[regression/8.0.0-preview.6.8686] [Android] BitmapFactory.DecodeStreamAsync crashes the app on .NET 8-preview.6 in Release mode

[AntPolkanov]

Description

I am using the FFImageLoading.Compat package to display jpg images in CachedImage.
The package works fine on .NET 7 (Android and iOS), but fails on the latest .NET 8-preview.6 (Android only) in the Release mode (works in Debug though).

I pulled the package and added logging. It turns out that DecodeAsync() method in the BaseDecoder.cs class fails when it calls await BitmapFactory.DecodeStreamAsync(imageData, null, options).ConfigureAwait(false);, see the exact line here: https://github.com/Redth/FFImageLoading.Compat/blob/3b171816d95b6d40d726dfe541d59c21acb29a8e/source/FFImageLoading/Platforms/Android/Decoders/BaseDecoder.cs#L41C28-L41C28 (cc: @Redth)

The error happens when libc calls memcpy(). The tombstone file and logcat can be found in the reproduction repo.

This issue blocks us from releasing our .NET MAUI app on Android.

Steps to Reproduce

1. Create a .NET MAUI 8-preview.6 app
2. Add FFImageLoading.Compat package
3. Add CachedImage on a page

<ffimageloading:CachedImage 
     WidthRequest="300" 
     HeightRequest="300"
     DownsampleToViewSize="true" 
     Source="https://raw.githubusercontent.com/recurser/exif-orientation-examples/master/Landscape_3.jpg">
</ffimageloading:CachedImage>

4. Run the app on Android in the Release mode
5. Open the page with the image

Expected result: the image appears on the page
Actual result: the app crashes

Link to public reproduction project repository

https://github.com/AntPolkanov/MAUI.Bug.FFImageLoadingCompat

Version with bug

8.0.0-preview.6.8686

Last version that worked well

7.0.92

Affected platforms

Android

Affected platform versions

No response

Did you find any workaround?

