[S20 FE] Samsung Camera crash when taking photos with the ultra wide camera sensor

[salvogiangri]

Device name:

Galaxy S20 FE

Steps to reproduce:

1. Open the Samsung Camera app
2. Switch to the 0.5x lens
3. Take a photo

Expected behaviour:

The camera app should capture the photo and store it in the desired storage media.

Actual behaviour:

The camera app crashes without capturing the photo.

Logs:

Currently the real reason behind the crash is unknown. In system logs we can observe the camera HAL crashing due to a null pointer exception when trying to capture the image:

06-30 17:19:34.278 16834 19613 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 19613 (HwBinder:16834_), pid 16834 ([email protected])
06-30 17:19:34.769 19864 19864 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-30 17:19:34.769 19864 19864 F DEBUG   : Build fingerprint: 'samsung/dm1qxtur/dm1q:14/UP1A.231005.007/S911BXXS5CXE9:user/release-keys'
06-30 17:19:34.769 19864 19864 F DEBUG   : Revision: '10'
06-30 17:19:34.769 19864 19864 F DEBUG   : ABI: 'arm64'
06-30 17:19:34.769 19864 19864 F DEBUG   : Processor: '5'
06-30 17:19:34.769 19864 19864 F DEBUG   : Timestamp: 2024-06-30 17:19:34.452774956+0300
06-30 17:19:34.769 19864 19864 F DEBUG   : Process uptime: 0s
06-30 17:19:34.769 19864 19864 F DEBUG   : Cmdline: /vendor/bin/hw/[email protected]_64
06-30 17:19:34.769 19864 19864 F DEBUG   : pid: 16834, tid: 19613, name: HwBinder:16834_  >>> /vendor/bin/hw/[email protected]_64 <<<
06-30 17:19:34.769 19864 19864 F DEBUG   : uid: 1047
06-30 17:19:34.769 19864 19864 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000
06-30 17:19:34.769 19864 19864 F DEBUG   : Cause: null pointer dereference
06-30 17:19:34.769 19864 19864 F DEBUG   :     x0  0000000000000004  x1  0000000000070002  x2  0000007b6506b720  x3  0000000000000000
06-30 17:19:34.769 19864 19864 F DEBUG   :     x4  0000000000000000  x5  0000007c18b2aa90  x6  0000000000000000  x7  0000007c18b2aa90
06-30 17:19:34.769 19864 19864 F DEBUG   :     x8  0000000000000000  x9  0000000000070002  x10 0000000000000001  x11 0000000000000159
06-30 17:19:34.769 19864 19864 F DEBUG   :     x12 0000000000000038  x13 0000000000080002  x14 0000007b65069d28  x15 0000000000000000
06-30 17:19:34.769 19864 19864 F DEBUG   :     x16 0000000000000000  x17 3d120a6702c255f6  x18 0000007b5f11c000  x19 0000007bfb809650
06-30 17:19:34.769 19864 19864 F DEBUG   :     x20 0000007bfb809650  x21 b400007bcdb2f030  x22 0000007bfbae7b08  x23 0000007b6506baa0
06-30 17:19:34.769 19864 19864 F DEBUG   :     x24 0000000000000000  x25 b400007bcdb391d7  x26 b400007bc13ce300  x27 0000000000000000
06-30 17:19:34.770 19864 19864 F DEBUG   :     x28 0000000000000000  x29 0000007b6506b8f0
06-30 17:19:34.770 19864 19864 F DEBUG   :     lr  0000007bfba38984  sp  0000007b6506a180  pc  0000007bfba38998  pst 0000000060001000
06-30 17:19:34.770 19864 19864 F DEBUG   : 27 total frames
06-30 17:19:34.770 19864 19864 F DEBUG   : backtrace:
06-30 17:19:34.770 19864 19864 F DEBUG   :       #00 pc 000000000029c998  /vendor/lib64/hw/com.qti.chi.override.so (SecUsecaseMultiCamera::GenerateRealtimeRequest(camera3_capture_request*, ChiMetadata*)+23480) (BuildId: 325128926c1991c5bad00e887ec5cfb1)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #01 pc 0000000000295808  /vendor/lib64/hw/com.qti.chi.override.so (SecUsecaseMultiCamera::ExecuteCaptureRequest(camera3_capture_request*)+25736) (BuildId: 325128926c1991c5bad00e887ec5cfb1)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #02 pc 00000000001667ac  /vendor/lib64/hw/com.qti.chi.override.so (Usecase::ProcessCaptureRequest(camera3_capture_request*)+3124) (BuildId: 325128926c1991c5bad00e887ec5cfb1)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #03 pc 0000000000130aa8  /vendor/lib64/hw/com.qti.chi.override.so (ExtensionModule::OverrideProcessRequest(camera3_device const*, camera3_capture_request*, void*)+2864) (BuildId: 325128926c1991c5bad00e887ec5cfb1)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #04 pc 00000000002fe108  /vendor/lib64/hw/camera.qcom.so (CamX::HALDevice::ProcessCaptureRequest(CamX::Camera3CaptureRequest*)+216) (BuildId: acd0bd0eef4645126604ee918d71bd8c)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #05 pc 00000000002f0ebc  /vendor/lib64/hw/camera.qcom.so (CamX::process_capture_request(camera3_device const*, camera3_capture_request*)+1692) (BuildId: acd0bd0eef4645126604ee918d71bd8c)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #06 pc 00000000000ef230  /vendor/lib64/[email protected] (unihal::CameraDevice::ProcessCaptureRequest(unsigned int, camera3_capture_request*)+108) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #07 pc 00000000000f0f8c  /vendor/lib64/[email protected] (unihal::MultiCameraManager::ProcessCaptureRequest(unsigned int, camera3_capture_request*)+88) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #08 pc 00000000000eb384  /vendor/lib64/[email protected] (unihal::HalCaptureMediator::SendRequestToHal(unsigned int, camera3_capture_request*)+120) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #09 pc 00000000000e8a10  /vendor/lib64/[email protected] (unihal::HalCaptureMediator::ProcessProcData(unihal::RequestUnit*, std::__1::vector<unihal::ProcData*, std::__1::allocator<unihal::ProcData*> >&, bool, int*)+544) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #10 