[Xiaomi Mi A1 Questions & Answers] talla1:
Hi all,

I have a very sporadic spontaneous device restart, about once per week. It seems that surfaceflinger gets a native crash and somehow it crashes the entire phone, and then it immediately restarts in a weird state, and I have to do another "real" restart, in order to get it back to normal. I tried to disable various things, but since it's rarely reproducible, I'm not sure how to track the issue.

I'm hoping that someone will see the trace, and have a clue regarding the root cause. I suspecting something in GravityBox, but without a way to reproduce this, my tests are extremely slow progressing.

My configuration:

Xiaomi Mi A1

Android 8.0.0

Android security patch level April 1, 2018

Rooted with magisk (5.7.0)

Installed Xposed framework (90.2-beta3) in Magisk

Installed Youtube Vanced in Magisk for background playback

Installed GravityBox (8.2.0) with Xposed

The stack trace I got from logcat. I can't *prove* this is the root cause for the restart, but I have twice caught this trace at the time of the crash:

07-03 07:01:02.159 F/DEBUG (14681): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

07-03 07:01:02.159 F/DEBUG (14681): Build fingerprint: 'xiaomi/tissot/tissot_sprout:8.0.0/OPR1.170623.026/V.9.5.10.0.ODHMIFA:user/release-keys'

07-03 07:01:02.159 F/DEBUG (14681): Revision: '0'

07-03 07:01:02.159 F/DEBUG (14681): ABI: 'arm64'

07-03 07:01:02.159 F/DEBUG (14681): pid: 572, tid: 572, name: surfaceflinger >>> /system/bin/surfaceflinger <<<

07-03 07:01:02.159 F/DEBUG (14681): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x48

07-03 07:01:02.159 F/DEBUG (14681): Cause: null pointer dereference

07-03 07:01:02.159 F/DEBUG (14681): x0 0000007fd393f728 x1 0000007b4e4862b0 x2 0000007fd393f808 x3 0000000000000000

07-03 07:01:02.159 F/DEBUG (14681): x4 0000007fd393fb78 x5 0000000000000000 x6 0000007b4e416520 x7 0000007b4e4153e0

07-03 07:01:02.159 F/DEBUG (14681): x8 0000007b4e486000 x9 0000000000000000 x10 0000000000000000 x11 0000000000000000

07-03 07:01:02.159 F/DEBUG (14681): x12 0000007b5260d788 x13 0000007b4e416ac0 x14 00000000ffffffff x15 0000000000014fc0

07-03 07:01:02.159 F/DEBUG (14681): x16 0000007b533c9f38 x17 0000007b536208e8 x18 53367c6a28ee963e x19 0000007fd393f7e0

07-03 07:01:02.159 F/DEBUG (14681): x20 0000007b4e533000 x21 0000000000000000 x22 0000007b5330458c x23 0000000000000001

07-03 07:01:02.159 F/DEBUG (14681): x24 0000007fd393fbd8 x25 0000007fd393fbb0 x26 0000007fd393fb88 x27 0000007fd393fb78

07-03 07:01:02.159 F/DEBUG (14681): x28 0000007fd393fb84 x29 0000007fd393f7a0 x30 0000007b532dc138

07-03 07:01:02.159 F/DEBUG (14681): sp 0000007fd393f6f0 pc 0000007b532dc154 pstate 0000000020000000

07-03 07:01:02.186 F/DEBUG (14681):

07-03 07:01:02.186 F/DEBUG (14681): backtrace:

07-03 07:01:02.186 F/DEBUG (14681): #00 pc 0000000000081154 /system/lib64/libsurfaceflinger.so (_ZNK7android5Layer12getTransformEv+180)

07-03 07:01:02.186 F/DEBUG (14681): #01 pc 0000000000080f8c /system/lib64/libsurfaceflinger.so (_ZNK7android5Layer19computeScreenBoundsEb+128)

07-03 07:01:02.186 F/DEBUG (14681): #02 pc 00000000000c132c /system/lib64/libsurfaceflinger.so (_ZNSt3__110__function6__funcIZN7android14SurfaceFlinger21computeVisibleRegionsEmjRNS2_6RegionES5_E3$_9NS_9allocatorIS6_EEFvPNS2_5LayerEEEclEOSA_+240)

