Android 12设备上libc.so崩溃问题求助（无法复现）

问题概述 #

在APM平台捕获到仅出现在Android 12设备上的系统SO库异常崩溃，崩溃发生在ReferenceQueueD线程，属于SIGSEGV（段错误），错误码SEGV_MAPERR，访问了无效内存地址。

应用Build Gradle配置 #

compileSdkVersion 31
buildToolsVersion '31.0.0'
defaultConfig {
    minSdkVersion 24
    targetSdkVersion 26

    ndk {  
        abiFilters 'armeabi-v7a', 'arm64-v8a'
    }
}

崩溃日志详情 #

Process Name: 'xxx'
Thread Name: 'ReferenceQueueD'
pid: 29245, tid: 29254  >>> com.xxx.xxxx <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00fffffefffffff0
  x0   00000070a0f4a6c0  x1   00ffffff00000000  x2   0000000000000000  x3   0000000000000000
  x4   0000000000000010  x5   0000006ded2d4340  x6   0003522200034d82  x7   00034dcc00035472
  x8   02ffffff00000000  x9   02ffffff00000000  x10  00000000ecc30e2f  x11  0000000000000000
  x12  0000000000000019  x13  000009f3ba83fe32  x14  00106e6d9f58a32d  x15  0000000034155555
  x16  00000070803f9248  x17  00000070a0eb2c00  x18  0000006d758cc000  x19  00ffffff00000000
  x20  0000000000000000  x21  00000070a0f4a6c0  x22  0000000000000000  x23  0000000014f28e78
  x24  000000006f7aaba0  x25  0000000014f28eb8  x26  0000000000000000  x27  0000006de9217000
  x28  0000000000000043  x29  0000006d7631b6e0  x30  00000070806b0cd0
  sp   0000006d7631b6d0  pc   00000070a0eb8668  pstate 0000000060001000
  v0   0000518400006498000050f0000035e9  v1   000030ff000055ff000052d100004c9a
  v2   00000000001c30000000006dd3dca000  v3   00000000000001000000000000000100
  v4   00000000000221c00000000000022180  v5   0000221c000022180000221400002210
  v6   00000000000000000000000000000000  v7   00000000000000008060180680601806
  v8   00000000000000000000000000000000  v9   00000000000000000000000000000000
  v10  00000000000000000000000000000000  v11  00000000000000000000000000000000
  v12  00000000000000000000000000000000  v13  00000000000000000000000000000000
  v14  00000000000000000000000000000000  v15  00000000000000000000000000000000
  v16  c0300c03c0300c03c0300c03c0300c03  v17  00000000000800000000080001000404
  v18  00000000000000000000080000000000  v19  0000000000000000be00000000000000
  v20  00000000000000003ff0002b8b263fc3  v21  00000000000001480000000000000001
  v22  00000000000000380000000000000001  v23  00000000000002000000000000000001
  v24  00000000000000800000000000000001  v25  00000000000001100000000000000001
  v26  00000000000001800000000000000001  v27  00000000000000b80000000000000001
  v28  00000000000000000000000300000001  v29  000000000000000c0000000000000002
  v30  00000000000000080000000000000002  v31  006d005f00790061006c00650064005f
  fpsr 00000010  fpcr 00000000
    #00 pc 0000000000006668  /apex/com.android.runtime/lib64/bionic/libc.so (_ZN5scudo9AllocatorINS_13AndroidConfigEXadL_Z21scudo_malloc_postinitEEE10deallocateEPvNS_5Chunk6OriginEmm+104)
    #01 pc 0000000000121ccc  /apex/com.android.i18n/lib64/libicui18n.so (_ZN6icu_6812RegexPattern3zapEv+216)
    --- --- --- ---

当前困境 #

测试设备上无法复现该问题，谷歌搜索未找到相关解决方案，急需有效的排查和解决思路。

排查建议 #

• 聚焦ICU正则对象生命周期：崩溃栈显示问题出在libicui18n.so的RegexPattern::zap()方法，这是正则对象的释放逻辑。检查应用或依赖库中是否存在正则对象重复释放、弱引用处理不当的情况，尤其是在ReferenceQueue相关逻辑中。
• 升级targetSdkVersion：当前targetSdk为26，而compileSdk是31（对应Android 12）。尝试将targetSdk升级到31，适配Android 12的系统行为，可能解决系统库调用的兼容性问题。
• 检查JNI层正则操作：如果应用有JNI代码直接调用ICU库，确认内存管理是否规范，避免出现野指针或重复释放。
• 启用Scudo调试：崩溃涉及Scudo内存分配器，Android 12默认启用Scudo。可以在调试时开启Scudo的额外日志，帮助定位内存错误的具体触发点。
• 收集更多设备信息：通过APM收集崩溃设备的具体型号、Android 12小版本号，缩小问题范围，排查是否是特定设备的系统库bug。

内容的提问来源于stack exchange，提问作者AstroNot