[Android Apps and Games] talla1:
CRASH when unlocking device while in picture in picture mode

Hi,

Awesome app!

I have a reproducible crash which seems to be related to the picture in picture mode. I only tested on my phone (details below), and of course I cannot test on the original Youtube app since this is related to background playback, but I suspect that most if not all devices will have it!

Now get this - it doesn't crash the app, it crashes the phone and causes a spontaneous restart!!

Reproduction steps:

1) Start playing something.

2) Go to background, you should see the picture in picture.

3) Lock the phone.

4) Open the screen, you should see the lock screen.

5) Slide down the notifications and press the youtube notification to try to get it back to foreground.

6) The device will ask for your pattern/pin/whatever.

7) Put the pattern or use the fingerprint scanner.

8) BOOM! The device restarts!

It happens to me 100% of the time. The problem seems to be related to surfaceflinger, and I don't know if it's an Android issue, original youtube issue, Xiaomi issue, Vanced issue or what, but since it happens due to something in vanced, I thought I would start here.

I couldn't find this stack trace anywhere on xda on the internet.

Xiaomi Mi A1

Android 8.0.0

Android security patch level April 1, 2018

Rooted with magisk (5.7.0)

Installed Xposed framework (90.2-beta3) in Magisk

Installed Youtube Vanced in Magisk for background playback

Installed GravityBox (8.2.0) with Xposed

The stack trace:

07-03 07:01:02.159 F/DEBUG (14681): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

07-03 07:01:02.159 F/DEBUG (14681): Build fingerprint: 'xiaomi/tissot/tissot_sprout:8.0.0/OPR1.170623.026/V.9.5.10.0.ODHMIFA:user/release-keys'

07-03 07:01:02.159 F/DEBUG (14681): Revision: '0'

07-03 07:01:02.159 F/DEBUG (14681): ABI: 'arm64'

07-03 07:01:02.159 F/DEBUG (14681): pid: 572, tid: 572, name: surfaceflinger >>> /system/bin/surfaceflinger <<<

07-03 07:01:02.159 F/DEBUG (14681): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x48

07-03 07:01:02.159 F/DEBUG (14681): Cause: null pointer dereference

07-03 07:01:02.159 F/DEBUG (14681): x0 0000007fd393f728 x1 0000007b4e4862b0 x2 0000007fd393f808 x3 0000000000000000

07-03 07:01:02.159 F/DEBUG (14681): x4 0000007fd393fb78 x5 0000000000000000 x6 0000007b4e416520 x7 0000007b4e4153e0

07-03 07:01:02.159 F/DEBUG (14681): x8 0000007b4e486000 x9 0000000000000000 x10 0000000000000000 x11 0000000000000000

07-03 07:01:02.159 F/DEBUG (14681): x12 0000007b5260d788 x13 0000007b4e416ac0 x14 00000000ffffffff x15 0000000000014fc0

07-03 07:01:02.159 F/DEBUG (14681): x16 0000007b533c9f38 x17 0000007b536208e8 x18 53367c6a28ee963e x19 0000007fd393f7e0

07-03 07:01:02.159 F/DEBUG (14681): x20 0000007b4e533000 x21 0000000000000000 x22 0000007b5330458c x23 0000000000000001

07-03 07:01:02.159 F/DEBUG (14681): x24 0000007fd393fbd8 x25 0000007fd393fbb0 x26 0000007fd393fb88 x27 0000007fd393fb78

07-03 07:01:02.159 F/DEBUG (14681): x28 0000007fd393fb84 x29 0000007fd393f7a0 x30 0000007b532dc138

07-03 07:01:02.159 F/DEBUG (14681): sp 0000007fd393f6f0 pc 0000007b532dc154 pstate 0000000020000000

07-03 07:01:02.186 F/DEBUG (14681):

07-03 07:01:02.186 F/DEBUG (14681): backtrace:

07-03 07:01:02.186 F/DEBUG (14681): #00 pc 0000000000081154 /system/lib64/libsurfaceflinger.so (_ZNK7android5Layer12getTransformEv+180)

07-03 07:01:02.186 F/DEBUG (14681): #01 pc 0000000000080f8c /system/lib64/libsurfaceflinger.so (_ZNK7android5Layer19computeScreenBoundsEb+128)

07-03 07:01:02.186 F/DEBUG (14681): #02 pc 00000000000c132c /system/lib64/libsurfaceflinger.so (_ZNSt3__110__function6__funcIZN7android14SurfaceF linger21computeVisibleRegionsEmjRNS2_6RegionES5_E3 $_9NS_9allocatorIS6_EEFvPNS2_5LayerEEEclEOSA_+240)

07-03 07:01:02.186 F/DEBUG (14681): #03 pc 0000000000088838 /system/lib64/libsurfaceflinger.so (_ZN7android5Layer23traverseInReverseZOrderENS_11L ayerVector8StateSetERKNSt3__18functionIFvPS0_EEE+1 52)

07-03 07:01:02.186 F/DEBUG (14681): #04 pc 0000000000088854 /system/lib64/libsurfaceflinger.so (_ZN7android5Layer23traverseInReverseZOrderENS_11L ayerVector8StateSetERKNSt3__18functionIFvPS0_EEE+1 80)

07-03 07:01:02.186 F/DEBUG (14681): #05 pc 000000000008a4c4 /system/lib64/libsurfaceflinger.so (_ZNK7android11LayerVector23traverseInReverseZOrde rENS0_8StateSetERKNSt3__18functionIFvPNS_5LayerEEE E+80)

07-03 07:01:02.186 F/DEBUG (14681): #06 pc 00000000000b21fc /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger21computeVisibleRegion sEmjRNS_6RegionES2_+264)

07-03 07:01:02.186 F/DEBUG (14681): #07 pc 00000000000b0300 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger18rebuildLayerStacksEv +364)

07-03 07:01:02.186 F/DEBUG (14681): #08 pc 00000000000afb14 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger20handleMessageRefresh Ev+100)

07-03 07:01:02.186 F/DEBUG (14681): #09 pc 00000000000af970 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger17onMessageReceivedEi+ 252)

07-03 07:01:02.186 F/DEBUG (14681): #10 pc 0000000000015d40 /system/lib64/libutils.so (_ZN7android6Looper9pollInnerEi+332)

07-03 07:01:02.186 F/DEBUG (14681): #11 pc 0000000000015b6c /system/lib64/libutils.so (_ZN7android6Looper8pollOnceEiPiS1_PPv+108)

07-03 07:01:02.186 F/DEBUG (14681): #12 pc 000000000008ae90 /system/lib64/libsurfaceflinger.so (_ZN7android12MessageQueue11waitMessageEv+84)

07-03 07:01:02.186 F/DEBUG (14681): #13 pc 00000000000ae8cc /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger3runEv+20)

07-03 07:01:02.186 F/DEBUG (14681): #14 pc 0000000000002cfc /system/bin/surfaceflinger (main+948)

07-03 07:01:02.186 F/DEBUG (14681): #15 pc 000000000001b830 /system/lib64/libc.so (__libc_init+88)

07-03 07:01:02.187 F/DEBUG (14681): #16 pc 00000000000028a8 /system/bin/surfaceflinger (do_arm64_start+80)

It took me sometime to find the stable reproduction. I hope some of you will try it and tell me if it happens to you too..

And if you have any leads to the root cause...

Thanks!!

Tal