07-03 07:01:02.186 F/DEBUG (14681): #03 pc 0000000000088838 /system/lib64/libsurfaceflinger.so (_ZN7android5Layer23traverseInReverseZOrderENS_11LayerVector8StateSetERKNSt3__18functionIFvPS0_EEE+152)

07-03 07:01:02.186 F/DEBUG (14681): #04 pc 0000000000088854 /system/lib64/libsurfaceflinger.so (_ZN7android5Layer23traverseInReverseZOrderENS_11LayerVector8StateSetERKNSt3__18functionIFvPS0_EEE+180)

07-03 07:01:02.186 F/DEBUG (14681): #05 pc 000000000008a4c4 /system/lib64/libsurfaceflinger.so (_ZNK7android11LayerVector23traverseInReverseZOrderENS0_8StateSetERKNSt3__18functionIFvPNS_5LayerEEEE+80)

07-03 07:01:02.186 F/DEBUG (14681): #06 pc 00000000000b21fc /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger21computeVisibleRegionsEmjRNS_6RegionES2_+264)

07-03 07:01:02.186 F/DEBUG (14681): #07 pc 00000000000b0300 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger18rebuildLayerStacksEv+364)

07-03 07:01:02.186 F/DEBUG (14681): #08 pc 00000000000afb14 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger20handleMessageRefreshEv+100)

07-03 07:01:02.186 F/DEBUG (14681): #09 pc 00000000000af970 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger17onMessageReceivedEi+252)

07-03 07:01:02.186 F/DEBUG (14681): #10 pc 0000000000015d40 /system/lib64/libutils.so (_ZN7android6Looper9pollInnerEi+332)

07-03 07:01:02.186 F/DEBUG (14681): #11 pc 0000000000015b6c /system/lib64/libutils.so (_ZN7android6Looper8pollOnceEiPiS1_PPv+108)

07-03 07:01:02.186 F/DEBUG (14681): #12 pc 000000000008ae90 /system/lib64/libsurfaceflinger.so (_ZN7android12MessageQueue11waitMessageEv+84)

07-03 07:01:02.186 F/DEBUG (14681): #13 pc 00000000000ae8cc /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger3runEv+20)

07-03 07:01:02.186 F/DEBUG (14681): #14 pc 0000000000002cfc /system/bin/surfaceflinger (main+948)

07-03 07:01:02.186 F/DEBUG (14681): #15 pc 000000000001b830 /system/lib64/libc.so (__libc_init+88)

07-03 07:01:02.187 F/DEBUG (14681): #16 pc 00000000000028a8 /system/bin/surfaceflinger (do_arm64_start+80)

Thanks!!!

UPDATE: another crash. My latest theory that it has something to do with the youtube background playback (a feature I constantly use). Latest stack:

07-04 08:53:37.041 I/DisplayPowerController( 2905): Blocking screen off

07-04 08:53:37.090 I/DreamManagerService( 2905): Entering dreamland.

07-04 08:53:37.091 I/PowerManagerService( 2905): Dozing...

07-04 08:53:37.093 I/DreamController( 2905): Starting dream: name=ComponentInfo{com.android.systemui/com.android.systemui.doze.DozeService}, isTest=false, canDoze=true, userId=0

07-04 08:53:37.122 I/DisplayPowerController( 2905): Unblocked screen off after 80 ms

07-04 08:53:37.309 I/DisplayManagerService( 2905): Display device changed state: "Built-in Screen", OFF

07-04 08:53:37.320 D/WindowManager( 2905): width=1080height=1920

07-04 08:53:37.321 W/Looper ( 2905): Dispatch took 158ms on android.ui, h=Handler (com.android.server.am.ActivityManagerService$UiHandler) {f6fcd5d} cb=null msg=53

07-04 08:53:37.572 D/WindowManager( 2905): width=576height=324

07-04 08:53:37.678 E/ActivityThread(14491): Performing stop of activity that is already stopped: {com.google.android.youtube/com.google.android.apps.youtube.app.WatchWhileActivity}

07-04 08:53:37.678 E/ActivityThread(14491): java.lang.RuntimeException: Performing stop of activity that is already stopped: {com.google.android.youtube/com.google.android.apps.youtube.app.WatchWhileActivity}

