Impeller VkPipelineCache corruption causes crash on app restart (Android Snapdragon 845) #172624
Description
Steps to reproduce
- Create an empty project:
flutter create vkcachecrash --platform=android - Replace
lib/main.dartwith the code in the Code sample section. - Run
flutter runorflutter run --release. The crash is more likely to occur on release builds. - Once the
flutter.impeller.vkcachefile is created, kill the process. - Launch the app for a second time. It may crash immediately in
vkCreatePipelineCache, depending on whether theflutter.impeller.vkcachefile from the previous step is corrupted or not. See full logs in the Logs section, both tombstone and adb logcat log.
07-23 15:50:57.311 26920 26920 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
07-23 15:50:57.311 26920 26920 F DEBUG : Build fingerprint: 'OnePlus/OnePlus6/OnePlus6:10/QKQ1.190716.003/2107162030:user/release-keys'
07-23 15:50:57.311 26920 26920 F DEBUG : Revision: '0'
07-23 15:50:57.311 26920 26920 F DEBUG : ABI: 'arm64'
07-23 15:50:57.311 26920 26920 F DEBUG : Timestamp: 2025-07-23 15:50:57+0800
07-23 15:50:57.312 26920 26920 F DEBUG : pid: 26874, tid: 26874, name: elinecachecrash >>> com.example.vkpipelinecachecrash <<<
07-23 15:50:57.312 26920 26920 F DEBUG : uid: 10750
07-23 15:50:57.312 26920 26920 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x6eeb988000
07-23 15:50:57.312 26920 26920 F DEBUG : x0 0000006bc0000ac0 x1 0000006eeb987fda x2 00000000fffda8af x3 0000006bc0026180
07-23 15:50:57.312 26920 26920 F DEBUG : x4 0000006feb9628d9 x5 0000006cc0000abf x6 0000000000000000 x7 0000000000000000
07-23 15:50:57.312 26920 26920 F DEBUG : x8 0000000000000000 x9 0000000000000000 x10 0000000000000000 x11 0000000000000000
07-23 15:50:57.312 26920 26920 F DEBUG : x12 0000000000000000 x13 0000000000000000 x14 0000000000000068 x15 0000000000000000
07-23 15:50:57.312 26920 26920 F DEBUG : x16 0000006eec997cd0 x17 0000006fe140b380 x18 0000006fe50f0000 x19 0000006f44d16940
07-23 15:50:57.312 26920 26920 F DEBUG : x20 0000006eeb9628da x21 0000006f44cb9980 x22 0000006bc0000ac0 x23 0000006f44d1aee4
07-23 15:50:57.312 26920 26920 F DEBUG : x24 000000000000139e x25 00000000ffffffff x26 0000006f44d16950 x27 000000000000000c
07-23 15:50:57.312 26920 26920 F DEBUG : x28 000000000000458c x29 0000007fd1357120
07-23 15:50:57.312 26920 26920 F DEBUG : sp 0000007fd13570b0 lr 0000006eec8c597c pc 0000006fe140b32c
07-23 15:50:57.312 26920 26920 F DEBUG :
07-23 15:50:57.312 26920 26920 F DEBUG : backtrace:
07-23 15:50:57.312 26920 26920 F DEBUG : #00 pc 000000000007f32c /apex/com.android.runtime/lib64/bionic/libc.so (__memcpy+284) (BuildId: a6a4a6a4e20240bbe3173fe560b161af)
07-23 15:50:57.312 26920 26920 F DEBUG : #01 pc 00000000001b6978 /vendor/lib64/hw/vulkan.sdm845.so (BuildId: ae2144fe420424bb96f4072c7260f2d9)
07-23 15:50:57.312 26920 26920 F DEBUG : #02 pc 00000000001b66a8 /vendor/lib64/hw/vulkan.sdm845.so (BuildId: ae2144fe420424bb96f4072c7260f2d9)
07-23 15:50:57.312 26920 26920 F DEBUG : #03 pc 000000000016b2d4 /vendor/lib64/hw/vulkan.sdm845.so (qglinternal::vkCreatePipelineCache(VkDevice_T*, VkPipelineCacheCreateInfo const*, VkAllocationCallbacks const*, VkPipelineCache_T**)+92) (BuildId: ae2144fe420424bb96f4072c7260f2d9)
07-23 15:50:57.312 26920 26920 F DEBUG : #04 pc 00000000007ef684 /data/app/com.example.vkpipelinecachecrash-UUFtRjmIlRZm9Nj00fX5jw==/lib/arm64/libflutter.so!libflutter.so (offset 0x47e000) (BuildId: fa495d4dbcee7946be46b9e436f7800458647c9f)
Additional info
Reproducible on two Snapdragon 845 devices (MI 8 and OnePlus 6), both running Android 10 (API 29). Tested with Flutter 3.32.7.
