type: crash
osVersion: google/shiba/shiba:16/BP4A.251205.006.E1/2025122501:user/release-keys
flags: dev options enabled
package: org.mozilla.firefox:2016132551, targetSdk 36
sharedUid: org.mozilla.firefox.sharedID
process: org.mozilla.firefox
installer: com.android.vending

signal 11 (SIGSEGV), code 9 (SEGV_MTESERR), fault addr 0x0300c6ba067c5660 (read)

backtrace:
      #00 pc 00000000000dd770  /apex/com.android.runtime/lib64/bionic/libc.so (getenv+96) (BuildId: b2e2593ea9af5cb426017f2c32a8fcf5)
      #01 pc 0000000002d22628  /vendor/lib64/egl/libGLES_mali.so (getIntrinsicNameImpl(unsigned int, llvm::ArrayRef<llvm::Type*>, llvm::Module*, llvm::FunctionType*, bool) (.llvm.12684891829665555366)+200) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #02 pc 0000000002d237c0  /vendor/lib64/egl/libGLES_mali.so (llvm::Intrinsic::getDeclaration(llvm::Module*, unsigned int, llvm::ArrayRef<llvm::Type*>)+80) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #03 pc 0000000002445034  /vendor/lib64/egl/libGLES_mali.so (llvm::Mali::TexIntrinsic::createTex(llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>*, llvm::Module*, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::Type*, llvm::Mali::TexArg::TextureArgument1, llvm::Mali::TexArg::TextureArgument2, llvm::Mali::TexArg::TextureArgument3, llvm::Mali::TexArg::TextureArgument4, llvm::Mali::TexArg::TextureArgument5, llvm::Mali::TexArg::TextureArgument6, llvm::Mali::TexArg::TextureArgument7, bool, int, int, bool, bool)+516) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #04 pc 0000000001c74f98  /vendor/lib64/egl/libGLES_mali.so (LIR2LLVMConverter::convert_tex(cmpbe_node const*)+7304) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #05 pc 0000000001c6e114  /vendor/lib64/egl/libGLES_mali.so (LIR2LLVMConverter::TraverseBBs(_tag_mempool*, cmpbe_bb*, bool)+436) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #06 pc 0000000001c6f3f4  /vendor/lib64/egl/libGLES_mali.so (lir2llvm(cmpbep_pass_manager_context*) (.llvm.3089111341236942289)+3732) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #07 pc 0000000001d69fa8  /vendor/lib64/egl/libGLES_mali.so (cmpbep_run_pass+392) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #08 pc 0000000001c6a5b8  /vendor/lib64/egl/libGLES_mali.so (cmpbe_compile_gles_shader+568) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #09 pc 0000000001c8b890  /vendor/lib64/egl/libGLES_mali.so (do_single_part2_compilation+208) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #10 pc 0000000001c8b158  /vendor/lib64/egl/libGLES_mali.so (cmpbe_v2_compile_multiple_shaders+9016) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #11 pc 0000000001c88e04  /vendor/lib64/egl/libGLES_mali.so (cmpbe_v2_compile_single_shader+68) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #12 pc 0000000001ac0c04  /vendor/lib64/egl/libGLES_mali.so (gfx::compiler::compile_internal_shader(char const*, unsigned long, hal::shader_kind, unsigned int, gfx::mem_allocator&, gfx::shader&, cutils_cmpbe_dump_ctx**)+260) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #13 pc 0000000001ac3fb0  /vendor/lib64/egl/libGLES_mali.so (gfx::internal_program_cache::load_glsl_string(unsigned long, char const*, hal::shader_kind, hal::program_descriptor const*&, cutils_cmpbe_dump_ctx**)+288) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #14 pc 0000000001b1b200  /vendor/lib64/egl/libGLES_mali.so (hal::halp::program_cache::find_or_generate_shader(hal::halp::program_cache_shader_type, hal::halp::program_cache_rt*, gpu_sample_pattern)+1584) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #15 pc 0000000001b1b9f0  /vendor/lib64/egl/libGLES_mali.so (hal::halp::program_cache::get_stencil_readback_shader(gpu_sample_pattern, bool, bool)+112) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #16 pc 0000000001b152c4  /vendor/lib64/egl/libGLES_mali.so (hal::halp::readback_template::init(hal::halp::device_internal&, hal::subpass_template_init_info const&, gpu_sample_pattern, unsigned int, hal::aspect_flags, bool)+2100) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #17 pc 0000000001b104e0  /vendor/lib64/egl/libGLES_mali.so (hal::halp::begin_subpass_template_base::init(hal::subpass_template_init_info const&, hal::halp::device_internal&, hal::mem_allocator&, bool)+3136) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #18 pc 0000000001b23700  /vendor/lib64/egl/libGLES_mali.so (hal::halp::begin_subpass_template_internal::init(hal::subpass_template_init_info const&, hal::halp::device_internal&, hal::mem_allocator&, bool)+32) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #19 pc 0000000001ae9f38  /vendor/lib64/egl/libGLES_mali.so (gfx::subpass::bake(bool)+1256) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #20 pc 000000000097b69c  /vendor/lib64/egl/libGLES_mali.so (vulkan::renderpass::init(vulkan::device*, VkRenderPassCreateInfo2 const&, gfx::host_mem_allocator const&, gfx::host_mem_allocator&)+13324) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #21 pc 00000000009781b8  /vendor/lib64/egl/libGLES_mali.so (vkCreateRenderPass+4600) (BuildId: 795ee26fb5a01fae4ea6c11abac14f9769df61fd)
