crash at /system/lib/libssl.so (SSL_CTX_set_alpn_protos+16) in 2.2.0

[ankurbn]

I thought this issue was fixed in 1.5.4, but I am still seeing this crash in 2.2.0. I tried using the work around specified at #647, but still seeing the crash. I can easily reproduce this issue on Moto G.

F/libc (31835): invalid address or address of corrupt block 0x5f95fbc0 passed to dlfree
F/libc (31835): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1), thread 680 (pool-7-thread-1)
I/DEBUG ( 1601): *** *** *** *** *** *** *** *** *** *** *** *** *** *** ** ***
I/DEBUG ( 1601): Build fingerprint: 'motorola/falcon_retuglb/falcon_umts:4.4.4/KXB21.14-L1.61/62:user/release-keys'
I/DEBUG ( 1601): Revision: 'p3c0'
I/DEBUG ( 1601): pid: 31835, tid: 680, name: pool-7-thread-1 >>> com.coinbase.android.debug <<<
I/DEBUG ( 1601): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad
I/DEBUG ( 1601): Abort message: 'invalid address or address of corrupt block 0x5f95fbc0 passed to dlfree'
I/DEBUG ( 1601): r0 00000000 r1 401300ba r2 deadbaad r3 40133ce3
I/DEBUG ( 1601): r4 5f95fbc0 r5 4013e190 r6 400de000 r7 5f95fbc8
I/DEBUG ( 1601): r8 6674e7dc r9 60b34860 sl 617d9540 fp 6674e7f4
I/DEBUG ( 1601): ip 00000001 sp 6674e780 lr 4010189b pc 4010189c cpsr 600e0030
I/DEBUG ( 1601): d0 2064696c61766e69 d1 2073736572646461
I/DEBUG ( 1601): d2 657264646120726f d3 6f6320666f207373
I/DEBUG ( 1601): d4 0000000000000000 d5 000000000000000b
I/DEBUG ( 1601): d6 0000000300000010 d7 0000040000000000
I/DEBUG ( 1601): d8 0000000000000000 d9 0000000000000000
I/DEBUG ( 1601): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 1601): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 1601): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 1601): d16 0000000000000000 d17 0000000000000000
I/DEBUG ( 1601): d18 0000000000000000 d19 0000000000000000
I/DEBUG ( 1601): d20 0063006600330066 d21 0035003900330038
I/DEBUG ( 1601): d22 0035003800640063 d23 0062006600660034
I/DEBUG ( 1601): d24 0018001700150016 d25 0019001a001a0019
I/DEBUG ( 1601): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 1601): d28 bfb61d660e0afc9a d29 3fefe16040000000
I/DEBUG ( 1601): d30 001a001a001a001a d31 0000000000000000
I/DEBUG ( 1601): scr 68000013
I/DEBUG ( 1601):
I/DEBUG ( 1601): backtrace:
I/DEBUG ( 1601): #00 pc 0001189c /system/lib/libc.so (dlfree+1191)
I/DEBUG ( 1601): #1 pc 0000dd33 /system/lib/libc.so (free+10)
I/DEBUG ( 1601): #2 pc 000c5585 /system/lib/libcrypto.so (CRYPTO_free+24)
I/DEBUG ( 1601): #3 pc 00027205 /system/lib/libssl.so (SSL_CTX_set_alpn_protos+16)
I/DEBUG ( 1601): #4 pc 00008bef /system/lib/libjavacrypto.so
I/DEBUG ( 1601): #5 pc 000203cc /system/lib/libdvm.so (dvmPlatformInvoke+112)
I/DEBUG ( 1601): #6 pc 00050eeb /system/lib/libdvm.so (dvmCallJNIMethod(unsigned int const_, JValue_, Method const_, Thread_)+398)
I/DEBUG ( 1601): #7 pc 00029860 /system/lib/libdvm.so
I/DEBUG ( 1601): #8 pc 00030b68 /system/lib/libdvm.so (dvmMterpStd(Thread_)+76)