pc 00000000000e8654  /vendor/lib64/[email protected] (unihal::HalCaptureMediator::ProcessCaptureRequest(unihal::RequestUnit*, int*)+240) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #11 pc 00000000000d8148  /vendor/lib64/[email protected] (unihal::CameraHalUnit::ProcessCaptureRequest(camera3_capture_request*)+556) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #12 pc 00000000000d5550  /vendor/lib64/[email protected] (unihal::CameraHalManager::ProcessCaptureRequest(camera3_device const*, camera3_capture_request*)+296) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #13 pc 00000000000c9eac  /vendor/lib64/[email protected] (unihal::uni_process_capture_request(camera3_device const*, camera3_capture_request*)+1060) (BuildId: 232758ec988c985693875d9fe1486494)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #14 pc 0000000000028778  /vendor/lib64/[email protected] (vendor::samsung::hardware::camera::device::V5_0::implementation::SehCameraDeviceSession::sehProcessOneCaptureRequest(vendor::samsung::hardware::camera::device::V5_0::SehCaptureRequest const&)+3256) (BuildId: 2740dc9c3bfb58ca5faae9f58973135e)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #15 pc 0000000000027a20  /vendor/lib64/[email protected] (vendor::samsung::hardware::camera::device::V5_0::implementation::SehCameraDeviceSession::sehProcessCaptureRequest(android::hardware::hidl_vec<vendor::samsung::hardware::camera::device::V5_0::SehCaptureRequest> const&, android::hardware::hidl_vec<android::hardware::camera::device::V3_2::BufferCache> const&, std::__1::function<void (android::hardware::camera::common::V1_0::Status, unsigned int)>)+92) (BuildId: 2740dc9c3bfb58ca5faae9f58973135e)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #16 pc 000000000002ec68  /vendor/lib64/[email protected] (vendor::samsung::hardware::camera::device::V5_0::implementation::SehCameraDeviceSession::SehTrampolineSessionInterface::sehProcessCaptureRequest(android::hardware::hidl_vec<vendor::samsung::hardware::camera::device::V5_0::SehCaptureRequest> const&, android::hardware::hidl_vec<android::hardware::camera::device::V3_2::BufferCache> const&, std::__1::function<void (android::hardware::camera::common::V1_0::Status, unsigned int)>)+148) (BuildId: 2740dc9c3bfb58ca5faae9f58973135e)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #17 pc 0000000000037f74  /vendor/lib64/[email protected] (vendor::samsung::hardware::camera::device::V5_0::BnHwSehCameraDeviceSession::_hidl_sehProcessCaptureRequest(android::hidl::base::V1_0::BnHwBase*, android::hardware::Parcel const&, android::hardware::Parcel*, std::__1::function<void (android::hardware::Parcel&)>)+568) (BuildId: 81f8ef9d75d352355638b15f021868fa)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #18 pc 0000000000038668  /vendor/lib64/[email protected] (vendor::samsung::hardware::camera::device::V5_0::BnHwSehCameraDeviceSession::onTransact(unsigned int, android::hardware::Parcel const&, android::hardware::Parcel*, unsigned int, std::__1::function<void (android::hardware::Parcel&)>)+1032) (BuildId: 81f8ef9d75d352355638b15f021868fa)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #19 pc 00000000000826d0  /apex/com.android.vndk.v30/lib64/libhidlbase.so (android::hardware::BHwBinder::transact(unsigned int, android::hardware::Parcel const&, android::hardware::Parcel*, unsigned int, std::__1::function<void (android::hardware::Parcel&)>)+68) (BuildId: bdc764630cb78156de4d84000d90ce5f)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #20 pc 0000000000086668  /apex/com.android.vndk.v30/lib64/libhidlbase.so (android::hardware::IPCThreadState::getAndExecuteCommand()+1076) (BuildId: bdc764630cb78156de4d84000d90ce5f)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #21 pc 00000000000878b0  /apex/com.android.vndk.v30/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+96) (BuildId: bdc764630cb78156de4d84000d90ce5f)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #22 pc 0000000000096ad4  /apex/com.android.vndk.v30/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24) (BuildId: bdc764630cb78156de4d84000d90ce5f)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #23 pc 00000000000154d0  /apex/com.android.vndk.v30/lib64/libutils.so (android::Thread::_threadLoop(void*)+260) (BuildId: 302a93d93d50a20e71c051933fe98b5f)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #24 pc 0000000000014d94  /apex/com.android.vndk.v30/lib64/libutils.so (thread_data_t::trampoline(thread_data_t const*)+412) (BuildId: 302a93d93d50a20e71c051933fe98b5f)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #25 pc 00000000000fd0f4  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 02a91a85343debb2911714273ff2b670)
06-30 17:19:34.770 19864 19864 F DEBUG   :       #26 pc 0000000000096a04  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 02a91a85343debb2911714273ff2b670)

Additional context:

Enabling "Location tags" in the Samsung Camera app Settings will temporarely address the issue.

[salvogiangri]

Stuff we've tried out but hasn't solved the issue:

• Stock system build props
• A14 Camera API libs (lib(Ultra)WideDistortionCorrection.camera.samsung.so, libImageTagger.camera.samsung.so)
• Stock/One UI 5.1 Camera app
• Backported UniHal from A14