[Android] SIGSEGV in DestroySurface after repeated CloseMedia → OpenMedia cycles on Android

[qa0108]

Unity version

6000.3.4f1

Unity editor platform

Windows

AVPro Video edition

Core

AVPro Video version

3.3.6

Device hardware

POCO X7 Pro

Which Android OS version are you using?

16

Unity Graphics API

OpenGLES 3

Video API

media3/ExoPlayer

Texture format

BGRA

Audio output

System Direct

Any other Media Player component configuration required to reproduce the issue.

No

Which output component(s) are you using?

Display uGUI

Any other component configuration required to reproduce the issue.

No response

The issue

Native crash (SIGSEGV) in Java_com_renderheads_AVPro_Video_Manager_DestroySurface after playing through several levels.

We have a background video player that switches wallpaper videos between levels. Each level transition calls CloseMedia() then OpenMedia() on the same MediaPlayer instance. After a few levels, the app crashes.

The crash call chain:

Player_Base$1.run              → deferred Runnable via Handler.post()
  Player_Base._Deinitialise
    Player_Base._CloseVideo
      Player_ExoPlayer.CloseVideoOnPlayer
        DestroySurface+68      → SIGSEGV

The crash is in the deferred Handler.post() callback — DestroySurface is called on a surface that is no longer valid.

We observe the same crash at the same rate in two separate projects using different code patterns but the same AVPro version (3.3.6), which suggests the issue is in the native layer.

Media information

No response

Logcat output

#00 pc 0000000000041d30 /data/app/~~hDA-2aiXBkFgIZwvz4GTPQ==/com.arrow.out.dream.crochet.maze-uEySrlzg9E38-ZvkwnjKhA==/lib/arm64/libAVProVideo2Native.so (Java_com_renderheads_AVPro_Video_Manager_DestroySurface+68) (BuildId: 770b2dea6406194e5993fb4d340492ebaf410d2b)
      #01 pc 00000000011d37bc /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+108)
      #02 pc 00000000006683e8 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #03 pc 0000000000607d52 /data/app/~~hDA-2aiXBkFgIZwvz4GTPQ==/com.arrow.out.dream.crochet.maze-uEySrlzg9E38-ZvkwnjKhA==/base.apk (offset 0x7502000) (com.renderheads.AVPro.Video.Player_ExoPlayer.CloseVideoOnPlayer+114)
      #04 pc 00000000006692a4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #05 pc 0000000000603b8a /data/app/~~hDA-2aiXBkFgIZwvz4GTPQ==/com.arrow.out.dream.crochet.maze-uEySrlzg9E38-ZvkwnjKhA==/base.apk (offset 0x7502000) (com.renderheads.AVPro.Video.Player_Base._CloseVideo+450)
      #06 pc 00000000006692a4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #07 pc 0000000000603bb4 /data/app/~~hDA-2aiXBkFgIZwvz4GTPQ==/com.arrow.out.dream.crochet.maze-uEySrlzg9E38-ZvkwnjKhA==/base.apk (offset 0x7502000) (com.renderheads.AVPro.Video.Player_Base._Deinitialise+16)
      #08 pc 00000000006692a4 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #09 pc 0000000000603c28 /data/app/~~hDA-2aiXBkFgIZwvz4GTPQ==/com.arrow.out.dream.crochet.maze-uEySrlzg9E38-ZvkwnjKhA==/base.apk (offset 0x7502000) (com.renderheads.AVPro.Video.Player_Base.access$000+0)
      #10 pc 0000000000668384 /apex/com.android.art/lib64/libart.so (nterp_helper+52) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #11 pc 0000000000634544 /data/app/~~hDA-2aiXBkFgIZwvz4GTPQ==/com.arrow.out.dream.crochet.maze-uEySrlzg9E38-ZvkwnjKhA==/base.apk (offset 0x7c68000) (com.renderheads.AVPro.Video.Player_Base$1.run+4)
      #12 pc 0000000000a80134 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (android.os.Handler.dispatchMessage+68)
      #13 pc 0000000000ac9770 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (android.os.Looper.loopOnce+1296)
      #14 pc 0000000000ac91e4 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (android.os.Looper.loop+244)
      #15 pc 00000000007453f0 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (android.app.ActivityThread.main+1648)
      #16 pc 00000000002ab260 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+640) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #17 pc 00000000002a12b4 /apex/com.android.art/lib64/libart.so (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+552) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #18 pc 00000000005ac130 /apex/com.android.art/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277)+32) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #19 pc 00000000011d3474 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+116)
      #20 pc 0000000000e6bab4 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+116)
      #21 pc 0000000000e75b8c /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (com.android.internal.os.ZygoteInit.main+3900)
      #22 pc 00000000002ab260 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+640) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #23 pc 00000000002a9e60 /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+876) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #24 pc 000000000060b158 /apex/com.android.art/lib64/libart.so (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+184) (BuildId: a1fcb66a9fb3fa9071e8a42dcf9cd5ea)
      #25 pc 000000000010b568 /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+104) (BuildId: 650706803879c5ecb8d05a4f2f246ef7)
      #26 pc 0000000000139134 /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+1204) (BuildId: 650706803879c5ecb8d05a4f2f246ef7)
      #27 pc 0000000000004698 /system/bin/app_process64 (main+1464) (BuildId: 8298230449e9ce4665160e74afe511e7)
      #28 pc 000000000006c1c8 /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+120) (BuildId: bb3194b7811ae2cf4021b5d37f3bd860)