EsxFramebufferObject::DetachAll(EsxContext*) Segfault Crash in React Native project that uses MapboxGL on Android

Question

So this crash has been the bane of my existence for 3 months now.

It is single handedly putting us over the Bad Behavior threshold with Google. I've never experienced it personally, I just know we've got hundreds of users a month with this crash.

The crash happens inside libGLESv2_adreno which is a lib that does OpenGL for Embedded Systems running on an Adreno GPU which is a Qualcomm-only GPU.

So, It only affects Android 9 Devices with the Adreno GPU, here's a few offenders:

• Samsung Galaxy S8
• LGE LG Stylo 5
• LGE LG G7 ThinQ
• Motorola Moto Z(3)
• Kyocera DuraForce PRO 2 with Sapphire shield

This is a React Native project which uses MapboxGL. In fact, I even found the same issue here: https://github.com/mapbox/mapbox-gl-native-android/issues/264

Sadly though, that's not the package we use.. this is what we use: https://github.com/react-native-mapbox-gl/maps

And I don't know that that this is a mapbox issue anyway, there are really no clues in this backtrace:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)

backtrace:
  #00  pc 000000000012ae70  /system/vendor/lib64/egl/libGLESv2_adreno.so (EsxFramebufferObject::DetachAll(EsxContext*)+56)
  #00  pc 00000000001fda4c  /system/vendor/lib64/egl/libGLESv2_adreno.so (EglContext::UnmakeCurrentEsx()+308)
  #00  pc 00000000001fd8c0  /system/vendor/lib64/egl/libGLESv2_adreno.so (EglContext::UnmakeCurrent()+128)
  #00  pc 00000000001fe888  /system/vendor/lib64/egl/libGLESv2_adreno.so (EglThreadList::SearchCurrentDisplayAndUnmake(EglDisplay*)+224)
  #00  pc 00000000001fe468  /system/vendor/lib64/egl/libGLESv2_adreno.so (EglDisplay::Terminate(int)+168)
  #00  pc 00000000001f4864  /system/vendor/lib64/egl/libGLESv2_adreno.so (EglApi::Terminate(void*)+84)
  #00  pc 000000000001115c  /system/lib64/libEGL.so (android::egl_display_t::terminate()+128)
  #00  pc 000000000006f9a8  /system/lib64/libgui.so (android::GLConsumer::EglImage::~EglImage()+80)
  #00  pc 000000000006f7ec  /system/lib64/libgui.so (android::GLConsumer::abandonLocked()+68)
  #00  pc 0000000000065ad0  /system/lib64/libgui.so (android::ConsumerBase::onLastStrongRef(void const*)+48)
  #00  pc 00000000001687bc  /system/lib64/libandroid_runtime.so (android::SurfaceTexture_release(_JNIEnv*, _jobject*)+80)
  #00  pc 000000000042982c  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.graphics.Camera.nativeConstructor [DEDUPED]+124)
  #00  pc 000000000088eb58  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.graphics.SurfaceTexture.release+40)
  #00  pc 0000000000d995dc  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.TextureView.releaseSurfaceTexture+252)
  #00  pc 0000000000d9a048  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.TextureView.onDetachedFromWindowInternal+248)
  #00  pc 0000000000cd1c20  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.View.dispatchDetachedFromWindow+192)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000da12c0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewGroup.dispatchDetachedFromWindow+240)
  #00  pc 0000000000d04f0c  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewRootImpl.dispatchDetachedFromWindow+188)
  #00  pc 0000000000d05884  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewRootImpl.doDie+180)
  #00  pc 0000000000d049b4  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.ViewRootImpl.die+68)
  #00  pc 0000000000c0c50c  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.WindowManagerGlobal.removeViewLocked+316)
  #00  pc 0000000000c0da4c  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.WindowManagerGlobal.removeView+220)
  #00  pc 0000000000dad9e4  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.view.WindowManagerImpl.removeViewImmediate+68)
  #00  pc 000000000090996c  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.app.ActivityThread.handleDestroyActivity+316)
  #00  pc 0000000000af9468  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.app.servertransaction.DestroyActivityItem.execute+136)
  #00  pc 00000000008134a0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.app.servertransaction.TransactionExecutor.executeLifecycleState+416)
  #00  pc 0000000000813b30  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.app.servertransaction.TransactionExecutor.execute+304)
  #00  pc 00000000008f6a78  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.app.ActivityThread$H.handleMessage+1112)
  #00  pc 0000000000b26a94  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.os.Handler.dispatchMessage+180)
  #00  pc 0000000000b29b90  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.os.Looper.loop+1264)
  #00  pc 0000000000903948  /system/framework/arm64/boot-framework.oat (offset 0x420000) (android.app.ActivityThread.main+680)
  #00  pc 000000000055844c  /system/lib64/libart.so (art_quick_invoke_static_stub+604)
  #00  pc 00000000000cfce8  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
  #00  pc 000000000045e630  /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
  #00  pc 0000000000460084  /system/lib64/libart.so (art::InvokeMethod(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+1440)
  #00  pc 00000000003ef520  /system/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*)+52)
  #00  pc 000000000011f7e4  /system/framework/arm64/boot.oat (offset 0x115000) (java.lang.Class.getDeclaredMethodInternal [DEDUPED]+180)
  #00  pc 0000000000e11f08  /system/framework/arm64/boot-framework.oat (offset 0x420000) (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+136)
  #00  pc 0000000000e18aa0  /system/framework/arm64/boot-framework.oat (offset 0x420000) (com.android.internal.os.ZygoteInit.main+2208)
  #00  pc 000000000055844c  /system/lib64/libart.so (art_quick_invoke_static_stub+604)
  #00  pc 00000000000cfce8  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
  #00  pc 000000000045e630  /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
  #00  pc 000000000045e290  /system/lib64/libart.so (art::InvokeWithVarArgs(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+424)
  #00  pc 0000000000362d8c  /system/lib64/libart.so (art::JNI::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+652)
  #00  pc 00000000000b934c  /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+116)
  #00  pc 00000000000bbfa4  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+768)
  #00  pc 0000000000004b84  /system/bin/app_process64 (main+1832)
  #00  pc 00000000000c9ec8  /system/lib64/libc.so (__libc_init+88)

Anyone particularly good at reading cryptic backtraces to pin down the source of an issue? Any suggestions for how to debug this better?

Would love it if there were a way to desymbolicate the code above, but I figured that would require GPU lib symbol files.. Maybe I'm wrong about that..

Thanks so much!

Update: This issue continues (it still shows up in Sentry), but now Google Play Console has filtered it out, so our app is now below the bad behavior mark. My best guess is that Google decided not to penalize apps for an issue that lies at a GPU level?