07-04 08:53:37.678 E/ActivityThread(14491):	at android.app.ActivityThread.performStopActivityInner(ActivityThread.java:4076)

07-04 08:53:37.678 E/ActivityThread(14491):	at android.app.ActivityThread.handleStopActivity(ActivityThread.java:4164)

07-04 08:53:37.678 E/ActivityThread(14491):	at android.app.ActivityThread.-wrap24(Unknown Source:0)

07-04 08:53:37.678 E/ActivityThread(14491):	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1639)

07-04 08:53:37.678 E/ActivityThread(14491):	at android.os.Handler.dispatchMessage(Handler.java:105)

07-04 08:53:37.678 E/ActivityThread(14491):	at android.os.Looper.loop(Looper.java:172)

07-04 08:53:37.678 E/ActivityThread(14491):	at android.app.ActivityThread.main(ActivityThread.java:6637)

07-04 08:53:37.678 E/ActivityThread(14491):	at java.lang.reflect.Method.invoke(Native Method)

07-04 08:53:37.678 E/ActivityThread(14491):	at com.android.internal.os.Zygote$MethodAndArgsCaller.run(Zygote.java:240)

07-04 08:53:37.678 E/ActivityThread(14491):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:767)

07-04 08:53:37.678 E/ActivityThread(14491):	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:108)

07-04 08:53:37.678 E/ActivityThread(14491): ActivityClientRecord{paused=true, stopped=true, hideForNow=false, startsNotResumed=false, isForward=true, pendingConfigChanges=0, onlyLocalRequest=false, preserveWindow=false, Activity{resumed=false, stopped=true, finished=false, destroyed=false, startedActivity=false, temporaryPause=false, changingConfigurations=false, visibleBehind=false}}

07-04 08:53:37.737 V/KeyguardStatusView( 3363): refresh statusview showing:true

07-04 08:53:37.761 V/KeyguardDisplayManager( 3363): show

07-04 08:54:50.289 I/ActivityManager( 2905): Killing 11815:com.google.android.apps.fitness/u0a157 (adj 906): empty for 1800s

07-04 08:55:51.135 I/JobServiceContext( 2905): bb55ee6 #u0a109/106 com.ticktick.task/.compat.service.job.ReminderPlayJobService

07-04 08:56:23.893 I/PowerManagerService( 2905): Waking up from dozing (uid 1000)...

07-04 08:56:23.935 I/DisplayPowerController( 2905): Blocking screen on until initial contents have been drawn.

07-04 08:56:23.941 I/DisplayManagerService( 2905): Display device changed state: "Built-in Screen", ON

07-04 08:56:24.038 I/DisplayPowerController( 2905): Unblocked screen on after 103 ms

07-04 08:56:24.199 W/PowerManagerService( 2905): Screen on took 426 ms

07-04 08:56:24.199 I/DreamManagerService( 2905): Gently waking up from dream.

07-04 08:56:24.199 I/DreamManagerService( 2905): Performing gentle wake from dream.

07-04 08:56:24.213 I/DreamManagerService( 2905): Leaving dreamland.

07-04 08:56:24.214 I/DreamManagerService( 2905): Performing gentle wake from dream.

07-04 08:56:24.214 I/DreamController( 2905): Stopping dream: name=ComponentInfo{com.android.systemui/com.android.systemui.doze.DozeService}, isTest=false, canDoze=true, userId=0

07-04 08:56:32.088 I/ActivityManager( 2905): START u0 {flg=0x14000000 cmp=com.google.android.apps.photos/.home.HomeActivity (has extras)} from uid 10089

07-04 08:56:32.484 I/ActivityManager( 2905): Start proc 15029:android.process.media/u0a9 for content provider com.android.providers.media/.MediaProvider

07-04 08:56:32.493 D/ActivityManager( 2905): awakeFromSleepingLocked: previously pausing activity didn't pause

07-04 08:56:32.635 V/FingerprintService( 2905): stop client com.android.systemui

07-04 08:56:32.644 W/FingerprintService( 2905): client com.android.systemui is no longer authenticating

07-04 08:56:32.644 V/KeyguardDisplayManager( 3363): hide

07-04 08:56:32.653 E/NotificationService( 2905): Suppressing notification from package by user request.