This is not a consistently reproducible crash. I automated the steps by running a script, and it crashes every 5-50 cycles. Once a crash occurs, all subsequent launches will also crash immediately until clear app data or reinstall.
PACKAGE_NAME="$1"
CYCLE_COUNT=0
while true; do
CYCLE_COUNT=$((CYCLE_COUNT + 1))
echo "cycle $CYCLE_COUNT"
# clear /data/data/$PACKAGE_NAME/code_cache/flutter.impeller.vkcache
adb shell pm clear "$PACKAGE_NAME"
# launch and wait 2 seconds
adb shell monkey -p "$PACKAGE_NAME" -c android.intent.category.LAUNCHER 1 > /dev/null 2>&1
sleep 2
# kill it
adb shell am force-stop "$PACKAGE_NAME"
# relaunch, crash may occur
adb shell monkey -p "$PACKAGE_NAME" -c android.intent.category.LAUNCHER 1 > /dev/null 2>&1
# wait and detect is proccess alive
sleep 2
PID=$(adb shell pidof "$PACKAGE_NAME" 2>/dev/null | tr -d '\r\n')
if [ -n "$PID" ] && [ "$PID" != "" ]; then
echo "no crash, continue"
else
echo "$PACKAGE_NAME crashed"
exit 1
doneMy Investigation
I tried many times to create a minimal reproducible project, and the key element is AnimatedSwitcher with a 1-second duration (running at least 50 frames to trigger the creation of flutter.impeller.vkcache). This seems to cause the Impeller engine or Vulkan driver to save a corrupted flutter.impeller.vkcache file.
When the Vulkan driver tries to create a pipeline cache from that corrupted file, it crashes.
I pulled out some flutter.impeller.vkcache files and analyzed them. It looks like some illegal memory access data got saved. For example, this vkcache file has a strange string /dev/ashmem/memoryheapbase (deleted) near the end of the flutter.impeller.vkcache file.
00039070 20 00 2F 00 64 00 65 00 76 00 2F 00 61 00 73 00 ./.d.e.v./.a.s.
00039080 68 00 6D 00 65 00 6D 00 2F 00 6D 00 65 00 6D 00 h.m.e.m./.m.e.m.
00039090 6F 00 72 00 79 00 68 00 65 00 61 00 70 00 62 00 o.r.y.h.e.a.p.b.
000390A0 61 00 73 00 65 00 20 00 28 00 64 00 65 00 6C 00 a.s.e. .(.d.e.l.
000390B0 65 00 74 00 65 00 64 00 29 00 00 00 00 00 00 00 e.t.e.d.).......
Expected results
No crash happens or at least it could recovers from consist crashes.
Actual results
Crashes immediately at launch after corrupted flutter.impeller.vkcache persisted.