      #22 pc 0000000000479b44  /system/lib64/libhwui.so (GrVkRenderPass::Create(GrVkGpu*, GrVkRenderPass::AttachmentFlags, GrVkRenderPass::AttachmentsDescriptor*, GrVkRenderPass::LoadStoreOps const&, GrVkRenderPass::LoadStoreOps const&, GrVkRenderPass::LoadStoreOps const&, GrVkRenderPass::SelfDependencyFlags, GrVkRenderPass::LoadFromResolve)+740) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #23 pc 00000000004794d8  /system/lib64/libhwui.so (GrVkResourceProvider::findCompatibleRenderPass(GrVkRenderPass::AttachmentsDescriptor*, GrVkRenderPass::AttachmentFlags, GrVkRenderPass::SelfDependencyFlags, GrVkRenderPass::LoadFromResolve, GrResourceHandle<GrVkResourceProvider::CompatibleRPHandleKind>*)+200) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #24 pc 0000000000477c34  /system/lib64/libhwui.so (GrVkGpu::onGetOpsRenderPass(GrRenderTarget*, bool, GrAttachment*, GrSurfaceOrigin, SkIRect const&, GrOpsRenderPass::LoadAndStoreInfo const&, GrOpsRenderPass::StencilLoadAndStoreInfo const&, skia_private::TArray<GrSurfaceProxy*, true> const&, GrXferBarrierFlags)+468) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #25 pc 00000000005272c8  /system/lib64/libhwui.so (skgpu::ganesh::OpsTask::onExecute(GrOpFlushState*)+456) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #26 pc 0000000000526f4c  /system/lib64/libhwui.so (skgpu::ganesh::AtlasRenderTask::onExecute(GrOpFlushState*)+44) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #27 pc 00000000002d6000  /system/lib64/libhwui.so (GrDrawingManager::flush(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*)+4304) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #28 pc 000000000072153c  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaGpuPipeline::renderLayersImpl(android::uirenderer::LayerUpdateQueue const&, bool)+364) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #29 pc 00000000002a73bc  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaPipeline::renderFrame(android::uirenderer::LayerUpdateQueue const&, SkRect const&, std::__1::vector<android::sp<android::uirenderer::RenderNode>, std::__1::allocator<android::sp<android::uirenderer::RenderNode>>> const&, bool, android::uirenderer::Rect const&, sk_sp<SkSurface>, SkMatrix const&)+220) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #30 pc 00000000005efa30  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaVulkanPipeline::draw(android::uirenderer::renderthread::Frame const&, SkRect const&, SkRect const&, android::uirenderer::LightGeometry const&, android::uirenderer::LayerUpdateQueue*, android::uirenderer::Rect const&, bool, android::uirenderer::LightInfo const&, std::__1::vector<android::sp<android::uirenderer::RenderNode>, std::__1::allocator<android::sp<android::uirenderer::RenderNode>>> const&, android::uirenderer::FrameInfoVisualizer*, android::uirenderer::renderthread::HardwareBufferRenderParams const&, std::__1::mutex&)+336) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #31 pc 00000000002b0160  /system/lib64/libhwui.so (android::uirenderer::renderthread::CanvasContext::draw(bool)+832) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #32 pc 000000000058215c  /system/lib64/libhwui.so (std::__1::__function::__func<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0, std::__1::allocator<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0>, void ()>::operator()() (.__uniq.264041412789356548918088680803242235290.c303f2d2360db58ed70a2d0ac7ed911b)+972) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #33 pc 0000000000577c48  /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::threadLoop()+808) (BuildId: 07e30792d42d22a0c2bf036725188b16)
      #34 pc 0000000000018250  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+208) (BuildId: d190dad3e30afcd1d9179d6819d8d20c)
      #35 pc 000000000001a5b8  /system/lib64/libutils.so (libutil_thread_trampoline(void*) (.__uniq.226528677032898775202282855395389835431)+24) (BuildId: d190dad3e30afcd1d9179d6819d8d20c)
      #36 pc 0000000000091584  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*) (.__uniq.67847048707805468364044055584648682506)+180) (BuildId: b2e2593ea9af5cb426017f2c32a8fcf5)
      #37 pc 00000000000813d4  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: b2e2593ea9af5cb426017f2c32a8fcf5)
Learn more about MTE reports: https://source.android.com/docs/security/test/memory-safety/mte-reports