No

Relevant log output

08-03 09:28:49.672  9110  9110 E .ffimageloading: Not starting debugger since process cannot load the jdwp agent.
08-03 09:28:50.537  9110  9143 E OpenGLRenderer: Unable to match the desired swap behavior.
08-03 09:28:50.564  9110  9148 F libc    : Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7421a73000 in tid 9148 (.NET TP Worker), pid 9110 (.ffimageloading)
08-03 09:28:51.068  9154  9154 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-03 09:28:51.068  9154  9154 F DEBUG   : Build fingerprint: 'google/sdk_gphone64_arm64/emu64a:14/UPB3.230519.006/10229193:userdebug/dev-keys'
08-03 09:28:51.068  9154  9154 F DEBUG   : Revision: '0'
08-03 09:28:51.068  9154  9154 F DEBUG   : ABI: 'arm64'
08-03 09:28:51.068  9154  9154 F DEBUG   : Timestamp: 2023-08-03 09:28:50.608506737+1000
08-03 09:28:51.068  9154  9154 F DEBUG   : Process uptime: 2s
08-03 09:28:51.068  9154  9154 F DEBUG   : Cmdline: com.companyname.maui.bug.ffimageloading
08-03 09:28:51.068  9154  9154 F DEBUG   : pid: 9110, tid: 9148, name: .NET TP Worker  >>> com.companyname.maui.bug.ffimageloading <<<
08-03 09:28:51.068  9154  9154 F DEBUG   : uid: 10209
08-03 09:28:51.068  9154  9154 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
08-03 09:28:51.068  9154  9154 F DEBUG   : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
08-03 09:28:51.068  9154  9154 F DEBUG   : signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x0000007421a73000
08-03 09:28:51.068  9154  9154 F DEBUG   :     x0  b400007421a72fff  x1  00000000778ce00c  x2  000000000000001e  x3  000000000000001e
08-03 09:28:51.068  9154  9154 F DEBUG   :     x4  00000000778ce02a  x5  b400007421a7301d  x6  0000000000000000  x7  b4000074819a07e0
08-03 09:28:51.068  9154  9154 F DEBUG   :     x8  00000000778ce000  x9  00000000778ce000  x10 0000000000000000  x11 000000725203e840
08-03 09:28:51.068  9154  9154 F DEBUG   :     x12 0000000000000000  x13 0000000000000002  x14 0000000000000008  x15 b4000074719d30f8
08-03 09:28:51.068  9154  9154 F DEBUG   :     x16 00000072cd810a70  x17 000000757c8d09c0  x18 0000007236a66000  x19 000000000000001e
08-03 09:28:51.068  9154  9154 F DEBUG   :     x20 b400007421a72fff  x21 0000000000000000  x22 b40000730194a6f0  x23 00000000778ce000
08-03 09:28:51.068  9154  9154 F DEBUG   :     x24 0000000070fde190  x25 0000000070fb1de0  x26 00000072cda16000  x27 00000072466f6000
08-03 09:28:51.068  9154  9154 F DEBUG   :     x28 0000000000000001  x29 00000072466f3e70
08-03 09:28:51.068  9154  9154 F DEBUG   :     lr  00000072cd6717b8  sp  00000072466f3df0  pc  000000757c8d09ec  pst 0000000020001000
08-03 09:28:51.068  9154  9154 F DEBUG   : 14 total frames
08-03 09:28:51.068  9154  9154 F DEBUG   : backtrace:
08-03 09:28:51.068  9154  9154 F DEBUG   :       #00 pc 00000000000529ec  /apex/com.android.runtime/lib64/bionic/libc.so (__memcpy_aarch64_simd+44) (BuildId: 584bea18de667f24c490a5df46125bc8)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #01 pc 00000000006717b4  /apex/com.android.art/lib64/libart.so (art::JNI<false>::GetByteArrayRegion(_JNIEnv*, _jbyteArray*, int, int, signed char*)+352) (BuildId: 9fbb49c28046dcdb656b256563f6944c)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #02 pc 0000000000515f7c  /system/lib64/libhwui.so (JavaInputStreamAdaptor::read(void*, unsigned long)+200) (BuildId: 2caff52cdd7985a5dd5f0639d675ef9b)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #03 pc 00000000005c8804  /system/lib64/libhwui.so ((anonymous namespace)::FrontBufferedStream::read(void*, unsigned long) (.__uniq.259476571162685252206752541612201816602)+184) (BuildId: 2caff52cdd7985a5dd5f0639d675ef9b)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #04 pc 00000000005c88ec  /system/lib64/libhwui.so ((anonymous namespace)::FrontBufferedStream::peek(void*, unsigned long) const (.__uniq.259476571162685252206752541612201816602.8f1c1c36362eb42cefaa8ed6ceaf4bc1)+48) (BuildId: 2caff52cdd7985a5dd5f0639d675ef9b)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #05 pc 0000000000271f80  /system/lib64/libhwui.so (SkCodec::MakeFromStream(std::__1::unique_ptr<SkStream, std::__1::default_delete<SkStream> >, SkCodec::Result*, SkPngChunkReader*, SkCodec::SelectionPolicy)+116) (BuildId: 2caff52cdd7985a5dd5f0639d675ef9b)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #06 pc 0000000000270a8c  /system/lib64/libhwui.so (doDecode(_JNIEnv*, std::__1::unique_ptr<SkStreamRewindable, std::__1::default_delete<SkStreamRewindable> >, _jobject*, _jobject*, long, long) (.__uniq.26938061605105508016343812100800822394)+740) (BuildId: 2caff52cdd7985a5dd5f0639d675ef9b)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #07 pc 0000000000270708  /system/lib64/libhwui.so (nativeDecodeStream(_JNIEnv*, _jobject*, _jobject*, _jbyteArray*, _jobject*, _jobject*, long, long) (.__uniq.26938061605105508016343812100800822394)+232) (BuildId: 2caff52cdd7985a5dd5f0639d675ef9b)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #08 pc 0000000000329790  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+176)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #09 pc 00000000006f8cc4  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (android.graphics.BitmapFactory.decodeStream+484)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #10 pc 0000000000350080  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+640) (BuildId: 9fbb49c28046dcdb656b256563f6944c)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #11 pc 00000000005151ac  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallStaticObjectMethodA(_JNIEnv*, _jclass*, _jmethodID*, jvalue const*)+832) (BuildId: 9fbb49c28046dcdb656b256563f6944c)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #12 pc 0000000000041da4  /data/app/~~RItoneN68pso2GFWpoZQBQ==/com.companyname.maui.bug.ffimageloading-oaT1k_S4pC2qEgGTTFhyNw==/split_config.arm64_v8a.apk!libmono-android.release.so (offset 0x90a000) (java_interop_jnienv_call_static_object_method_a+48) (BuildId: 61a34325905bcc5cf15047bd8242ba339c24fc4a)
08-03 09:28:51.068  9154  9154 F DEBUG   :       #13 pc 0000000000007200  <anonymous:7573bf0000>
08-03 09:28:51.078   204   204 E tombstoned: Tombstone written to: tombstone_20
08-03 09:28:51.116   380   380 E BpTransactionCompletedListener: Failed to transact (-32)
08-03 09:28:51.138  3078  3919 E OpenGLRenderer: Unable to match the desired swap behavior.
08-03 09:28:51.146  2421  3081 E OpenGLRenderer: Unable to match the desired swap behavior.
08-03 09:28:52.908   920  3060 E TaskPersister: File error accessing recents directory (directory doesn't exist?).

