Skip to content

[Bug] Native Crash (SIGSEGV) in libgui.so / BLASTBufferQueue during InMobiAdActivity lifecycle transitions on Android 14 #110

Description

@hoanghiephui

Description: A critical native crash (SIGSEGV: Segmentation violation) is occurring on Android 14 devices (specifically Samsung Galaxy A23) within the InMobiAdActivity. The crash appears to be a race condition between the video decoding engine (ACodec) and the Surface/Buffer management when the Activity is undergoing lifecycle changes (moving to background) or when the system is under memory pressure.
Device Information:

Device: Samsung Galaxy A23 (SM-A235M)

OS Version: Android 14 (API 34)

SDK Version: 11.3.0

App Version: 1.2.4.2
Logcat / Stack Trace:

SIGSEGV: Segmentation violation (invalid memory reference)

0  libgui.so +0x10d5fc                   android::SurfaceComposerClient::Transaction::getLayerState(android::sp<android::SurfaceControl> const&)
1  libgui.so +0x10ed54                   android::SurfaceComposerClient::Transaction::setBuffer(android::sp<android::SurfaceControl> const&, android::sp<android::GraphicBuffer> const&, std::__1::optional<android::sp<android::Fence> > const&, std::__1::optional<unsigned long> const&, unsigned int, std::__1::function<void (android::ReleaseCallbackId const&, android::sp<android::Fence> const&, std::__1::optional<unsigned int>)>)
2  libgui.so +0xb9a4c                    android::BLASTBufferQueue::acquireNextBufferLocked(std::__1::optional<android::SurfaceComposerClient::Transaction*>)
3  libgui.so +0xbb7fc                    android::BLASTBufferQueue::onFrameAvailable(android::BufferItem const&)
4  libgui.so +0xc7c18                    android::ConsumerBase::onFrameAvailable(android::BufferItem const&)
5  libgui.so +0x97bc4                    android::BufferQueue::ProxyConsumerListener::onFrameAvailable(android::BufferItem const&)
6  libgui.so +0xa3120                    android::BufferQueueProducer::queueBuffer(int, android::IGraphicBufferProducer::QueueBufferInput const&, android::IGraphicBufferProducer::QueueBufferOutput*)
7  libgui.so +0xfb60c                    android::Surface::queueBuffer(ANativeWindowBuffer*, int)
8  libstagefright.so +0xbe548            android::ACodec::BaseState::onOutputBufferDrained(android::sp<android::AMessage> const&)
...
13 libstagefright_foundation.so +0x1dd50 android::ALooper::loop()

Context & Observations:
1.
Lifecycle state: The crash frequently occurs immediately after InMobiAdActivity#onStop() or during onSaveInstanceState().
2.
Memory Pressure: The logs show a Trim Memory (Running moderate) event just seconds before the crash.
3.
Root Cause Hypothesis: It seems that the ACodec (MediaCodec) continues to push decoded video frames to the Surface after the BLASTBufferQueue or the underlying SurfaceControl has been invalidated or released during the Activity's transition to the background. This leads to a null/invalid pointer reference in libgui.so.
Steps to Reproduce (if applicable):
1.
Launch an InMobi Video Ad.
2.
Trigger a lifecycle change (e.g., press the Home button or switch apps) while the video is playing.
3.
The crash occurs intermittently, especially when the device is low on RAM.
Expected Behavior: The SDK should safely stop the video player and stop pushing buffers to the Surface before the Surface is destroyed or the Activity reaches the onStop state.
Suggested Fix: Ensure that all rendering threads and MediaCodec instances are properly paused or released synchronously during onPause or onStop to prevent onFrameAvailable from being triggered on an invalidated Surface.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions