Develop Reference

Unity game weird crash on Samsung S22 Android 12: libGLESv2 call vulkan while using opengles2/3

I built a game with Unity 2020.3.37f1c1, but I've been getting some weird crashes recently.
libunity called 'EGL_ClientWaitSyncKHR' of 'libGLESv2_samsung. so', and finally crashed in /vendor/lib64/hw/vulkan.samsung.so.
Currently only appears on Samsung S22(Android 12)
The following is the wrong stack information and attachment:
Exception java.lang.Error: FATAL EXCEPTION [main]
Unity version : 2020.3.37f1c1
Device model : samsung SM-S901B
Device fingerprint: samsung/r0sxeea/r0s:12/SP1A.210812.016/S901BXXU2AVG6:user/release-keys
Build Type : Release
Scripting Backend : IL2CPP
ABI : arm64-v8a
Strip Engine Code : true
Caused by: java.lang.Error: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Version '2020.3.37f1c1 (9f30be21c416)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a'
Build fingerprint: 'samsung/r0sxeea/r0s:12/SP1A.210812.016/S901BXXU2AVG6:user/release-keys'
Revision: '28'
ABI: 'arm64'
Timestamp: 2022-08-11 16:26:01+0100
pid: 31315, tid: 31510, name: UnityMain >>> com.joy.dreams <<<
uid: 10353
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x18
Cause: null pointer dereference
x0 b40000730ca851a8 x1 0000000000000001 x2 b4000073c685e958 x3 0000000000000001
x4 0000000002faf080 x5 0000007389af81f4 x6 000000739307cd74 x7 7f7f7f7f7f7f7f7f
x8 00000072e05e5930 x9 0000000000000000 x10 000000000000148e x11 00000076d3767038
x12 00000076d3767030 x13 000000007fffffff x14 0000000000236ca0 x15 000000ff43beb615
x16 000996cc2fb00000 x17 0000000027100000 x18 0000007223726000 x19 0000000002faf080
x20 0000000000000001 x21 b4000073c685e960 x22 b40000730ca851a8 x23 00000072e05e5930
x24 b4000075d6845030 x25 00000072e05e6000 x26 0000000000000001 x27 00000000000fc000
x28 00000072e04ed000 x29 00000072e05e5950
sp 00000072e05e5930 lr 0000007393046400 pc 0000007389af5678
backtrace:
#00 pc 00000000013fc678 /vendor/lib64/hw/vulkan.samsung.so (BuildId: 3c3f650bfd63758b76be354f30896f41c5962e82)
#01 pc 00000000003f73fc /vendor/lib64/egl/libGLESv2_samsung.so (BuildId: a637a476c6448ffa)
#02 pc 00000000004229c8 /vendor/lib64/egl/libGLESv2_samsung.so (BuildId: a637a476c6448ffa)
#03 pc 000000000042d0d4 /vendor/lib64/egl/libGLESv2_samsung.so (BuildId: a637a476c6448ffa)
#04 pc 000000000042ddb8 /vendor/lib64/egl/libGLESv2_samsung.so (BuildId: a637a476c6448ffa)
#05 pc 00000000002322f4 /vendor/lib64/egl/libGLESv2_samsung.so (BuildId: a637a476c6448ffa)
#06 pc 000000000023a5fc /vendor/lib64/egl/libGLESv2_samsung.so (EGL_ClientWaitSyncKHR+128) (BuildId: a637a476c6448ffa)
#07 pc 0000000000e21048 /data/app/~~udK_hURMFPtEwbPmzROagg==/com.joy.dreams-_3gKnvwVkixqDYaLkfgxvA==/lib/arm64/libunity.so (BuildId: ccc8535e5325b0e400c5bed07b4f9a9b0b53bd60)
#08 pc 0000000000e209f0 /data/app/~~udK_hURMFPtEwbPmzROagg==/com.joy.dreams-_3gKnvwVkixqDYaLkfgxvA==/lib/arm64/libunity.so (BuildId: ccc8535e5325b0e400c5bed07b4f9a9b0b53bd60)
#09 pc 00000000000b3020 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+264) (BuildId: 1001969d8caf747bff324cbb95af4b2e)
#10 pc 000000000005288c /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 1001969d8caf747bff324cbb95af4b2e)
at vulkan
at libGLESv2_samsung
at libGLESv2_samsung
at libGLESv2_samsung
at libGLESv2_samsung
at libGLESv2_samsung
at libGLESv2_samsung.EGL_ClientWaitSyncKHR (EGL_ClientWaitSyncKHR:128)
at libunity
at libunity
at libc.__pthread_start(void*) (__pthread_start:264)
at libc.__start_thread (__start_thread:64)

In player setting -other setting, Graphic API is vulkan there? Check the Target API level/Minimum API level as well.

Unity 2019.3 : "Crash On Android Phone"

I have built AAB (for ARM & ARM-64) then test it to my Android Smartphone, but I found it crash.
By Inspecting the log I found below error (using HTC U11, API Level 26):
Build fingerprint: 'htc/ocndugl_00401/htc_ocndugl:8.0.0/OPR6.170623.013/1002308.10:user/release-keys'
Revision: '0'
ABI: 'arm64'
pid: 31372, tid: 31556, name: Loading.Preload >>> com.apps.mygame <<<
signal 5 (SIGTRAP), code -6 (SI_TKILL), fault addr --------
x0 0000000000000000 x1 0000000000007b44 x2 0000000000000005 x3 0000007dad1fe1d1
x4 000000004e524157 x5 000000004e524157 x6 000000004e524157 x7 00000000004e5241
x8 0000000000000083 x9 346b4f359488495f x10 346b4f359488495f x11 0000000000000000
x12 0000000000000000 x13 0000000000000000 x14 0000000000000000 x15 0000007e351c8000
x16 0000007e3341f2e8 x17 0000007e333c0e04 x18 0000000000000000 x19 0000007dad1fead8
x20 0000000000000000 x21 0000007e14bfc840 x22 0000007e1428c11c x23 0000007dad1ff588
x24 0000007e14c36000 x25 0000000000800101 x26 000000000014d618 x27 0000007e110ef700
x28 0000007e110ef010 x29 0000000000000008 x30 0000007e1428be84
sp 0000007dad1fea60 pc 0000007e333c0e0c pstate 0000000000000000
backtrace:
#00 pc 000000000006ae0c /system/lib64/libc.so (tgkill+8)
#01 pc 000000000064ae80 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#02 pc 000000000064b390 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#03 pc 000000000027fa58 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#04 pc 000000000027fdf4 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#05 pc 00000000003035d0 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#06 pc 000000000030701c /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#07 pc 00000000002fff90 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#08 pc 0000000000329b80 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#09 pc 0000000000334628 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#10 pc 000000000032bf00 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#11 pc 000000000032c4e0 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#12 pc 0000000000276b40 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#13 pc 0000000000278488 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#14 pc 00000000002782d4 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#15 pc 0000000000278240 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#16 pc 00000000002cd5b8 /data/app/com.apps.mygame-dztW0fQOeFKAoF2N3WRWqw==/lib/arm64/libunity.so
#17 pc 00000000000677a4 /system/lib64/libc.so (_ZL15__pthread_startPv+36)
#18 pc 000000000001f2a4 /system/lib64/libc.so (__start_thread+68)
I read on Unity Forum it caused by Graphic Issue so need to disable OpenGL es 3. I have tested it but still failed.
Note, I'm using below plugin (All are latest) :
Unity IAP
Google Admob
Firebase
Also, I'm using Unity 2019.3.12f1 (almost latest)
Any Idea?

SIGSEGV when using native library on android, hardware accelerated only

I'm using the Superpowered SDK to do some audio playback and recording. When I press a button to start playback the app crashes with
A/DEBUG: ABI: 'arm64'
A/DEBUG: pid: 18529, tid: 18548, name: RenderThread >>> com.superpowered.example <<<
A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x10
A/DEBUG: x0 0000007f789f8000 x1 0000007f7409f288 x2 0000007f7d6a8a88 x3 0000000000fe502b
A/DEBUG: x4 0000000000116906 x5 0000000000000000 x6 00000a4cc0b1813f x7 0000007f789f8000
A/DEBUG: x8 000000000055655a x9 000000000055655a x10 000000000000a8c0 x11 00000000213b09a0
A/DEBUG: x12 0000000000000018 x13 ffffffffa82de1ea x14 000bb95f86000000 x15 003b9aca00000000
A/DEBUG: x16 0000007f7dadc7d8 x17 0000007f7d6a8a54 x18 0000007f78892ee8 x19 0000007f78891000
A/DEBUG: x20 0000007f7409f288 x21 0000007f78892ee8 x22 0000007f7bf4e000 x23 0000007f7bf4e000
A/DEBUG: x24 0000007f7409f288 x25 7fffffffffffffff x26 00000000ffffffff x27 0000007f7a52a9b0
A/DEBUG: x28 0000007f635331e0 x29 0000007f7409f190 x30 0000007f7bec3840
A/DEBUG: sp 0000007f7409f190 pc 0000007f7bec3850 pstate 0000000080000000
A/DEBUG: backtrace:
A/DEBUG: #00 pc 0000000000025850 /system/lib64/libhwui.so
A/DEBUG: #01 pc 0000000000026e5c /system/lib64/libhwui.so
A/DEBUG: #02 pc 0000000000026fd8 /system/lib64/libhwui.so
A/DEBUG: #03 pc 000000000002b43c /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::threadLoop()+124)
A/DEBUG: #04 pc 000000000001579c /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+208)
A/DEBUG: #05 pc 00000000000903cc /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+96)
A/DEBUG: #06 pc 0000000000014fec /system/lib64/libutils.so
A/DEBUG: #07 pc 0000000000065fb4 /system/lib64/libc.so (__pthread_start(void*)+52)
A/DEBUG: #08 pc 000000000001ed84 /system/lib64/libc.so (__start_thread+16)
I already opened an issue on their github repo, but they won't investigate any further bacause it's obviously an error in my "custom UI code".
So after hours of debugging here is what I found:
It seems like triggering playback in the native library somehow interferes with the android internals.
Adding random delays to the button actions reduces the likelihood of a crash.
A temporary workaround was to disable hardware acceleration (android:hardwareAccelerated="false").
If you want to try it yourself you can find the code here.
Has anyone had a similiar problem? Is there any workaround that doesn't involve disabling HW acceleration? Any help is greatly appreciated!

Encountered EGL error 12291 EGL_BAD_ALLOC during rendering

I have a Live Wallpaper app that handle images.
I'm getting some crashes report in the Play Store (but not in fabric.io) with this stack trace:
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'samsung/hero2ltexx/hero2lte:6.0.1/MMB29K/G935FXXU1APDN:user/release-keys'
Revision: '9'
ABI: 'arm64'
pid: 15250, tid: 15331, name: RenderThread >>> com.xxxx.xxxxx <<<
signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'Encountered EGL error 12291 EGL_BAD_ALLOC during rendering'
x0 0000000000000000 x1 0000000000003be3 x2 0000000000000006 x3 0000000000000000
x4 0000000000000000 x5 0000000000000001 x6 0000000000000000 x7 0000000000000000
x8 0000000000000083 x9 fefeff7e6032ce0b x10 7f7f7f7f7f7fff7f x11 0101010101010101
x12 0000000000000010 x13 0000007f6f425bdc x14 0000000000000001 x15 000000000000000f
x16 0000007f9422f568 x17 0000007f941c23b8 x18 0000007f945cf720 x19 0000007f6f426500
x20 0000007f6f426440 x21 0000000000000019 x22 0000000000000006 x23 0000007f6132f6c0
x24 0000007f6132e800 x25 0000007f614fd7b0 x26 0000000000000002 x27 0000007f70602bb0
x28 0000007f6eb58c10 x29 0000007f6f425b80 x30 0000007f941bfb54
sp 0000007f6f425b80 pc 0000007f941c23c0 pstate 0000000020000000
backtrace:
#00 pc 00000000000693c0 /system/lib64/libc.so (tgkill+8)
#01 pc 0000000000066b50 /system/lib64/libc.so (pthread_kill+68)
#02 pc 0000000000023990 /system/lib64/libc.so (raise+28)
#03 pc 000000000001e2c0 /system/lib64/libc.so (abort+60)
#04 pc 000000000000cf04 /system/lib64/libcutils.so (__android_log_assert+236)
#05 pc 000000000002be6c /system/lib64/libhwui.so
#06 pc 00000000000284f4 /system/lib64/libhwui.so
#07 pc 000000000002aa68 /system/lib64/libhwui.so
#08 pc 000000000002ef50 /system/lib64/libhwui.so (_ZN7android10uirenderer12renderthread12RenderThread10threadLoopEv+124)
#09 pc 000000000001699c /system/lib64/libutils.so (_ZN7android6Thread11_threadLoopEPv+208)
#10 pc 0000000000095110 /system/lib64/libandroid_runtime.so (_ZN7android14AndroidRuntime15javaThreadShellEPv+96)
#11 pc 00000000000161ec /system/lib64/libutils.so
#12 pc 0000000000065fa0 /system/lib64/libc.so (_ZL15__pthread_startPv+52)
#13 pc 000000000001ee6c /system/lib64/libc.so (__start_thread+16)
I cannot find many informations on internet... it seems a Samsung issue only.

I had the same issue from a service, it crash when the service get destroyed, onDestroy remove some view on the WindowManager.
The solution I found working is to remove the view using removeViewImmediate instead of removeView
#Override
public void onDestroy() {
super.onDestroy();
WindowManager windowManager = (WindowManager) getSystemService(WINDOW_SERVICE);
windowManager.removeView(view);
}
replaced by
#Override
public void onDestroy() {
super.onDestroy();
WindowManager windowManager = (WindowManager) getSystemService(WINDOW_SERVICE);
windowManager.removeViewImmediate(view);
}
https://developer.android.com/reference/android/view/WindowManager.html#removeViewImmediate(android.view.View)
Not sure why yet this solve it, the doc is light...
It only happened on Samsung device that use Android 6.0.1 (mainly S6 and S7).

JNI ERROR (app bug): local reference table overflow (max=512) even with out Native Code

we recently launched our app and upgrade actually from previous version..
and suddenly we started to see this error in a ton of devices ..we have no clue whats happening and the logs are very vague ..
Attaching the logs here .But any help or some clue might help us debug the issue .
Build fingerprint: 'Verizon/zeroltevzw/zeroltevzw:5.1.1/LMY47X/G925VVRU4BOK7:user/release-keys'
Revision: '10'
ABI: 'arm64'
pid: 31610, tid: 31610, name: st.mediamanager >>> <<<
signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'sart/runtime/indirect_reference_table.cc:98] JNI ERROR (app bug): local reference table overflow (max=512)'
x0 0000000000000000 x1 0000000000007b7a x2 0000000000000006 x3 0000007fa219fe30
x4 0000007fa219fe30 x5 0000000000000005 x6 0000000000000001 x7 0000000000000020
x8 0000000000000083 x9 00000000000000ca x10 0000007fa1f2a000 x11 0000000000000001
x12 0000000000000001 x13 0000007fa1f2a000 x14 c4aa4c0daad90e20 x15 0000007f92002a31
x16 0000007fa1f2a610 x17 0000007fa1eca174 x18 0000000000000000 x19 0000007fa219fe30
x20 0000007fa21a00e8 x21 0000007fa1f30000 x22 0000000000000001 x23 0000000000000006
x24 0000007fee90e2d0 x25 0000007f9e0a6000 x26 0000007fee90e2c8 x27 0000007f9dffd520
x28 0000007f9e0a6000 x29 0000007fee90e150 x30 0000007fa1e8c264
sp 0000007fee90e150 pc 0000007fa1eca17c pstate 0000000060000000
backtrace:
#00 pc 000000000005e17c /system/lib64/libc.so (tgkill+8)
#01 pc 0000000000020260 /system/lib64/libc.so (pthread_kill+160)
#02 pc 0000000000021794 /system/lib64/libc.so (raise+28)
#03 pc 000000000001b17c /system/lib64/libc.so (abort+60)
#04 pc 0000000000310534 /system/lib64/libart.so (art::Runtime::Abort()+300)
#05 pc 00000000000d5378 /system/lib64/libart.so (art::LogMessage::~LogMessage()+2684)
#06 pc 00000000001e7ff0 /system/lib64/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+416)
#07 pc 00000000002e28cc /system/lib64/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+248)
#08 pc 000000000002a5dc /system/framework/arm64/boot.oat
Build fingerprint: 'Verizon/trltevzw/trltevzw:5.1.1/LMY47X/N910VVRU2BPA1:user/release-keys'
Revision: '12'
ABI: 'arm'
pid: 481, tid: 481, name: st.mediamanager >>> <<<
signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'sart/runtime/indirect_reference_table.cc:109] JNI ERROR (app bug): local reference table overflow (max=512)'
r0 00000000 r1 000001e1 r2 00000006 r3 00000000
r4 b6fc3e38 r5 00000006 r6 00000016 r7 0000010c
r8 00000000 r9 b486f550 sl b4827800 fp 00000475
ip 000001e1 sp bebbaaf8 lr b6e22715 pc b6e46854 cpsr 60070010
backtrace:
#00 pc 00038854 /system/lib/libc.so (tgkill+12)
#01 pc 00014711 /system/lib/libc.so (pthread_kill+52)
#02 pc 0001532f /system/lib/libc.so (raise+10)
#03 pc 00011bc9 /system/lib/libc.so (__libc_android_abort+36)
#04 pc 0001003c /system/lib/libc.so (abort+4)
#05 pc 00230cd1 /system/lib/libart.so (art::Runtime::Abort()+160)
#06 pc 000ac58b /system/lib/libart.so (art::LogMessage::~LogMessage()+1322)
#07 pc 0016996d /system/lib/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+244)
#08 pc 00214f43 /system/lib/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+162)
#09 pc 0001bd8d /system/framework/arm/boot.oat
Build fingerprint: 'Verizon/zenltevzw/zenltevzw:5.1.1/LMY47X/G928VVRU2AOJ3:user/release-keys'
Revision: '9'
ABI: 'arm64'
pid: 18658, tid: 18658, name: st.mediamanager >>> <<<
signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'sart/runtime/indirect_reference_table.cc:109] JNI ERROR (app bug): local reference table overflow (max=512)'
x0 0000000000000000 x1 00000000000048e2 x2 0000000000000006 x3 0000007fa3887e30
x4 0000007fa3887e30 x5 0000000000000005 x6 0000000000000001 x7 0000000000000020
x8 0000000000000083 x9 000000000000005e x10 0000007fa3613000 x11 0000000000000001
x12 0000000000000001 x13 0000007fa3613000 x14 24d3f27831b256ef x15 0000000000000001
x16 0000007fa3613610 x17 0000007fa35b30d4 x18 0000000000000000 x19 0000007fa3887e30
x20 0000007fa38880e8 x21 0000007fa3619000 x22 0000000000000001 x23 0000000000000006
x24 0000007fc7e2cbc0 x25 0000007f9f820d40 x26 0000000000000001 x27 0000007f8c101b60
x28 0000000000000000 x29 0000007fc7e2ca40 x30 0000007fa3575224
sp 0000007fc7e2ca40 pc 0000007fa35b30dc pstate 0000000060000000
backtrace:
#00 pc 000000000005e0dc /system/lib64/libc.so (tgkill+8)
#01 pc 0000000000020220 /system/lib64/libc.so (pthread_kill+160)
#02 pc 0000000000021754 /system/lib64/libc.so (raise+28)
#03 pc 000000000001b13c /system/lib64/libc.so (abort+60)
#04 pc 00000000002ffca4 /system/lib64/libart.so (art::Runtime::Abort()+300)
#05 pc 00000000000d15b8 /system/lib64/libart.so (art::LogMessage::~LogMessage()+2684)
#06 pc 00000000002ad730 /system/lib64/libart.so (art::Monitor::VisitLocks(art::StackVisitor*, void (*)(art::mirror::Object*, void*), void*, bool)+952
#07 pc 0000000000314978 /system/lib64/libart.so (art::StackDumpVisitor::VisitFrame()+568)
#08 pc 000000000030ba08 /system/lib64/libart.so (art::StackVisitor::WalkStack(bool)+308)
#09 pc 0000000000313754 /system/lib64/libart.so (art::Thread::DumpJavaStack(std::__1::basic_ostream<char, std::__1::char_traits<char> >&) const+268)
