firebase-messaging crashes in v23.1.2

[slowcar]

We have a crash in our release build and have identified the last update of firebase-messaging as the source.
The issue does not appear with 'com.google.firebase:firebase-messaging:23.1.1', but does when updating it to 23.1.2
Downgrading firebase-messaging to 23.1.1 resolves the crash.

According to the playstore pre-launch report the issue occurs in devices with Android 10+
We have reproduced the issue on a Pixel 1 (Android 10) and a Pixel 4a (Android 13), bit not on a Samsung Galaxy Tab 2016 (Android 8.1)

The crash occurs directly after starting the application on a fresh release build install. It does not occur with a debug build, so maybe there is R8/proguard involved somehow.
It manifests as a segmentation fault: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)

The error seems to occur in libart.so which is maybe related to androidx.sharetarget according to one stacktrace, maybe it was part of the "upstream update" linked in the release notes for 23.1.2 here? https://github.com/firebase/firebase-android-sdk/blob/master/firebase-messaging/CHANGELOG.md

Some of the stacktraces:

Pixel 4a (Android 13), own test

2023-03-08 11:31:59.880 DEBUG A backtrace:
2023-03-08 11:31:59.880 DEBUG A #00 pc 0000000000763170 /apex/com.android.art/lib64/libart.so (art::FaultManager::GetMethodAndReturnPcAndSp(siginfo*, void*, art::ArtMethod**, unsigned long*, unsigned long*, bool*)+132) (BuildId: d307dc6adc4105b5e392ad710770385d)
2023-03-08 11:31:59.880 DEBUG A #1 pc 00000000002889d0 /apex/com.android.art/lib64/libart.so (art::FaultManager::IsInGeneratedCode(siginfo*, void*, bool)+424) (BuildId: d307dc6adc4105b5e392ad710770385d)
2023-03-08 11:31:59.880 DEBUG A #2 pc 000000000028840c /apex/com.android.art/lib64/libart.so (art::FaultManager::HandleFault(int, siginfo*, void*)+92) (BuildId: d307dc6adc4105b5e392ad710770385d)
2023-03-08 11:31:59.880 DEBUG A #3 pc 0000000000002320 /apex/com.android.art/lib64/libsigchain.so (art::SignalChain::Handler(int, siginfo*, void*)+660) (BuildId: d5ff66d01eb05cf124e6fe95ee64abfd)
2023-03-08 11:31:59.880 DEBUG A #4 pc 00000000000007e8 [vdso] (__kernel_rt_sigreturn+0)
2023-03-08 11:31:59.880 DEBUG A #5 pc 0000000000201010 /apex/com.android.art/lib64/libart.so (nterp_op_return+16) (BuildId: d307dc6adc4105b5e392ad710770385d)

Pixel 6/7 (Android 12/13), from google play pre-launch

backtrace:
#00 pc 0x0000000000762e78 /apex/com.android.art/lib64/libart.so (art::FaultManager::GetMethodAndReturnPcAndSp(siginfo*, void*, art::ArtMethod**, unsigned long*, unsigned long*, bool*)+132)
#1 pc 0x00000000002889a4 /apex/com.android.art/lib64/libart.so (art::FaultManager::IsInGeneratedCode(siginfo*, void*, bool)+424)
#2 pc 0x00000000002883e0 /apex/com.android.art/lib64/libart.so (art::FaultManager::HandleFault(int, siginfo*, void*)+92)
#3 pc 0x0000000000002320 /apex/com.android.art/lib64/libsigchain.so (art::SignalChain::Handler(int, siginfo*, void*)+660)
#4 pc 0x0000000000000878 [vdso]
#5 pc 0x0000000000201010 /apex/com.android.art/lib64/libart.so (nterp_op_return+16)

samsung SM-G981U1 (Android 10), from google play pre-launch

backtrace:
#00 pc 0x00000000005a34e0 /apex/com.android.runtime/lib64/libart.so (MterpInvokeInterface+1628)
#1 pc 0x0000000000131a14 /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_interface+20)
#2 pc 0x00000000001fb2a6 /data/app/com.isec7.android.med-2CAsABGnJ6eElrv9rJB3Cg==/oat/arm64/base.vdex (androidx.sharetarget.c.f+46)
#3 pc 0x00000000005a4810 /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+1040)
#4 pc 0x0000000000131994 /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20)
#5 pc 0x00000000001fa21e /data/app/com.isec7.android.med-2CAsABGnJ6eElrv9rJB3Cg==/oat/arm64/base.vdex (androidx.sharetarget.ShortcutInfoCompatSaverImpl$a.run+26)
#6 pc 0x00000000005a3580 /apex/com.android.runtime/lib64/libart.so (MterpInvokeInterface+1788)
#7 pc 0x0000000000131a14 /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_interface+20)
#8 pc 0x00000000001fa776 /data/app/com.isec7.android.med-2CAsABGnJ6eElrv9rJB3Cg==/oat/arm64/base.vdex (androidx.sharetarget.ShortcutInfoCompatSaverImpl$j.run+22)
#9 pc 0x00000000002b4f24 /apex/com.android.runtime/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.996741680656401153)+240)
#10 pc 0x0000000000593008 /apex/com.android.runtime/lib64/libart.so (artQuickToInterpreterBridge+1032)
#11 pc 0x0000000000140468 /apex/com.android.runtime/lib64/libart.so (art_quick_to_interpreter_bridge+88)
#12 pc 0x0000000000215dc4 /system/framework/arm64/boot.oat (java.util.concurrent.Executors$RunnableAdapter.call+68)
#13 pc 0x00000000002b30f8 /system/framework/arm64/boot.oat (java.util.concurrent.FutureTask.run+200)
#14 pc 0x000000000031a9b8 /system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+984)
#15 pc 0x0000000000318010 /system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+64)
#16 pc 0x00000000001b7b38 /system/framework/arm64/boot.oat (java.lang.Thread.run+72)
#17 pc 0x0000000000137334 /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_stub+548)
#18 pc 0x0000000000145fec /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+244)
#19 pc 0x00000000004b1738 /apex/com.android.runtime/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
#20 pc 0x00000000004b284c /apex/com.android.runtime/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+416)
#21 pc 0x00000000004f37b8 /apex/com.android.runtime/lib64/libart.so (art::Thread::CreateCallback(void*)+1176)
#22 pc 0x00000000000e6f10 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+36)
#23 pc 0x00000000000850c8 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[argzdev]

Thanks for reporting, @slowcar. Are you able to reproduce the issue? Any chance you could share with us a minimal reproducible example of this? Thanks!

[google-oss-bot]

Hey @slowcar. We need more information to resolve this issue but there hasn't been an update in 5 weekdays. I'm marking the issue as stale and if there are no new updates in the next 5 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

[slowcar]

Sorry, I am not able to provide a reproducable example as i don't know what exactly causes the error.
I have tracked down the line that causes the crash:
ShortcutManagerCompat.removeAllDynamicShortcuts(myApplicationContext)

If I a) remove this line or b) downgrade firebase-messaging to 23.1.1 the crash no longer occurs.

I have found no connection between the ShortcutManager (androidx.sharetarget 1.2.0) and firebase-messaging and have no clue how and where libart.so is even called. Checking the dependency graph (gradlew app:dependencies) did not offer any clues as well.
I tried to reproduce the issue in a sample app, but without success.

As we can avoid the crash by just not updating the lib we will just close this, maybe the error resolves itself with an update from one of the involved libraries...

[slowcar]

Resolved the issue with additional proguard lines
# Firebase-keep class com.google.android.gms.** { *; }-keep class com.google.firebase.** { *; }