signal 11 (SIGSEGV), code 9 (SEGV_MTESERR), fault addr 0x020000760137d68c (read) Stack Trace: RELADDR FUNCTION FILE:LINE v------> ipcz::APIObject::object_type() const ../../third_party/ipcz/src/ipcz/api_object.h:32:43 v------> ipcz::APIObjectImpl::FromObject(ipcz::APIObject*) ../../third_party/ipcz/src/ipcz/api_object.h:80:27 v------> ipcz::APIObjectImpl::FromHandle(unsigned long) ../../third_party/ipcz/src/ipcz/api_object.h:87:12 0000000003180a0c Put ../../third_party/ipcz/src/api.cc:167:26 00000000030ecba8 MojoWriteMessageIpcz ../../mojo/core/core_ipcz.cc:197:29 000000000780f11c mojo::WriteMessageRaw(mojo::MessagePipeHandle, void const*, unsigned long, unsigned long const*, unsigned long, unsigned int) ../../mojo/public/cpp/system/message_pipe.cc:47:10 v------> mojo::android::JNI_CoreImpl_WriteMessage(_JNIEnv*, long, jni_zero::JavaRef<_jobject*> const&, int, jni_zero::JavaRef<_jobject*> const&, int) ../../mojo/public/java/system/core_impl.cc:139:10 v------> _ZZZ57Muxed_org_chromium_mojo_system_impl_CoreImpl_writeMessageENK3$_0clIiEEDaT_ENKUlDpOT_E_clIJRP7_JNIEnvRlRN8jni_zero7JavaRefIPN4java3nio12_JByteBufferEEERiSI_SJ_EEEDTcl25JNI_CoreImpl_WriteMessagespclsr3stdE7forwardIDtfp_EEfp_EEES4_ ../../mojo/public/java/system/core_impl.cc:356:1 v------> _ZZ57Muxed_org_chromium_mojo_system_impl_CoreImpl_writeMessageENK3$_0clIiEEDaT_ ../../mojo/public/java/system/core_impl.cc:356:1 00000000070b4fec Muxed_org_chromium_mojo_system_impl_CoreImpl_writeMessage ../../mojo/public/java/system/core_impl.cc:356:1 00000000002e5100 art_quick_generic_jni_trampoline+144) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000027f3c64 deleted) (offset 0x2000000) (jy6.n+596 /memfd:jit-cache 00000000002cdd94 art_quick_invoke_stub+612) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f5b8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+2688) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b7f0 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+1940) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 0000000000031e94 offset 0x4a56000) (r72.d+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c5574 art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f9a8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b628 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+1484) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000002bf94 offset 0x4a56000) (q80.d+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c5574 art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f9a8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b7f0 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+1940) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 0000000000261908 offset 0x4084000) (ov0.E+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c45fc art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.__uniq.112435418011751916792819755956732575238.llvm.15926011731833139376)+364) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c3d30 artQuickToInterpreterBridge+1020) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000002e5238 art_quick_to_interpreter_bridge+88) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000027f3718 deleted) (offset 0x2000000) (jra.b+2568 /memfd:jit-cache 00000000002cdd94 art_quick_invoke_stub+612) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f5b8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+2688) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b628 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+1484) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000002305a4 offset 0x4084000) (p40.call+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c45fc art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.__uniq.112435418011751916792819755956732575238.llvm.15926011731833139376)+364) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c3d30 artQuickToInterpreterBridge+1020) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000002e5238 art_quick_to_interpreter_bridge+88) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000217f1f4 deleted) (offset 0x2000000) (java.util.concurrent.FutureTask.run+340 /memfd:jit-cache 00000000002cdd94 art_quick_invoke_stub+612) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f5b8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+2688) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b230 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+468) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 0000000000230890 offset 0x4084000) (s40.run+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c5574 art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f9a8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b7f0 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+1940) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048c638 offset 0x4084000) (jy8.run+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c5574 art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000057f9a8 bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000048b7f0 void art::interpreter::ExecuteSwitchImplCpp(art::interpreter::SwitchImplContext*)+1940) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c49a8 ExecuteSwitchImplAsm+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000069cfb8 offset 0x4084000) (org.chromium.base.task.TaskRunnerImpl.runTask+0 /data/app/~~KKeVISiJigiguL7YkeUo0Q==/org.chromium.chrome-tvPGeVQiWB7wis5Ci3UgdQ==/base.apk/libmonochrome.so 00000000003c45fc art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.__uniq.112435418011751916792819755956732575238.llvm.15926011731833139376)+364) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003c3d30 artQuickToInterpreterBridge+1020) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000002e5238 art_quick_to_interpreter_bridge+88) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000002ce060 art_quick_invoke_static_stub+640) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000002ccc9c art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+876) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 000000000060ae14 art::JNI::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+184) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000003454cc art::(anonymous namespace)::CheckJNI::CallMethodV(char const*, _JNIEnv*, _jobject*, _jclass*, _jmethodID*, std::__va_list, art::Primitive::Type, art::InvokeType) (.__uniq.99033978352804627313491551960229047428)+356) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 0000000000815f44 art::(anonymous namespace)::CheckJNI::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list) (.__uniq.99033978352804627313491551960229047428.llvm.14895045140914427511)+60) (BuildId: be34fbe63ff357beb403f9cb39923ea7 /apex/com.android.art/lib64/libart.so 00000000033902e0 _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) ../../third_party/android_toolchain/ndk/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/jni.h:778:9 v------> base::Java_TaskRunnerImpl_runTask(_JNIEnv*, int) gen/jni_headers/base/tasks_jni/TaskRunnerImpl_jni.h:186:8 000000000719a160 base::(anonymous namespace)::RunJavaTask(int) ../../base/android/task_scheduler/task_runner_android.cc:82:3 v------> base::OnceCallback::Run() && ../../base/functional/callback.h:155:12 0000000007129f28 base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ../../base/task/common/task_annotator.cc:229:34 v------> void base::TaskAnnotator::RunTask(perfetto::StaticString, base::PendingTask&, base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)::$_0&&) ../../base/task/common/task_annotator.h:112:5 0000000007156bf4 base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) ../../base/task/thread_pool/task_tracker.cc:691:19 0000000007156c98 base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) ../../base/task/thread_pool/task_tracker.cc:676:3 v------> base::internal::TaskTracker::RunTaskWithShutdownBehavior(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) ../../base/task/thread_pool/task_tracker.cc:706:7 0000000007156590 base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) ../../base/task/thread_pool/task_tracker.cc:506:5 0000000007156054 base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) ../../base/task/thread_pool/task_tracker.cc:394:5 0000000007160584 base::internal::WorkerThread::RunWorker() ../../base/task/thread_pool/worker_thread.cc:473:36 000000000716022c base::internal::WorkerThread::RunPooledWorker() ../../base/task/thread_pool/worker_thread.cc:359:3 00000000071600fc base::internal::WorkerThread::ThreadMain() ../../base/task/thread_pool/worker_thread.cc:339:7 0000000007180768 base::(anonymous namespace)::ThreadFunc(void*) ../../base/threading/platform_thread_posix.cc:102:13 000000000008a714 __pthread_start(void*) (.__uniq.67847048707805468364044055584648682506)+180) (BuildId: 91811ea70d610cb58de95ac6d0978282 /apex/com.android.runtime/lib64/bionic/libc.so 000000000007b3b4 __start_thread+68) (BuildId: 91811ea70d610cb58de95ac6d0978282 /apex/com.android.runtime/lib64/bionic/libc.so