Code sample
Code sample
import 'dart:async';
import 'package:flutter/material.dart';
void main() {
runApp(const App());
}
class App extends StatefulWidget {
const App({super.key});
@override
State<App> createState() => _AppState();
}
class _AppState extends State<App> {
bool _animating = false;
@override
void initState() {
super.initState();
Future.delayed(Duration(milliseconds: 50)).then((v) {
setState(() {
_animating = true;
});
});
}
@override
Widget build(BuildContext context) {
return AnimatedSwitcher(
duration: Duration(seconds: 1),
child: _animating ? Square() : Circle(),
);
}
}
class Square extends StatelessWidget {
const Square({super.key});
@override
Widget build(BuildContext context) {
return Container(
key: const ValueKey('1'),
width: 50,
height: 50,
color: Colors.red,
);
}
}
class Circle extends StatelessWidget {
const Circle({super.key});
@override
Widget build(BuildContext context) {
// ignore: sized_box_for_whitespace
return Container(
key: const ValueKey('2'),
width: 50,
height: 50,
decoration: BoxDecoration(
color: Colors.cyan,
borderRadius: BorderRadius.circular(50),
),
);
}
}Screenshots or Video
Screenshots / Video demonstration
[Upload media here]
Logs
Logs
Flutter Doctor output
Doctor output
[✓] Flutter (Channel stable, 3.32.7, on macOS 15.3.1 24D70 darwin-arm64, locale zh-Hans-CN) [294ms]
• Flutter version 3.32.7 on channel stable at /Users/a250102/fvm/versions/3.32.7
• Upstream repository https://github.com/flutter/flutter.git
• Framework revision d7b523b356 (7 days ago), 2025-07-15 17:03:46 -0700
• Engine revision 39d6d6e699
• Dart version 3.8.1
• DevTools version 2.45.1
• Pub download mirror https://pub.flutter-io.cn
• Flutter download mirror https://storage.flutter-io.cn
[✓] Android toolchain - develop for Android devices (Android SDK version 35.0.0-rc3) [943ms]
• Android SDK at /Users/a250102/Library/Android/sdk
• Platform android-35, build-tools 35.0.0-rc3
• ANDROID_HOME = /Users/a250102/Library/Android/sdk
• ANDROID_SDK_ROOT = /Users/a250102/Library/Android/sdk
• Java binary at: /Library/Java/JavaVirtualMachines/amazon-corretto-17.jdk/Contents/Home/bin/java
This JDK is specified in your Flutter configuration.
To change the current JDK, run: `flutter config --jdk-dir="path/to/jdk"`.
• Java version OpenJDK Runtime Environment Corretto-17.0.13.11.1 (build 17.0.13+11-LTS)
• All Android licenses accepted.
[✓] Xcode - develop for iOS and macOS (Xcode 16.2) [667ms]
• Xcode at /Applications/Xcode.app/Contents/Developer
• Build 16C5032a
• CocoaPods version 1.16.2
[✓] Chrome - develop for the web [7ms]
• Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
[✓] Android Studio (version 2024.3) [7ms]
• Android Studio at /Applications/Android Studio.app/Contents
• Flutter plugin can be installed from:
🔨 https://plugins.jetbrains.com/plugin/9212-flutter
• Dart plugin can be installed from:
🔨 https://plugins.jetbrains.com/plugin/6351-dart
• Java version OpenJDK Runtime Environment (build 21.0.6+-13368085-b895.109)
[✓] VS Code (version 1.102.1) [6ms]
• VS Code at /Applications/Visual Studio Code.app/Contents
• Flutter extension can be installed from:
🔨 https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter
[!] Proxy Configuration [6ms]
• HTTP_PROXY is set
! NO_PROXY is not set
[✓] Connected device (3 available) [5.9s]
• ONEPLUS A6000 (mobile) • 3d818cac • android-arm64 • Android 10 (API 29)
• macOS (desktop) • macos • darwin-arm64 • macOS 15.3.1 24D70 darwin-arm64
• Chrome (web) • chrome • web-javascript • Google Chrome 138.0.7204.159
! Error: Browsing on the local area network for iPhone. Ensure the device is unlocked and attached with a cable or associated with the same local area network as this Mac.
The device must be opted into Developer Mode to connect wirelessly. (code -27)
! Error: Browsing on the local area network for PBC-iPhone16e-C. Ensure the device is unlocked and attached with a cable or associated with the same local area network as this Mac.
The device must be opted into Developer Mode to connect wirelessly. (code -27)
! Error: Browsing on the local area network for ZhongTai ‘s iPad. Ensure the device is unlocked and attached with a cable or associated with the same local area network as this Mac.
The device must be opted into Developer Mode to connect wirelessly. (code -27)
[✓] Network resources [1,080ms]
• All expected network resources are available.
! Doctor found issues in 1 category.