07-04 08:56:32.655 V/FingerprintService( 2905): Done with client: com.android.systemui

07-04 08:56:32.655 V/FingerprintService( 2905): handleError(client=com.android.systemui, error = 5)

07-04 08:56:32.678 F/libc ( 565): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x48 in tid 565 (surfaceflinger)

07-04 08:56:32.788 F/DEBUG (15060): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

07-04 08:56:32.789 F/DEBUG (15060): Build fingerprint: 'xiaomi/tissot/tissot_sprout:8.0.0/OPR1.170623.026/V.9.5.10.0.ODHMIFA:user/release-keys'

07-04 08:56:32.789 F/DEBUG (15060): Revision: '0'

07-04 08:56:32.789 F/DEBUG (15060): ABI: 'arm64'

07-04 08:56:32.789 F/DEBUG (15060): pid: 565, tid: 565, name: surfaceflinger >>> /system/bin/surfaceflinger <<<

07-04 08:56:32.789 F/DEBUG (15060): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x48

07-04 08:56:32.789 F/DEBUG (15060): Cause: null pointer dereference

07-04 08:56:32.789 F/DEBUG (15060): x0 0000007ff418f398 x1 00000074846ec2b0 x2 0000007ff418f478 x3 0000000000000000

07-04 08:56:32.789 F/DEBUG (15060): x4 0000007ff418f7e8 x5 0000000000000000 x6 000000748482e540 x7 000000748481b9a0

07-04 08:56:32.789 F/DEBUG (15060): x8 00000074846ec000 x9 0000000000000000 x10 0000000000000000 x11 0000000000000000

07-04 08:56:32.789 F/DEBUG (15060): x12 0000007488a0d788 x13 000000748482f6e0 x14 00000000ffffffff x15 000000000002e240

07-04 08:56:32.789 F/DEBUG (15060): x16 00000074893b9f38 x17 00000074897d08e8 x18 0000000000000000 x19 0000007ff418f450

07-04 08:56:32.789 F/DEBUG (15060): x20 00000074846df000 x21 0000000000000000 x22 00000074892f458c x23 0000000000000001

07-04 08:56:32.789 F/DEBUG (15060): x24 0000007ff418f848 x25 0000007ff418f820 x26 0000007ff418f7f8 x27 0000007ff418f7e8

07-04 08:56:32.789 F/DEBUG (15060): x28 0000007ff418f7f4 x29 0000007ff418f410 x30 00000074892cc138

07-04 08:56:32.789 F/DEBUG (15060): sp 0000007ff418f360 pc 00000074892cc154 pstate 0000000020000000

07-04 08:56:32.815 F/DEBUG (15060):

07-04 08:56:32.815 F/DEBUG (15060): backtrace:

07-04 08:56:32.815 F/DEBUG (15060): #00 pc 0000000000081154 /system/lib64/libsurfaceflinger.so (_ZNK7android5Layer12getTransformEv+180)

07-04 08:56:32.815 F/DEBUG (15060): #01 pc 0000000000080f8c /system/lib64/libsurfaceflinger.so (_ZNK7android5Layer19computeScreenBoundsEb+128)

07-04 08:56:32.815 F/DEBUG (15060): #02 pc 00000000000c132c /system/lib64/libsurfaceflinger.so (_ZNSt3__110__function6__funcIZN7android14SurfaceFlinger21computeVisibleRegionsEmjRNS2_6RegionES5_E3$_9NS_9allocatorIS6_EEFvPNS2_5LayerEEEclEOSA_+240)

07-04 08:56:32.815 F/DEBUG (15060): #03 pc 0000000000088838 /system/lib64/libsurfaceflinger.so (_ZN7android5Layer23traverseInReverseZOrderENS_11LayerVector8StateSetERKNSt3__18functionIFvPS0_EEE+152)

07-04 08:56:32.815 F/DEBUG (15060): #04 pc 0000000000088854 /system/lib64/libsurfaceflinger.so (_ZN7android5Layer23traverseInReverseZOrderENS_11LayerVector8StateSetERKNSt3__18functionIFvPS0_EEE+180)

07-04 08:56:32.815 F/DEBUG (15060): #05 pc 000000000008a4c4 /system/lib64/libsurfaceflinger.so (_ZNK7android11LayerVector23traverseInReverseZOrderENS0_8StateSetERKNSt3__18functionIFvPNS_5LayerEEEE+80)

