Android NDK崩潰在/system/lib/libz.so

Question

我正在運行一個Cocos2dx項目，我得到了Android上發生的看似隨機的崩潰。我正在測試三星Galaxy Note，但是我也能夠在其他Android設備上也發生同樣的崩潰。

當我試圖從zip文件（擴展文件）讀取時發生崩潰。遊戲崩潰的可能性大約爲1％，所以我沒有明確的repro步驟。

這裏的堆棧跟蹤：

F/libc (11564): Fatal signal 11 (SIGSEGV) at 0x00000003 (code=1), thread 11592 (Thread-866) 
I/DEBUG (1717): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 
I/DEBUG (1717): Build fingerprint: 'samsung/GT-N7000/GT-N7000:4.1.2/JZO54K/N7000XXLT9:user/release-keys' 
I/DEBUG (1717): pid: 11564, tid: 11592, name: Thread-866 >>> com.example.myapp <<< 
I/DEBUG (1717): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000003 
V/AlarmManager(2007): waitForAlarm result :2 
D/STATUSBAR-NetworkController(2129): refreshSignalCluster: data=-1 bt=false 
W/AlarmManager(2007): FACTORY_ON= 0 
I/DEBUG (1717):  r0 0005ffff r1 5fb96b58 r2 00000004 r3 ffffffff 
I/DEBUG (1717):  r4 000004e0 r5 5fbc8180 r6 00000038 r7 80000000 
I/DEBUG (1717):  r8 00000000 r9 5e314f3c sl 5e301420 fp 5e41494c 
I/DEBUG (1717):  ip ffffffff sp 5e4148c0 lr 4004c013 pc 4004c538 cpsr a0000030 
I/DEBUG (1717):  d0 0000000000000000 d1 0000000000000000 
I/DEBUG (1717):  d2 0000000000000000 d3 0000000000000000 
I/DEBUG (1717):  d4 0000000000000000 d5 0000000000000000 
I/DEBUG (1717):  d6 0000020000000000 d7 3f80000044000000 
I/DEBUG (1717):  d8 0000000000000000 d9 0000000000000000 
I/DEBUG (1717):  d10 0000000000000000 d11 0000000000000000 
I/DEBUG (1717):  d12 0000000000000000 d13 0000000000000000 
I/DEBUG (1717):  d14 0000000000000000 d15 0000000000000000 
I/DEBUG (1717):  d16 0000000000000000 d17 0000000000000000 
I/DEBUG (1717):  d18 0000000000000000 d19 0000000000000000 
I/DEBUG (1717):  d20 0000000000000000 d21 0000000000000000 
I/DEBUG (1717):  d22 0000000000000000 d23 0000000000000000 
I/DEBUG (1717):  d24 0000000000000000 d25 0000000000000000 
I/DEBUG (1717):  d26 0000000000000000 d27 0000000000000000 
I/DEBUG (1717):  d28 0000000000000000 d29 0000000000000000 
I/DEBUG (1717):  d30 0000000000000000 d31 0000000000000000 
I/DEBUG (1717):  scr 20000011 
I/DEBUG (1717): 
I/DEBUG (1717): backtrace: 
I/DEBUG (1717):  #00 pc 00014538 /system/lib/libc.so (dlmalloc+1371) 
I/DEBUG (1717):  #01 pc 00016f7f /system/lib/libc.so (malloc+10) 
I/DEBUG (1717):  #02 pc 00bf49b4 /data/data/com.example.myapp/lib/libgame.so (operator new(unsigned int)+24) 
I/DEBUG (1717): 
I/DEBUG (1717): stack: 
I/DEBUG (1717):   5e414880 fffffff1 
I/DEBUG (1717):   5e414884 40110dc4 /system/lib/libz.so 
I/DEBUG (1717):   5e414888 5e314f44 
I/DEBUG (1717):   5e41488c 5e414c80 
I/DEBUG (1717):   5e414890 5ed8356c 
I/DEBUG (1717):   5e414894 fffffff1 
I/DEBUG (1717):   5e414898 5ed47448 
I/DEBUG (1717):   5e41489c 00000000 
I/DEBUG (1717):   5e4148a0 5e414c80 
I/DEBUG (1717):   5e4148a4 4010b7c0 /system/lib/libz.so (inflateInit2_+136) 
I/DEBUG (1717):   5e4148a8 c0000000 
I/DEBUG (1717):   5e4148ac 000004d9 
I/DEBUG (1717):   5e4148b0 00000000 
I/DEBUG (1717):   5e4148b4 002fd0d0 
I/DEBUG (1717):   5e4148b8 df0027ad 
I/DEBUG (1717):   5e4148bc 00000000 
