[Bug] App crashes at [libFirebaseCppApp-13_2_0.so] firebase::messaging::Notification::~Notification()

[szagurskii]

Description

Stack trace is below. Happens on:

• Android 15 (SDK 35)
• Android 14 (SDK 34)
• Android 13 (SDK 33)
• Android 12 (SDK 31)
• Android 11 (SDK 30)

Top Devices Affected by This Issue:

Device	Affected Users	Events	RAM (TotalMem)	System on Chip
Redmi gale	4 (4.0%)	7 (5.1%)	– (8,046 MB)	Mediatek MT6769Z
samsung a24	4 (4.0%)	6 (4.4%)	– (5,934 MB)	Mediatek MT6789V/CD
TECNO TECNO-L16	4 (4.0%)	4 (2.9%)	8,192 MB (8,055 MB)	Mediatek MT6789V/CD
samsung a15	3 (3.0%)	5 (3.7%)	4,096 MB (3,815 MB)	Mediatek MT6789V/CD
Redmi sapphiren	2 (2.0%)	4 (2.9%)	– (7,970 MB)	QTI SM6225
POCO redwood	2 (2.0%)	3 (2.2%)	– (7,539 MB)	Qualcomm SM7325
Redmi obsidian	2 (2.0%)	3 (2.2%)	8,192 MB (8,027 MB)	Mediatek MT6789
POCO duchamp	2 (2.0%)	2 (1.5%)	– (11,892 MB)	Mediatek MT6897
POCO gust	2 (2.0%)	2 (1.5%)	– (8,046 MB)	Mediatek MT6769Z
POCO malachite	2 (2.0%)	2 (1.5%)	8,192 MB (7,789 MB)	Mediatek MT6878
POCO vayu	2 (2.0%)	2 (1.5%)	– (7,863 MB)	Qualcomm SM8150
Redmi emerald	2 (2.0%)	2 (1.5%)	8,192 MB (8,027 MB)	Mediatek MT6789
TECNO TECNO-BG6	2 (2.0%)	2 (1.5%)	– (3,954 MB)	Spreadtrum T606
TECNO TECNO-LH6n	2 (2.0%)	2 (1.5%)	4,096 MB (3,914 MB)	Mediatek MT6769V/CD
samsung a16	2 (2.0%)	2 (1.5%)	4,096 MB (3,797 MB)	Mediatek MT6789V/CD
samsung a25x	2 (2.0%)	2 (1.5%)	– (7,758 MB)	Samsung s5e8825
realme RE6070L1	1 (1.0%)	4 (2.9%)	8,192 MB (5,884 MB)	Mediatek MT6835
samsung a35x	1 (1.0%)	4 (2.9%)	– (7,798 MB)	Samsung s5e8835

pid: 0, tid: 18633 >>> com.example.package <<<

backtrace:
  #00  pc 0x000000000008aa28  /apex/com.android.runtime/lib64/bionic/libc.so (abort+168)
  #01  pc 0x0000000000047c4c  /apex/com.android.runtime/lib64/bionic/libc.so (free+108)
  #02  pc 0x000000000022b59c  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libFirebaseCppApp-13_2_0.so (firebase::messaging::Notification::~Notification()+48)
  #03  pc 0x000000000022bc28  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libFirebaseCppApp-13_2_0.so (firebase::messaging::Message::~Message()+28)
  #04  pc 0x000000000022bbd8  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libFirebaseCppApp-13_2_0.so (Firebase_Messaging_CSharp_delete_FirebaseMessageInternal+20)
  #05  pc 0x00000000040f3cfc  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (FirebaseMessagingInternalPINVOKE_delete_FirebaseMessageInternal_mD15EF62AC59E1DA718AEDD7AFE2D4AACD824A304+6284) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #06  pc 0x00000000040f3ba0  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (FirebaseMessageInternal_Dispose_m3EC0B7CCD31B6953F328C6C21F86E8E49A6A8D7F+4686) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #07  pc 0x00000000040f3a50  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (FirebaseMessageInternal_Finalize_m12BEABABC4325D74C2E471C086110DD341457C9E+21) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #08  pc 0x00000000034cd754  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**)+608) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #09  pc 0x00000000034cd6a0  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**)+594) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #10  pc 0x0000000003511bac  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (il2cpp::gc::GarbageCollector::RunFinalizer(void*, void*)+178) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #11  pc 0x00000000035510a4  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (GC_invoke_finalizers+1315) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #12  pc 0x0000000003511af4  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (il2cpp::gc::FinalizerThread(void*)+460) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #13  pc 0x0000000003530600  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (il2cpp::os::Thread::RunWrapper(void*)+201) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #14  pc 0x00000000034d5a88  /data/app/~~gdOjq7M7LrgLarvF6dPmbA==/com.example.package-hkjPdZzSBSGthV8hkh80ng==/lib/arm64/libil2cpp.so (il2cpp::os::ThreadImpl::ThreadStartWrapper(void*)+123) (BuildId: 4fb9df01887d86e49baf7a59ebef9b3df6efe370)
  #15  pc 0x00000000000efb14  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+264)
  #16  pc 0x000000000008c35c  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68)

