We got a crash log like this:

Crash Log

But there is no function named: com.jwplayer.ui.j.b
And there is no class named: com.jwplayer.ui.n.n
So, I think the proguard obfuscator change the name, and download the mapping file from the bitrise:

image.png

OK, the origin name is: com.jwplayer.ui.d.c
And I can't search a result with -> com.jwplayer.ui.j, so I think com.jwplayer.ui.j is the origin name, but after checked com.jwplayer.ui.j, the crash happens in the line 266, I can't understand the crash report "com.jwplayer.ui.j.b (j.java:5475)"

image.png

But I'm sure the line 266 is the CRASH, "var7.a" is a map, but is public, GREAT:

image.png

If we want to know how a public field used in other classes, we can watch the field by breakpoint(very slow and easy failed), BUT I set the breakpoint in the constructor function, and when some where new a object, we can get the reference and analyse like this:

Breakpoint and Stack

Check the Stack

image.png

Bad news: the reference is referenced by other classes.
Good news: there are only 3 classes.
So analysis one by one:
com.jwplayer.ui.c looks simple BUT with public field:

image.png

a and b is public and the reference of c(var119) is used in other class:

image.png

image.png

SO, the key class is com.jwplayer.api.b, and this.S and this.e is "var118" and "var119"

image.png

image.png

var2 is a tmp variable

Bad news: this.e is default access modifier, and I can't search where use the "this.e", but there must be used somewhere.So I checked the package:

Package Structure

Good news is the package is small.
I checked all the class in the package, and located the PrivateLifecycleObserverPi class:

image.png

YES, both com.jwplayer.ui.d.c and com.jwplayer.ui.j can access the map and call clear(). This.a is "var116", is the key class com.jwplayer.api.b:

image.png

Remember the "this.S" and "this.e", YES, line 54 "var1.e.a" is the MAP.
So, we can locate the problem:
clear() called first and the Runnable in the post runs, then crash happens.