How to find the crash point: Android Native crash

港控/mmm° 2022-08-08 19:44 175阅读 0赞

There is a very quick way to find out which line cause the crash in logcat,

Generally, if some native service crashes, look in the crash log in logcat like this:

> I/DEBUG ( 2253): \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\*
> 
> I/DEBUG ( 2253): Build fingerprint: 'freescale/sabresd\_6dq/sabresd\_6dq:4.0.4/R13.3-rc3/eng.b18293.20120710.124535:user/test-keys'
> 
> I/DEBUG ( 2253): pid: 3043, tid: 3080 >>> /system/bin/mediaserver <<<
> 
> I/DEBUG ( 2253): signal 11 (SIGSEGV), code 1 (SEGV\_MAPERR), fault addr deadbaad
> 
> I/DEBUG ( 2253): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000
> 
> I/DEBUG ( 2253): r4 00000000 r5 00000027 r6 00bfd370 r7 40c1ef18
> 
> I/DEBUG ( 2253): r8 00004349 r9 00000000 10 000003f5 fp 00000000
> 
> I/DEBUG ( 2253): ip ffffffff sp 418876a0 lr 400ff1b5 pc 400fb91c cpsr 60000030
> 
> I/DEBUG   ( 2253):  ip ffffffff  sp 418876a0  lr 400ff1b5  pc 400fb91c  cpsr 60000030
> 
>

We can see it’s possibly related to some code that we debugged, but don’t know exactly where or which line of code,

Android has a tool to convert this log to a more precise log. As a quick example, if you got this crash in logcat:

> F/libc ( 3043): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
> 
> I/DEBUG ( 2253): \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\* \*\*\*
> 
> I/DEBUG ( 2253): Build fingerprint: 'freescale/sabresd\_6dq/sabresd\_6dq:4.0.4/R13.3-rc3/eng.b18293.20120710.124535:user/test-keys'
> 
> I/DEBUG ( 2253): pid: 3043, tid: 3080 >>> /system/bin/mediaserver <<<
> 
> I/DEBUG ( 2253): signal 11 (SIGSEGV), code 1 (SEGV\_MAPERR), fault addr deadbaad
> 
> I/DEBUG ( 2253): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000
> 
> I/DEBUG ( 2253): r4 00000000 r5 00000027 r6 00bfd370 r7 40c1ef18
> 
> I/DEBUG ( 2253): r8 00004349 r9 00000000 10 000003f5 fp 00000000
> 
> I/DEBUG ( 2253): ip ffffffff sp 418876a0 lr 400ff1b5 pc 400fb91c cpsr 60000030
> 
> I/DEBUG ( 2253): d0 3e4ccccd00000000 d1 7e37e43c3e4ccccd
> 
> I/DEBUG ( 2253): d2 0000004042000000 d3 4200000000000000
> 
> I/DEBUG ( 2253): d4 3ff0000000000000 d5 3ff0000000000000
> 
> I/DEBUG ( 2253): d6 4220000041300000 d7 3e4ccccd3e4ccccd
> 
> I/DEBUG ( 2253): d8 000000000000685d d9 00000000010bee7c
> 
> I/DEBUG ( 2253): d10 0000000000000000 d11 0000000000000000
> 
> I/DEBUG ( 2253): d12 0000000000000000 d13 0000000000000000
> 
> I/DEBUG ( 2253): d14 0000000000000000 d15 0000000000000000
> 
> I/DEBUG ( 2253): d16 0000000000000000 d17 3ff0000000000000
> 
> I/DEBUG ( 2253): d18 7e37e43c8800759c d19 0000000000000000
> 
> I/DEBUG ( 2253): d20 bfe0000000000000 d21 405443dab91ed79f
> 
> I/DEBUG ( 2253): d22 0000000000000000 d23 3f40624dd2f1a9fc
> 
> I/DEBUG ( 2253): d24 7fff80007fff0000 d25 3f6328e1cb8c85e0
> 
> I/DEBUG ( 2253): d26 0000000000000000 d27 0000000000000000
> 
> I/DEBUG ( 2253): d28 0000000000000000 d29 0000000000000000
> 
> I/DEBUG ( 2253): d30 0000000000000000 d31 0000000000000000
> 
> I/DEBUG ( 2253): scr 28000010
> 
> I/DEBUG ( 2253):
> 
> I/DEBUG ( 2253): \#00 pc 0001791c /system/lib/libc.so
> 
> I/DEBUG ( 2253): \#01 pc 00003f3e /system/lib/libcutils.so (\_\_android\_log\_assert)
> 
> I/DEBUG ( 2253): \#02 pc 0006c436 /system/lib/libstagefright.so (\_ZN7android8OMXCodec16drainInputBufferEPNS0\_10BufferInfoE)
> 
> I/DEBUG ( 2253): \#03 pc 0006cbc2 /system/lib/libstagefright.so (\_ZN7android8OMXCodec17drainInputBuffersEv)
> 
> I/DEBUG ( 2253): \#04 pc 0006f570 /system/lib/libstagefright.so (\_ZN7android8OMXCodec4readEPPNS\_11MediaBufferEPKNS\_11MediaSource11ReadOpti
> 
> onsE)
> 
> I/DEBUG ( 2253): \#05 pc 00051aba /system/lib/libstagefright.so (\_ZN7android11AudioPlayer5startEb)
> 
> I/DEBUG ( 2253): \#06 pc 0005411e /system/lib/libstagefright.so (\_ZN7android13AwesomePlayer18startAudioPlayer\_lEb)
> 
> I/DEBUG ( 2253): \#07 pc 0005554a /system/lib/libstagefright.so (\_ZN7android13AwesomePlayer6play\_lEv)
> 
> I/DEBUG ( 2253): \#08 pc 000558e0 /system/lib/libstagefright.so (\_ZN7android13AwesomePlayer4playEv)
> 
> I/DEBUG ( 2253): \#09 pc 00027f4e /system/lib/libmediaplayerservice.so (\_ZN7android17StagefrightPlayer5startEv)
> 
> I/DEBUG ( 2253): \#10 pc 00024dda /system/lib/libmediaplayerservice.so (\_ZN7android18MediaPlayerService6decodeEixxPjPiS2\_)
> 
> I/DEBUG ( 2253):
> 
> I/DEBUG ( 2253): code around pc:
> 
> I/DEBUG ( 2253): 400fb8fc 4623b15c 2c006824 e026d1fb b12368db \\.\#F$h.,..&..h\#.
> 
> I/DEBUG ( 2253): 400fb90c 21014a17 6011447a 48124798 24002527 .J.!zD.\`.G.H'%.$
> 
> I/DEBUG ( 2253): 400fb91c f7f47005 2106ee22 eebef7f5 f04fa901 .p.."..!......O.
> 
> I/DEBUG ( 2253): 400fb92c 460a5380 93032006 94029401 ea7af7f5 .S.F. ........z.
> 
> I/DEBUG ( 2253): 400fb93c 4622a905 f7f52002 f7f4ea84 2106ee0e .."F. .........!
> 
> I/DEBUG ( 2253):
> 
> I/DEBUG ( 2253): code around lr:
> 
> I/DEBUG ( 2253): 400ff194 41f0e92d 4c0c4680 447c2600 68a56824 -..A.F.L.&|D$h.h
> 
> I/DEBUG ( 2253): 400ff1a4 e0076867 300cf9b5 dd022b00 47c04628 gh.....0.+..(F.G
> 
> I/DEBUG ( 2253): 400ff1b4 35544306 37fff117 6824d5f4 d1ee2c00 .CT5...7..$h.,..
> 
> I/DEBUG ( 2253): 400ff1c4 e8bd4630 bf0081f0 00028346 41f0e92d 0F......F...-..A
> 
> I/DEBUG ( 2253): 400ff1d4 9004b086 f602fb01 460c461f 46154814 .........F.F.H.F
> 
> I/DEBUG ( 2253):
> 
> I/DEBUG ( 2253): memory map around addr deadbaad:
> 
> I/DEBUG ( 2253): becef000-bed10000 \[stack\]
> 
> I/DEBUG ( 2253): (no map  for address)
> 
> I/DEBUG ( 2253): ffff0000-ffff1000 \[vectors\]
> 
> I/DEBUG ( 2253):