I/DEBUG ( 1601): #9 pc 0002e200 /system/lib/libdvm.so (dvmInterpret(Thread_, Method const_, JValue_)+184)
I/DEBUG ( 1601): #10 pc 000637cd /system/lib/libdvm.so (dvmInvokeMethod(Object_, Method const_, ArrayObject_, ArrayObject_, ClassObject_, bool)+392)
I/DEBUG ( 1601): #11 pc 0006b6ab /system/lib/libdvm.so
I/DEBUG ( 1601): #12 pc 00029860 /system/lib/libdvm.so
I/DEBUG ( 1601): #13 pc 00030b68 /system/lib/libdvm.so (dvmMterpStd(Thread_)+76)
I/DEBUG ( 1601): #14 pc 0002e200 /system/lib/libdvm.so (dvmInterpret(Thread_, Method const_, JValue_)+184)
I/DEBUG ( 1601): #15 pc 000634e9 /system/lib/libdvm.so (dvmCallMethodV(Thread_, Method const_, Object_, bool, JValue_, std::va_list)+336)
I/DEBUG ( 1601): #16 pc 0006350d /system/lib/libdvm.so (dvmCallMethod(Thread, Method const, Object_, JValue_, ...)+20)
I/DEBUG ( 1601): #17 pc 0007112f /system/lib/libdvm.so
I/DEBUG ( 1601): #18 pc 00029860 /system/lib/libdvm.so
I/DEBUG ( 1601): #19 pc 00030b68 /system/lib/libdvm.so (dvmMterpStd(Thread_)+76)
I/DEBUG ( 1601): #20 pc 0002e200 /system/lib/libdvm.so (dvmInterpret(Thread_, Method const_, JValue_)+184)
I/DEBUG ( 1601): #21 pc 000634e9 /system/lib/libdvm.so (dvmCallMethodV(Thread_, Method const_, Object_, bool, JValue_, std::va_list)+336)
I/DEBUG ( 1601): #22 pc 0006350d /system/lib/libdvm.so (dvmCallMethod(Thread, Method const, Object_, JValue, ...)+20)
I/DEBUG ( 1601): #23 pc 000581db /system/lib/libdvm.so
I/DEBUG ( 1601): #24 pc 0000d298 /system/lib/libc.so (__thread_entry+72)
I/DEBUG ( 1601): #25 pc 0000d430 /system/lib/libc.so (pthread_create+240)
I/DEBUG ( 1601):
I/DEBUG ( 1601): stack:
I/DEBUG ( 1601): 6674e740 5f8f6059 /system/lib/libjavacrypto.so
I/DEBUG ( 1601): 6674e744 00000000
I/DEBUG ( 1601): 6674e748 5f8f6059 /system/lib/libjavacrypto.so
I/DEBUG ( 1601): 6674e74c 79527dce
I/DEBUG ( 1601): 6674e750 5f95fbc0
I/DEBUG ( 1601): 6674e754 4013e190
I/DEBUG ( 1601): 6674e758 400de000
I/DEBUG ( 1601): 6674e75c 40102c11 /system/lib/libc.so
I/DEBUG ( 1601): 6674e760 401300ba /system/lib/libc.so
I/DEBUG ( 1601): 6674e764 6674e774 [stack:680]
I/DEBUG ( 1601): 6674e768 40133ce3 /system/lib/libc.so
I/DEBUG ( 1601): 6674e76c 4010189b /system/lib/libc.so (dlfree+1190)
I/DEBUG ( 1601): 6674e770 401300ba /system/lib/libc.so
I/DEBUG ( 1601): 6674e774 5f95fbc0
I/DEBUG ( 1601): 6674e778 40133ce3 /system/lib/libc.so
I/DEBUG ( 1601): 6674e77c 00000000
I/DEBUG ( 1601): #00 6674e780 4013a000 /system/lib/libc.so
I/DEBUG ( 1601): 6674e784 5f95fbc8
I/DEBUG ( 1601): 6674e788 5f9d1008
I/DEBUG ( 1601): 6674e78c 4235e7f8 /dev/ashmem/dalvik-heap (deleted)
I/DEBUG ( 1601): 6674e790 60b3486c
I/DEBUG ( 1601): 6674e794 400fdd35 /system/lib/libc.so (free+12)
I/DEBUG ( 1601): #1 6674e798 40b90de4
I/DEBUG ( 1601): 6674e79c 40b21587 /system/lib/libcrypto.so (CRYPTO_free+26)
I/DEBUG ( 1601): #2 6674e7a0 00000018
I/DEBUG ( 1601): 6674e7a4 40bba209 /system/lib/libssl.so (SSL_CTX_set_alpn_protos+20)

[swankjesse]

Yikes. Will fix with this:
#1305

[ankurbn]

FYI seeing this on Xiaomi Mi4 and Moto X too.