Several crashes of a very similar nature with similar stack traces from Firebase Messaging are currently at the top of a recent release. Please advise.

Reproducing the issue

We have not been able to reproduce it.

Firebase Unity SDK Version

13.2.0

Unity editor version

2022.3.60f1

Installation Method

Unity Package Manager

Problematic Firebase Component(s)

Messaging

Other Firebase Component(s) in use

Messaging, Remote Config, Crashlytics, Analytics, Installations

Additional SDKs you are using

Facebook, AppsFlyer, Play In-App Update, Play Integrity, Play In-App Review, TapJoy

Targeted Platform(s)

Android

Unity editor platform

Windows, Mac

Scripting Runtime

IL2CPP

Release Distribution Type

Pre-built SDK from https://firebase.google.com/download/unity

Relevant Log Output

If using CocoaPods for Apple platforms, the project's Podfile.lock

The crash is from Android platform.

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[niccolo-hare]

Hi @szagurskii, thanks for reaching out. I tried setting up a similar app, but I didn't encounter any issues when receiving a message. What I did was, I initialized all the Firebase SDKs included in the details you shared, used an emulator with 16 KB page size, then sent a test message.
This seems to indicate that the SDK is functioning properly, but I'm curious as to how and when this issue occurred. To help us give us a better idea of the cause, could you answer these questions:

• In general, when did the issue start appearing?
• What was the last SDK version you used with your app before using version 13.2.0?
• Could you give us an idea of how many users are affected, compared to how many you have in total?

There might also be some clue with regards to the type of message you sent. I would appreciate it if you could also share a sample of the request or payload you used for your campaign where this issue occurred. However, please ensure that there's no PIIs included in the sample.

[szagurskii]

Hi @niccolo-hare, thanks for getting back.

In general, when did the issue start appearing?

This issue started appearing when we released push notifications feature (integrated Firebase Messaging) in our game.

What was the last SDK version you used with your app before using version 13.2.0?

Before releasing, we had Firebase SDK 12.4.1 but we had no Firebase Messaging in it. We only had Remote Config, Crashlytics, Analytics. Moreover, we already tried to remedy this issue by downgrading to 12.10.1 from 13.2.0. It did not help and our dashboard now looks like this:

Could you give us an idea of how many users are affected, compared to how many you have in total?

In my analysis, a lot. Currently, we shipped to Open Testing Track in Google Play and have ~8k active users in that track, giving us 238 users who experienced the crash at least once, so at least 2% crash rate. Google Play Store stats for open testing and prod are below:

As the crash happens both on 13.2.0 and 12.10.1, I decided to give 13.2.0 a go again to open testing and changed some code which is connected to Dispose methods and Action delegates with a hope that it could fix the problem.

[szagurskii]

This is an example of the payload we send to our users, it is localized on the server, so here can be any language including right to left languages.

{
  "message": {
    "token": "<token>",
    "notification": {
      "title": "Base Attacked",
      "body": "Your base is under attack! Server EU #1"
    },
    "data": {},
    "android": {
      "notification": {
        "channel_id": "push.base.attacked.title",
        "priority": "max"
      }
    }
  }
}

[a-maurice]

I think I know what the issue might be, and have addressed it in the PR mentioned above. In the meantime, a rather clunky workaround could be to hold onto a reference to the Message, to prevent it's deletion. Obviously not ideal, and it would still have problems when closing the app.

[a-maurice]

The 13.3.0 release includes that fix for this, https://github.com/firebase/firebase-unity-sdk/releases/tag/v13.3.0

Thanks for raising the issue with us, and all the info you gave, it really helped.