I/DEBUG (1717):  #00 5e4148c0 00000000 
I/DEBUG (1717):   5e4148c4 00000000 
I/DEBUG (1717):   5e4148c8 00000000 
I/DEBUG (1717):   5e4148cc 5ea2ef50 
I/DEBUG (1717):   5e4148d0 00000000 
I/DEBUG (1717):   5e4148d4 000004d9 
I/DEBUG (1717):   5e4148d8 5f0a2dfc 
I/DEBUG (1717):   5e4148dc 002fd0d0 
I/DEBUG (1717):   5e4148e0 5e314f44 
I/DEBUG (1717):   5e4148e4 5e414c80 
I/DEBUG (1717):   5e4148e8 5e314f3c 
I/DEBUG (1717):   5e4148ec 5e301420 
I/DEBUG (1717):   5e4148f0 5e41494c 
I/DEBUG (1717):   5e4148f4 4004ef81 /system/lib/libc.so (malloc+12) 
I/DEBUG (1717):  #01 5e4148f8 000004d9 
I/DEBUG (1717):   5e4148fc 5dcfd9b8 /data/data/com.example.myapp/lib/libgame.so (operator new(unsigned int)+28) 
I/DEBUG (1717):  #02 5e414900 5ea2df18 
I/DEBUG (1717):   5e414904 5f0a2dfc 
I/DEBUG (1717):   5e414908 5ecef9a4 
I/DEBUG (1717):   5e41490c 5dcfccf4 /data/data/com.example.myapp/lib/libgame.so (operator new[](unsigned int)+8) 
I/DEBUG (1717):   5e414910 000004d9 
I/DEBUG (1717):   5e414914 5db3e3e8 /data/data/com.example.myapp/lib/libgame.so (cocos2d::ZipFile::getFileData(std::string const&, unsigned long*)+352) 
I/DEBUG (1717):   5e414918 5f0a2e22 
I/DEBUG (1717):   5e41491c 5e414998 
I/DEBUG (1717):   5e414920 5e414968 
I/DEBUG (1717):   5e414924 5ea2df18 
I/DEBUG (1717):   5e414928 5fc75108 
I/DEBUG (1717):   5e41492c 5ea2df30 
I/DEBUG (1717):   5e414930 00000000 
I/DEBUG (1717):   5e414934 00000000 
I/DEBUG (1717):   5e414938 5e414984 
I/DEBUG (1717):   5e41493c 01d971d9 
I/DEBUG (1717): 
I/DEBUG (1717): memory near r0: 
I/DEBUG (1717):  0005ffdc ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  0005ffec ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  0005fffc ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  0006000c ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  0006001c ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717): 
I/DEBUG (1717): memory near r1: 
I/DEBUG (1717):  5fb96b38 00000000 00000000 00000000 ffffffff ................ 
I/DEBUG (1717):  5fb96b48 00000000 00000000 40c19600 5edf1128 ...........@(..^ 
I/DEBUG (1717):  5fb96b58 000000a8 000005e1 5fb96b58 5fb96b58 ........Xk._Xk._ 
I/DEBUG (1717):  5fb96b68 5fb94fd8 5eceb800 5fbc8180 00000004 .O._...^..._.... 
I/DEBUG (1717):  5fb96b78 00000000 3f800000 3f800000 00000000 .......?...?.... 
I/DEBUG (1717): 
I/DEBUG (1717): memory near r5: 
I/DEBUG (1717):  5fbc8160 00000000 00000000 00000000 00000000 ................ 
I/DEBUG (1717):  5fbc8170 00000000 00000000 00000000 00000000 ................ 
I/DEBUG (1717):  5fbc8180 00630061 00000519 5fbc8180 5fbc8180 a.c........_..._ 
I/DEBUG (1717):  5fbc8190 5fb8ee78 5fb96b58 4008163c 00000004 x.._Xk._<..@.... 
I/DEBUG (1717):  5fbc81a0 00000000 3f800000 3f800000 00000000 .......?...?.... 
I/DEBUG (1717): 
I/DEBUG (1717): memory near r7: 
I/DEBUG (1717):  7fffffe0 ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  7ffffff0 ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  80000000 ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  80000010 ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717):  80000020 ffffffff ffffffff ffffffff ffffffff ................ 
