signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'art/compiler/dex/mir_method_info.cc:104] Check failed: invoke_type == kVirtual (invoke_type=direct, kVirtual=virtual) '
r0 00000000 r1 00003439 r2 00000006 r3 b4068978
r4 b4068980 r5 b4068930 r6 00000000 r7 0000010c
r8 b4c7f800 r9 b4c7de44 r10 935a30db r11 b4c63858
ip 00000006 sp b4067f08 lr b6c84edd pc b6c872cc
backtrace:
#00 pc 000422cc /system/lib/libc.so (tgkill+12)
#01 pc 0003fed9 /system/lib/libc.so (pthread_kill+32)
#02 pc 0001c6bf /system/lib/libc.so (raise+10)
#03 pc 00019871 /system/lib/libc.so (__libc_android_abort+34)
#04 pc 000174e0 /system/lib/libc.so (abort+4)
#05 pc 0031f589 /system/lib/libart.so (_ZN3art7Runtime5AbortEv+212)
#06 pc 000f3969 /system/lib/libart.so (_ZN3art10LogMessageD2Ev+2092)
#07 pc 000f0197 /system/lib/libart.so (_ZN3art7BarrierD2Ev+182)
#08 pc 00345ac9 /system/lib/libart.so (_ZN3art10ThreadList4DumpERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEE+144)
#09 pc 0031f645 /system/lib/libart.so (_ZN3art7Runtime5AbortEv+400)
#10 pc 000f3969 /system/lib/libart.so (_ZN3art10LogMessageD2Ev+2092)
#11 pc 001ad551 /system/lib/libart-compiler.so (_ZN3art21MirMethodLoweringInfo7ResolveEPNS_14CompilerDriverEPKNS_18DexCompilationUnitEPS0_j+2080)
#12 pc 0019fe5d /system/lib/libart-compiler.so (_ZN3art8MIRGraph25DoCacheMethodLoweringInfoEv+356)
#13 pc 001b203f /system/lib/libart-compiler.so (_ZN3art16PassDriverMEOpts9ApplyPassEPNS_14PassDataHolderEPKNS_4PassE+18)
#14 pc 00163da7 /system/lib/libart-compiler.so
#15 pc 001645d7 /system/lib/libart-compiler.so (_ZNK3art13QuickCompiler7CompileEPKNS_7DexFile8CodeItemEjNS_10InvokeTypeEtjP8_jobjectRKS1_+1394)
#16 pc 001c0a6d /system/lib/libart-compiler.so (_ZN3art14CompilerDriver13CompileMethodEPNS_6ThreadEPKNS_7DexFile8CodeItemEjNS_10InvokeTypeEtjP8_jobjectRKS3_NS_24DexToDexCompilationLevelEb+1848)
#17 pc 001c0cb3 /system/lib/libart-compiler.so (_ZN3art14CompilerDriver13CompileMethodEPNS_6ThreadEPNS_9ArtMethodE+354)
#18 pc 001caf3f /system/lib/libart-compiler.so (_ZN3art3jit11JitCompiler13CompileMethodEPNS_6ThreadEPNS_9ArtMethodE+330)
#19 pc 0025ed63 /system/lib/libart.so (_ZN3art3jit3Jit13CompileMethodEPNS_9ArtMethodEPNS_6ThreadE+34)
#20 pc 00260ebb /system/lib/libart.so (_ZN3art3jit14JitCompileTask3RunEPNS_6ThreadE+262)
#21 pc 003477e9 /system/lib/libart.so (_ZN3art16ThreadPoolWorker3RunEv+256)
#22 pc 00347e21 /system/lib/libart.so (_ZN3art16ThreadPoolWorker8CallbackEPv+52)
#23 pc 0003f7db /system/lib/libc.so (_ZL15__pthread_startPv+30)
#24 pc 00019ef5 /system/lib/libc.so (__start_thread+6)
崩溃问题发生在FingerPrint为Allwinner/t3_p3/t3-p3:6.0.1/MMB29M/20200623:eng/test-keys的机器上，从上述信息推测Allwinner厂商在2020年还在耕耘Android 6版本，并且和大多数古董Android 6不一样的地方在于Allwinner厂商开启了JIT，开启JIT的方式如下。
adb root
adb shell stop
adb shell setprop dalvik.vm.usejit true
adb shell start
开启JIT后maps会加载libart-compiler.so。
要想找到invoke_type错误的Java函数，可以hook art::jit::JitCodeCache::ContainsMethod(art::ArtMethod*) const函数，并在代理函数中通过PrettyMethod获取invoke_type错误的java函数名称：
using PrettyMethod_t = std::string (*)(void* m, bool with_signature);
PrettyMethod_t PrettyMethod = nullptr;
bool ContainsMethod_proxy(void* thiz, void* method)
{
if (PrettyMethod != nullptr)
{
std::string name = PrettyMethod(method, true);
ANDROID_LOG("ContainsMethod_proxy name:%s", name.c_str());
}
bool ret = false;
PLTHOOK_CALL_ORIG_FUNC_SAFE(ContainsMethod_proxy, ret, thiz, method);
return ret;
}
void* handle = dlopen("/system/lib/libart.so", RTLD_NOW);
if (handle == nullptr)
{
ANDROID_LOG("dlopen libart.so error");
return;
}
PrettyMethod = (PrettyMethod_t)dlsym(handle, "_ZN3art12PrettyMethodEPNS_9ArtMethodEb");
if (PrettyMethod == nullptr)
{
dlclose(handle);
ANDROID_LOG("dlsym PrettyMethod error");
return;
}
dlclose(handle);
task = phl::plthook::hook_single("libart-compiler.so", "_ZNK3art3jit12JitCodeCache14ContainsMethodEPNS_9ArtMethodE", reinterpret_cast<void*>(ContainsMethod_proxy), reporter);
if (task == 0)
{
LOG("libart-compiler.so error");
ANDROID_LOG("libart-compiler.so error");
return;
}