07-04 08:56:32.815 F/DEBUG (15060): #06 pc 00000000000b21fc /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger21computeVisibleRegionsEmjRNS_6RegionES2_+264)

07-04 08:56:32.815 F/DEBUG (15060): #07 pc 00000000000b0300 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger18rebuildLayerStacksEv+364)

07-04 08:56:32.815 F/DEBUG (15060): #08 pc 00000000000afb14 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger20handleMessageRefreshEv+100)

07-04 08:56:32.815 F/DEBUG (15060): #09 pc 00000000000af970 /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger17onMessageReceivedEi+252)

07-04 08:56:32.815 F/DEBUG (15060): #10 pc 0000000000015d40 /system/lib64/libutils.so (_ZN7android6Looper9pollInnerEi+332)

07-04 08:56:32.815 F/DEBUG (15060): #11 pc 0000000000015b6c /system/lib64/libutils.so (_ZN7android6Looper8pollOnceEiPiS1_PPv+108)

07-04 08:56:32.815 F/DEBUG (15060): #12 pc 000000000008ae90 /system/lib64/libsurfaceflinger.so (_ZN7android12MessageQueue11waitMessageEv+84)

07-04 08:56:32.815 F/DEBUG (15060): #13 pc 00000000000ae8cc /system/lib64/libsurfaceflinger.so (_ZN7android14SurfaceFlinger3runEv+20)

07-04 08:56:32.815 F/DEBUG (15060): #14 pc 0000000000002cfc /system/bin/surfaceflinger (main+948)

07-04 08:56:32.816 F/DEBUG (15060): #15 pc 000000000001b830 /system/lib64/libc.so (__libc_init+88)

07-04 08:56:32.816 F/DEBUG (15060): #16 pc 00000000000028a8 /system/bin/surfaceflinger (do_arm64_start+80)

07-04 08:56:32.940 W/NativeCrashListener( 2905): Couldn't find ProcessRecord for pid 565

07-04 08:56:33.039 E/AndroidRuntime(15029): FATAL EXCEPTION: main

07-04 08:56:33.039 E/AndroidRuntime(15029): Process: android.process.media, PID: 15029

07-04 08:56:33.039 E/AndroidRuntime(15029): DeadSystemException: The system died; earlier logs will point to the root cause

07-04 08:56:33.040 E/AndroidRuntime(14491): FATAL EXCEPTION: main

07-04 08:56:33.040 E/AndroidRuntime(14491): Process: com.google.android.youtube, PID: 14491

07-04 08:56:33.040 E/AndroidRuntime(14491): DeadSystemException: The system died; earlier logs will point to the root cause

07-04 08:56:33.041 E/ActivityThread(13718): Failed to find provider info for media

07-04 08:56:33.049 E/AndroidRuntime( 4427): FATAL EXCEPTION: main

07-04 08:56:33.049 E/AndroidRuntime( 4427): Process: com.google.android.googlequicksearchbox:interactor, PID: 4427

07-04 08:56:33.049 E/AndroidRuntime( 4427): DeadSystemException: The system died; earlier logs will point to the root cause

07-04 08:56:33.050 E/AndroidRuntime( 3363): FATAL EXCEPTION: main

07-04 08:56:33.050 E/AndroidRuntime( 3363): Process: com.android.systemui, PID: 3363

07-04 08:56:33.050 E/AndroidRuntime( 3363): DeadSystemException: The system died; earlier logs will point to the root cause

07-04 08:56:33.050 E/AndroidRuntime( 4375): FATAL EXCEPTION: main

07-04 08:56:33.050 E/AndroidRuntime( 4375): Process: com.google.android.gms.persistent, PID: 4375

07-04 08:56:33.050 E/AndroidRuntime( 4375): DeadSystemException: The system died; earlier logs will point to the root cause

07-04 08:56:33.069 E/AndroidRuntime(13718): FATAL EXCEPTION: AsyncTask #1

07-04 08:56:33.069 E/AndroidRuntime(13718): Process: com.google.android.apps.photos, PID: 13718

UPDATE2: I found a stable reproduction! As I suspected, it happens in something related to vanced youtube, so I opened a details thread there, with the reproduction steps: https://xdaforums.com/showpost.php?p=76996980&postcount=3773