I/DEBUG (1717): 
I/DEBUG (1717): memory near r9: 
I/DEBUG (1717):  5e314f1c 00000000 00000000 5f53b6e9 5e314f50 ..........S_PO1^ 
I/DEBUG (1717):  5e314f2c 5d0620a0 5745d968 00000000 00000000 . .]h.EW........ 
I/DEBUG (1717):  5e314f3c 5e314f6c 588d8406 5745dcf0 5d0620a0 lO1^...X..EW. .] 
I/DEBUG (1717):  5e314f4c 5f540e05 42150c40 421f3670 5e314fdc ..T_@..Bp6.B.O1^ 
I/DEBUG (1717):  5e314f5c 588d8a00 5745e4d8 588d8406 00000000 ...X..EW...X.... 
I/DEBUG (1717): 
I/DEBUG (1717): memory near sl: 
I/DEBUG (1717):  5e301400 3f800000 00000010 41476e00 00000453 ...?.....nGAS... 
I/DEBUG (1717):  5e301410 5d0620a0 5e314f3c 5745dcf0 5cff9000 . .]<O1^..EW...\ 
I/DEBUG (1717):  5e301420 421c9308 00000000 5e414da8 00000000 ...B.....MA^.... 
I/DEBUG (1717):  5e301430 5e414ddc 0000000b 00000000 408220c0 .MA^......... .@ 
I/DEBUG (1717):  5e301440 00000000 00000000 566e8270 5e311300 ........p.nV..1^ 
I/DEBUG (1717): 
I/DEBUG (1717): memory near fp: 
I/DEBUG (1717):  5e41492c 5ea2df30 00000000 00000000 5e414984 0..^.........IA^ 
I/DEBUG (1717):  5e41493c 01d971d9 000000ad 000004d9 5e414984 .q...........IA^ 
I/DEBUG (1717):  5e41494c 5db1664c 5e414998 5de6a954 5f0a0944 Lf.].IA^T..]D.._ 
I/DEBUG (1717):  5e41495c 5ea2cca8 60de10b8 5f0a2dfc 5f0a22ec ...^...`.-._."._ 
I/DEBUG (1717):  5e41496c 00000000 60de10b8 5db0ceec 5db0ceec .......`...]...] 
I/DEBUG (1717): 
I/DEBUG (1717): memory near sp: 
I/DEBUG (1717):  5e4148a0 5e414c80 4010b7c0 c0000000 000004d9 .LA^...@........ 
I/DEBUG (1717):  5e4148b0 00000000 002fd0d0 df0027ad 00000000 ....../..'...... 
I/DEBUG (1717):  5e4148c0 00000000 00000000 00000000 5ea2ef50 ............P..^ 
I/DEBUG (1717):  5e4148d0 00000000 000004d9 5f0a2dfc 002fd0d0 .........-._../. 
I/DEBUG (1717):  5e4148e0 5e314f44 5e414c80 5e314f3c 5e301420 DO1^.LA^<O1^ .0^ 
I/DEBUG (1717): 
I/DEBUG (1717): code around pc: 
I/DEBUG (1717):  4004c518 0c82eb05 312cf8dc 0856b38b f1c62a1f ......,1..V..*.. 
I/DEBUG (1717):  4004c528 bf080719 21002700 f707fa14 460d4646 .....'.!....FF.F 
I/DEBUG (1717):  4004c538 c004f8d3 0803f02c 0808ebc4 d20445b0 ....,........E.. 
I/DEBUG (1717):  4004c548 0f00f1b8 4646d01b ea4f461d f8d378d7 ......FF.FO..x.. 
I/DEBUG (1717):  4004c558 f108c014 f8530804 f11c3028 bf180800 ......S.(0...... 
I/DEBUG (1717): 
I/DEBUG (1717): code around lr: 
I/DEBUG (1717):  4004bff0 b930fd21 2becf8df f8d2447a 078b11b4 !.0....+zD...... 
I/DEBUG (1717):  4004c000 f8dfd50a 447d5be4 70dcf505 f7fe2500 .....[}D...p.%.. 
I/DEBUG (1717):  4004c010 2800e958 8249f041 f2002cf4 2c0a823f X..(A.I..,..?.., 
I/DEBUG (1717):  4004c020 340bd903 0407f024 2410e000 7bbcf8df ...4$......$...{ 
I/DEBUG (1717):  4004c030 447f08e2 fa36683e 079df302 f003d042 ...D>h6.....B... 
I/DEBUG (1717): !@dumpstate -k -t -z -d -o /data/log/dumpstate_app_native -m 11564 

Answer 1

崩潰，很可能是因爲由於不當內存釋放泄漏堆損壞。

如果您使用的是C++，那麼我建議您使用std::tr1::shared_ptr來避免手動釋放內存。如果你只使用C，那麼儘量不要malloc/free。

它也可以是mmap而不是munmap的結果。在完成mmap分配的內存後，立即執行munmap。