#10 pc 0000000000313968 /system/lib64/libart.so (art::Thread::DumpStack(std::__1::basic_ostream<char, std::__1::char_traits<char> >&) const+272)
#11 pc 000000000031e8dc /system/lib64/libart.so (art::ThreadList::DumpLocked(std::__1::basic_ostream<char, std::__1::char_traits<char> >&)+100)
#12 pc 00000000002ffd34 /system/lib64/libart.so (art::Runtime::Abort()+444)
#13 pc 00000000000d15b8 /system/lib64/libart.so (art::LogMessage::~LogMessage()+2684)
#14 pc 00000000001d7468 /system/lib64/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+416)
#15 pc 00000000002d2018 /system/lib64/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+248)
#16 pc 000000000002a5dc /system/framework/arm64/boot.oat
Build fingerprint: 'Verizon/kltevzw/kltevzw:5.0/LRX21T/G900VVRU2BOK3:user/release-keys'
Revision: '14'
ABI: 'arm'
pid: 32148, tid: 32148, name: st.mediamanager >>> <<<
signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'art/runtime/indirect_reference_table.cc:113] JNI ERROR (app bug): local reference table overflow (max=512)'
r0 00000000 r1 00007d94 r2 00000006 r3 00000000
r4 b6f92114 r5 00000006 r6 00000016 r7 0000010c
r8 00000000 r9 b4e4f520 sl b4e07800 fp 000004ba
ip 00007d94 sp be8a3b38 lr b6f1bfd1 pc b6f40268 cpsr 60070010
backtrace:
#00 pc 00038268 /system/lib/libc.so (tgkill+12)
#01 pc 00013fcd /system/lib/libc.so (pthread_kill+52)
#02 pc 00014beb /system/lib/libc.so (raise+10)
#03 pc 00011531 /system/lib/libc.so (__libc_android_abort+36)
#04 pc 0000fcbc /system/lib/libc.so (abort+4)
#05 pc 0021d5d9 /system/lib/libart.so (art::Runtime::Abort()+160)
#06 pc 000a834b /system/lib/libart.so (art::LogMessage::~LogMessage()+1322)
#07 pc 001574b7 /system/lib/libart.so (art::IndirectReferenceTable::Add(unsigned int, art::mirror::Object*)+346)
#08 pc 002010d5 /system/lib/libart.so (art::VMClassLoader_findLoadedClass(_JNIEnv*, _jclass*, _jobject*, _jstring*)+136)
#09 pc 0001b151 /system/framework/arm/boot.oat

I don't have a full answer, but its too lengthy for a comment so I'll post it as one.
So the error is just what you expect- its a call into native code that causes you to have more than 512 objects shared with native. Usually that happens because of a leak somewhere. And you don't need to be using native code directly to do it- the framework makes a LOT of native calls behind the scenes.
From the stack trace- I see its libart.so, not libdalvik.so. So this is happening on new devices which have switched from the Dalvik VM to Art. The stack trace looks like it was trying to load a class and add a reference to it for some JNI code, but I can't be certain of that. I do know that we've seen class loading bugs at work on Art that didn't exist on dalvik.
If you have any native code at all I'd make sure you were releasing all reference to java memory and classes properly. If you don't- this may be a bug in Art, knowing what the app was doing at the time of the crash would be useful. Is the crash consistent? If so, what are you doing?