[drasticactions]

BitmapFactory is an Android Runtime API and not an MAUI UI one. IMO this looks more like a runtime issue than anything specific to code here, @jonathanpeppers what do you think?

[jonathanpeppers]

We just bind the Android APIs to C# as-is, so aren't much involved in what they actually do. One difference is that .NET 8 Preview 6 now uses Android API 34 as the targetSdkVersion. There could be different behavior (bugs?) in the newest version of Android.

@AntPolkanov can you share a more complete Android log? Try this:

# clear the log
adb logcat -c
# enable moar logging
adb shell setprop debug.mono.log default,assembly,mono_log_level=debug,mono_log_mask=all
# cause the app to crash again, save the log
adb logcat -d > log.txt

Share the log.txt file here, thanks!

[ghost]

Hi @AntPolkanov. We have added the "s/needs-info" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[AntPolkanov]

Thanks for looking into this, guys!
@jonathanpeppers , please find the log attached.

log.txt

[jonathanpeppers]

If you add to your project:

<PropertyGroup>
   <AndroidEnableMarshalMethods>false</AndroidEnableMarshalMethods>
</PropertyGroup>

Log messages like this should go away:

08-07 08:59:44.386  6005  6005 D monodroid-assembly: MM: Trying to look up pointer to method 'n_OnDraw_Landroid_graphics_drawable_shapes_Shape_Landroid_graphics_Canvas_Landroid_graphics_Paint__mm_wrapper(IntPtr,IntPtr,IntPtr,IntPtr,IntPtr)' (token 0x60024a4) in class 'Android.Graphics.Drawables.ShapeDrawable, Mono.Android, Version=0.0.0.0, Culture=neutral, PublicKeyToken=84e04ff9cfb79065' (index 40)

Does the problem go away with AndroidEnableMarshalMethods=false?

We have this feature disabled by default in the next release, and plan to make it "experimental" for .NET 8.

[AntPolkanov]

@jonathanpeppers , it did help! Thank you.
The issue can be closed.

[jonathanpeppers]

Thanks I will put your sample on the list to test if we turn on AndroidEnableMarshalMethods again.