Unity craches inconsistently on Android during rendering in GfxDeviceGLES::DrawBufferRanges function

I have an app which uses AR Core + imported FBX model from my asset bundle.

When I use the app and manipulate the model on my Android devices I often have a crash with the following tombstone:

2020-05-28 22:51:24.896 19364-19418/? E/CRASH: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0000000000000000
2020-05-28 22:51:24.896 19364-19418/? E/CRASH: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2020-05-28 22:51:24.896 19364-19418/? E/CRASH: Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a'
2020-05-28 22:51:24.896 19364-19418/? E/CRASH: Build fingerprint: 'google/marlin/marlin:10/QP1A.191005.007.A3/5972272:user/release-keys'
2020-05-28 22:51:24.896 19364-19418/? E/CRASH: Revision: '0'
2020-05-28 22:51:24.897 19364-19418/? E/CRASH: pid: 19364, tid: 19418, name: Thread-3  >>> au.com.arvix <<<
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x0   0000000000000001  x1   0000000000000000  x2   0000000000000000  x3   0000000000000000
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x4   0000000503503000  x5   000000000000a000  x6   0000000023800813  x7   0000000503500000
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x8   00000071240aeea0  x9   0000000000000002  x10  00000071241491a8  x11  0000000000000000
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x12  0000000000000002  x13  0000000500000004  x14  0000000023800013  x15  00000000ffffff93
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x16  0000000000000000  x17  0000000000000010  x18  00000000000000a0  x19  00000071c00f9248
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x20  0000000000020005  x21  00000070a5c1a280  x22  0000000503500000  x23  0000000000000001
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x24  00000070ce236e80  x25  0000000000000000  x26  000000002380a813  x27  0000000003500000
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     x28  000000002003c000  x29  00000070b5f042c0  x30  00000000021c0780
2020-05-28 22:51:24.897 19364-19418/? E/CRASH:     sp   00000070b5f041b0  pc   00000071243d991c  pstate 0000000060000000
2020-05-28 22:51:24.897 19364-19418/? E/CRASH: backtrace:
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #00  pc 000000000000086c  [vdso] ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #01  pc 00000000002a1918  /vendor/lib64/egl/libGLESv2_adreno.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #02  pc 0000000000283268  /vendor/lib64/egl/libGLESv2_adreno.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #03  pc 0000000000274834  /vendor/lib64/egl/libGLESv2_adreno.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #04  pc 0000000000040db8  /vendor/lib64/egl/libGLESv2_adreno.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #05  pc 000000000003a2b0  /vendor/lib64/egl/libGLESv2_adreno.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #06  pc 00000000007590bc  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #07  pc 000000000085fea0  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #08  pc 000000000075e554  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #09  pc 0000000000879228  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #10  pc 000000000044548c  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.054 19364-19418/? E/CRASH:  #11  pc 0000000000447130  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.055 19364-19418/? E/CRASH:  #12  pc 000000000043fbc4  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.055 19364-19418/? E/CRASH:  #13  pc 000000000060e028  /data/app/au.com.arvix-PGUeRtIHSBEh2Ycmu3nNIg==/lib/arm64/libunity.so ()
2020-05-28 22:51:25.055 19364-19418/? E/CRASH:  #14  pc 00000000000a372c  /apex/com.android.runtime/lib64/bionic/libc.so ()
2020-05-28 22:51:25.055 19364-19418/? E/CRASH:  #15  pc 0000000000044004  /apex/com.android.runtime/lib64/bionic/libc.so ()

Where unity code decodes to:

#06  pc 00000000007590bc  /libunity.so GfxDeviceGLES::DrawBufferRanges(GfxBuffer*, unsigned int, GfxBuffer* const*, unsigned int const*, int, DrawBuffersRange const*, int, VertexDeclaration*, unsigned long, bool)
#07  pc 000000000085fea0  /libunity.so SinglePassStereoSupportExt::DrawBuffersStereo(GfxBuffer*, unsigned int, GfxBuffer* const*, unsigned int const*, int, DrawBuffersRange const*, int, VertexDeclaration*, unsigned long)
#08  pc 000000000075e554  /libunity.so GfxDeviceGLES::DrawBuffers(GfxBuffer*, unsigned int, GfxBuffer* const*, unsigned int const*, int, DrawBuffersRange const*, int, VertexDeclaration*)
#09  pc 0000000000879228  /libunity.so DynamicVBO::DrawChunk(VertexDeclaration*)
#10  pc 000000000044548c  /libunity.so GfxDeviceWorker::RunCommand(ThreadedStreamBuffer&)
#11  pc 0000000000447130  /libunity.so GfxDeviceWorker::RunExt(ThreadedStreamBuffer&)
#12  pc 000000000043fbc4  /libunity.so GfxDeviceWorker::RunGfxDeviceWorker(void*)
#13  pc 000000000060e028  /libunity.so Thread::RunThreadWrapper(void*)

The issue is flaky and not reproduced on every run. However it was noticed at least on two different devices.

Reproduced on the following Unity versions:

  • 2019.2.9f1
  • 2019.3.11f1

I am wondering if anybody experienced anything similar. Have anybody faced similar issue?

Apparently It was a faulty AR Core version.
I used 1.12, and I was unable to reproduce the issue after upgrading to 1.18 AR Core and 2019.4.x Unity.