oat64 (art::Dex2Oat::CompileDexFiles(std::__1::vector<art::DexFile const*, std::__1::allocator<art::DexFile const*>> const&)+1868, pc 7323c)
    /apex/com.android.art/bin/dex2oat64 (art::Dex2Oat::Compile()+6088, pc 70fa8)
    /apex/com.android.art/bin/dex2oat64 (art::Dex2oat(int, char**)+11220, pc 5e794)
    /apex/com.android.art/bin/dex2oat64 (main+8, pc 5bbb8)
    /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+116, pc 5c5c4)

other8026

someone27281 Did it only happen once, or has it happened multiple times? What were you doing when it happened? Can you make it crash again?

someone27281

other8026 it happened 2 times, no idea how to reproduce it tho. Reading the log, it looks like it is doing some kind of optimization on an app, I think?

someone27281

other8026 any updates? It keeps happening every reboot. No other noticeable issues in the phone so far.

other8026

someone27281 You're saying that it happens on every reboot? I noticed a specific app in this line:

cmdline: /apex/com.android.art/bin/dex2oat64 --zip-fd=5 --zip-location=/data/app/~~ROPZH56YGQBxsiAoqqzPBA==/com.snapwork.hdfc-fa9D3E6Q5n1TTsn8UROrxQ==/base.apk --oat-fd=6 --oat-location=/data/app/~~ROPZH56YGQBxsiAoqqzPBA==/com.snapwork.hdfc-fa9D3E6Q5n1TTsn8UROrxQ==/oat/arm64/base.odex --output-vdex-fd=7 --swap-fd=8 --class-loader-context-fds=9 --class-loader-context=PCL[]{PCL[/system/framework/org.apache.http.legacy.jar]} --classpath-dir=/data/app/~~ROPZH56YGQBxsiAoqqzPBA==/com.snapwork.hdfc-fa9D3E6Q5n1TTsn8UROrxQ== --dm-fd=10 --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a76 --compiler-filter=speed --compilation-reason=install-dm --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:33 --runtime-arg -Xhidden-api-policy:enabled --cpu-set=0,1,2,3 -j4 --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-name:com.snapwork.hdfc,app-version-name:11.2.4,app-version-code:181,art-version:352090000

Specifically, I see com.snapwork.hdfc in that line. The app appears to be "HDFC Bank MobileBanking App". If you uninstall it (if it's okay to try) and reboot the phone, do the crashes continue? If you try to reinstall the app, do you get an error? Are other apps mentioned in that same line in other crash reports?

someone27281

other8026 If you uninstall it (if it's okay to try)

yes, but that is a banking app and unfortunately I do not want risking it becoming inaccessible due to a bug. I hope you can try it on your testing devices?

Edit: my understanding is it's dex2oat binary that is crashing while it is trying to optimize the app?

DeletedUser87

someone27281 have you tried exploit protection compatibility mode?

other8026

someone27281 I installed the app and I also got a crash. I'll open an issue in the issue tracker and submit the whole crash log.

Edit: Here's the issue https://github.com/GrapheneOS/os-issue-tracker/issues/4328

someone27281

other8026 thanks! Normally these kinds of bug reports doean't seem to go anywhere, thanks for making issue on github! (I don't have github account)

GrapheneOS

Is this resolved?

other8026

GrapheneOS just tried on my Pixel 9 and I still get the same crash when installing the app