Skip to content

[Crash] Native SIGABRT double-free in SwipeEngine::setMode on hardened_malloc OS #2188

Description

@pengnuin

Reproduction steps

  1. Enable swipe typing in FUTO Keyboard.
  2. Use the keyboard normally to type and swipe text in any app.
  3. The crash occurs intermittently during normal use when background dictionary/layout updates execute concurrently with the swipe decoder.

(Note: This is an intermittent thread-safety/race condition bug, so exact steps are non-deterministic. This is also the first time I have encountered this crash after using the keyboard for a long time without issue, so it appears to be a rare edge case.)

Actual result

The keyboard crashed abruptly with SIGABRT due to a native memory allocation error (hardened_malloc: fatal allocator error: double free).

Full Stack Trace:

type: crash
package: org.futo.inputmethod.latin.playstore:11717, targetSdk 35
osVersion: google/shiba/shiba:17/CP2A.260705.006/2026071501:user/release-keys
uid: 10195 (u:r:untrusted_app_34:s0:c195,c256,c512,c768)
cmdline: org.futo.inputmethod.latin.playstore
processUptime: 1332s

abortMessage: hardened_malloc: fatal allocator error: double free (quarantine)

signal: 6 (SIGABRT), code -1 (SI_QUEUE)
threadName: ExecutorUtils
MTE: not enabled

backtrace:
    /apex/com.android.runtime/lib64/bionic/libc.so (abort+160, pc 83370)
    /apex/com.android.runtime/lib64/bionic/libc.so (fatal_error+48, pc 65030)
    /apex/com.android.runtime/lib64/bionic/libc.so (deallocate_small(void*, unsigned long const*) (.__uniq.113816362394208727042336347611812082814)+680, pc 623d8)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/lib/arm64/libswipe_jni.so (void std::__ndk1::vector<float, std::__ndk1::allocator<float>>::__assign_with_size[abi:ne180000]<float*, float*>(float*, float*, long)+68, pc 687b8)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/lib/arm64/libswipe_jni.so (swipe_decoder::SwipeEngine::setMode(swipe_decoder::SwipeEngine::Mode const&)+1560, pc 65818)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/lib/arm64/libswipe_jni.so (Java_org_futo_ml_inference_SwipeDecoder_nativeSetMode+1892, pc 609bc)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/oat/arm64/base.odex (art_jni_trampoline+224, pc 1220410)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/oat/arm64/base.odex (org.futo.ml.inference.SwipeDecoder.setMode+272, pc 1221b90)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/oat/arm64/base.odex (org.futo.inputmethod.latin.SwipeDecoderDictionary.applyPendingLayoutInfo+716, pc ee21dc)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/oat/arm64/base.odex (org.futo.inputmethod.latin.DictionaryFacilitatorImpl.updateSwipeLayoutAndDictsIfNeeded+9752, pc e92348)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/oat/arm64/base.odex (com.charleskorn.kaml.YamlParser.onUpdateMainDictionaryAvailability+600, pc bceb58)
    /data/app/~~cZpDCm2LzQ_MWZaQl9zKFw==/org.futo.inputmethod.latin.playstore-mCfDB56P9nsxAAdCbQxBfw==/oat/arm64/base.odex (org.futo.inputmethod.latin.DictionaryFacilitatorImpl$1.run+888, pc e8ac98)
    /system/framework/arm64/boot.oat (java.util.concurrent.Executors$RunnableAdapter.call+60, pc 2127ec)
    /system/framework/arm64/boot.oat (java.util.concurrent.FutureTask.run+172, pc 21162c)
    /system/framework/arm64/boot.oat (java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run+128, pc 21a5e0)
    /system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+840, pc 21cbd8)
    /system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+56, pc 2214c8)
    /system/framework/arm64/boot.oat (java.lang.Thread.run+64, pc a9d10)
    /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612, pc 2a3194)
    /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+148, pc 2a1404)
    /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1392, pc 4de040)
    /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+12, pc 4ddabc)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*) (.__uniq.67847048707805468364044055584648682506)+180, pc 97024)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68, pc 86e34)

Expected result

The keyboard should update dictionaries and layout settings smoothly in the background without crashing or causing native memory corruption (double free) in libswipe_jni.so.

Note: I used AI to help formatting this bug report, but the stack trace is a real output from my phone.

Keyboard Version

0.1.29.1-playstore

Which android version are you using?

Android 17

Which device are you using?

Google Pixel 8

Which operating system are you using?

GrapheneOS

References

No response

Metadata

Metadata

Assignees

Labels

BugSomething isn't workingCrashSwipe TypingIssues/FR related to swipe typing unlike regular typing

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions