Azure Communication Services Android Calling SDK: native SIGSEGV in libACSCallingShared.so during call setup since 2.14.0

Service

Azure Communication Services Calling SDK for Android (com.azure.android:azure-communication-calling), Teams interop with a Microsoft 365 user (TeamsCallAgent).

Scenario

Our Android app makes 1:1 Teams calls with outgoing video. We need to upgrade from 2.13.1 to 2.14.0 or later to use Teams explicit recording consent (RecordingCallFeature.grantTeamsConsent). Every version from 2.14.0 on crashes natively during call setup, so we cannot upgrade.

Result

The process dies with SIGSEGV while the call is CONNECTING or RINGING, before the remote side answers. All crashing threads are started by libskypert.so and fail inside libACSCallingShared.so. Results on the same device, account and network:

• 2.13.1: 0 crashes in 4 calls
• 2.14.0: 2 crashes in 8 calls
• 3.0.0: 2 crashes in 2 calls
• 2.16.0: 5 crashes in 5 calls (earlier test)

2.14.0:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x000000e00a3686b8

#00 pc 000000000024e320  libskypert.so (rt::intrusive_ptr_add_ref(rt::IReferenceCountable const*)+0)

#01 pc 00000000005f3f68  libACSCallingShared.so

#02 pc 00000000005f4b34  libACSCallingShared.so

#03 pc 000000000050e7c4  libACSCallingShared.so

#04 pc 000000000050c8a4  libACSCallingShared.so

#05 pc 0000000000632b4c  libACSCallingShared.so

#09 pc 00000000002e1170  libskypert.so

3.0.0 (twice, same pc, different fault addresses 0x003fffffffffffe9 and 0x00000005345ad814):

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)

#00 pc 0000000000656ab0  libACSCallingShared.so

#01 pc 0000000000657698  libACSCallingShared.so

#02 pc 000000000056dd2c  libACSCallingShared.so

#03 pc 000000000056be4c  libACSCallingShared.so

#08 pc 00000000003021c0  libskypert.so

Another 2.14.0 crash is a null pointer dereference (fault addr 0x1b0) at libACSCallingShared.so pc 0x5a7bc8. The 2.16.0 crash went through intrusive_ptr_release(). It looks like reference counting on an object that was already freed.

Environment

• Device: RealWear Arc 3, Qualcomm SM6115, arm64-v8a
• Android 16, kernel 5.15, 4 KB memory pages (getconf PAGE_SIZE = 4096)
• One CallClient and one call agent per process
• Outgoing video: VirtualOutgoingVideoStream, raw I420 1280x720 at 15 fps, passed to startVideo when the call starts
• The libc++_shared.so from trouter-client-android is the one packaged in the APK

Steps to reproduce

1. Create a CallClient and a TeamsCallAgent with a Microsoft 365 user.
2. Start a 1:1 Teams call to another Microsoft 365 user with a VirtualOutgoingVideoStream attached.
3. The app crashes while the call is CONNECTING or RINGING. It also crashes when the call starts right after the call agent is created.

Troubleshooting so far

• At the moment of every crash, the outgoing video stream was not yet STARTED, so no raw frame had been sent to the SDK.
• We made the app own a fresh buffer per frame and serialize sendRawVideoFrame, following the raw media quickstart. That does not change when the crash happens.
• The 16 KB page size limitation does not apply: the device uses 4 KB pages, and all native libraries load successfully.
• No service incident or resource change on our ACS resource.
• Related reports we found: Azure/azure-sdk-for-android#1537 (ADO Bug 3732687, now closed) and #2244. That repo is now archived.

Question

Is this a known native crash in Calling SDK 2.14.0 and later, and is there a fix version or a workaround?

We can share full tombstones, redacted logcat and call IDs privately.