You can see it’s related to which lib, but don’t know which line.

So, let’s go to your source code, for example:

mydroid;

after do

> $. build/envsetup.sh$ lunch sabresd\_6dp-eng
> 
>  
> 
> $ development/scripts/stack

Then you have a prompt:

> Reading native crash info from stdin

The you just copy all the crash log in above to this prompt.

And then Key in EOF (CTRL+D) in this prompt.

You will get output like this:

> Reading symbols from /home/b33651/proj/ics/out/target/product/sabresd\_6dq/symbols
> 
> pid: 3043, tid: 3080 >>> /system/bin/mediaserver <<<
> 
> signal 11 (SIGSEGV), code 1 (SEGV\_MAPERR), fault addr deadbaad
> 
>   r0 deadbaad r1 00000001 r2 a0000000 r3 00000000
> 
>   r4 00000000 r5 00000027 r6 00bfd370 r7 40c1ef18
> 
>   r8 00004349 r9 00000000 10 000003f5 fp 00000000
> 
>   ip ffffffff sp 418876a0 lr 400ff1b5 pc 400fb91c
> 
>  
> 
> Stack Trace:
> 
>   RELADDR FUNCTION FILE:LINE
> 
>   0001791c \_\_libc\_android\_abort+92 /home/b33651/proj/ics/bionic/libc/unistd/abort.c:82
> 
>   00003f3e \_\_android\_log\_assert+94 /home/b33651/proj/ics/system/core/liblog/logd\_write.c:246
> 
>   0006c436 android::OMXCodec::drainInputBuffer(android::OMXCodec::BufferInfo\*)+138 /home/b33651/proj/ics/frameworks/base/media/libstagefright/OMXCodec.cpp:3181
> 
>   0006cbc2 android::OMXCodec::drainInputBuffers()+102 /home/b33651/proj/ics/frameworks/base/media/libstagefright/OMXCodec.cpp:3125
> 
>   0006f570 android::OMXCodec::read(android::MediaBuffer\*\*, android::MediaSource::ReadOptions const\*)+136 /home/b33651/proj/ics/frameworks/base/media/libstagefright/OMXCodec.cpp:4020
> 
>   00051aba android::AudioPlayer::start(bool)+134 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AudioPlayer.cpp:93
> 
>   0005411e android::AwesomePlayer::startAudioPlayer\_l(bool)+70 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AwesomePlayer.cpp:953
> 
>   0005554a android::AwesomePlayer::play\_l()+202 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AwesomePlayer.cpp:888
> 
>   000558e0 android::AwesomePlayer::play()+20 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AwesomePlayer.cpp:837
> 
>   00027f4e android::StagefrightPlayer::start()+6 /home/b33651/proj/ics/frameworks/base/media/libmediaplayerservice/StagefrightPlayer.cpp:90
> 
>   00024dda android::MediaPlayerService::decode(int, long long, long long, unsigned int\*, int\*, int\*)+206 /home/b33651/proj/ics/frameworks/base/media/libmediaplayerservice/MediaPlayerService.cpp:1428

So, you get more reason logs.

### Note: ###

1.  The Android directory must have built once.
2.  The crash log better aligns with your Android build environment.