SIGSEGV in AndroidPacketCreator.nativeCreateRgbaImage called from ModelResourcesCacheService.nativeInstallServiceObject

### Have I written custom code (as opposed to using a stock example script provided in MediaPipe) Yes ### OS Platform and Distribution Android 8.1.0, 13, 15, 16 (see affected devices table) ### Mobile device if the issue happens on mobile device | Device | OS Version | Chipset Family | | :--- | :--- | :--- | | **Motorola Moto G84 5G** | Android 15 | Qualcomm Snapdragon 695 (arm64-v8a) | | **Samsung Galaxy M55 5G** | Android 13 | Samsung (arm64-v8a) | | **Samsung Galaxy S20 FE 5G** | Android 8.1.0 | Qualcomm (arm64-v8a) | | **Samsung Galaxy Tab A (2016) With S Pen** | Android 16 | (arm64-v8a / armeabi-v7a) | | **Samsung Galaxy S21 FE 5G** | Android 16 | Qualcomm (arm64-v8a) | | **Samsung Galaxy S25** | Android 16 | Qualcomm Snapdragon 8 Elite (arm64-v8a) | ### Browser and version if the issue happens on browser _No response_ ### Programming Language and version Kotlin 2.3.10 / Java 17 ### MediaPipe version 0.10.29 ### Bazel version _No response_ ### Solution GestureRecognizer + FaceDetector (Tasks Vision, RunningMode.IMAGE) ### Android Studio, NDK, SDK versions (if issue is related to building in Android environment) AGP 8.13.2 · compileSdk/targetSdk 35 · minSdk 24 · LiteRT 1.4.0 ### Xcode & Tulsi version (if issue is related to building for iOS) _No response_ ### Describe the actual behavior The app crashes with SIGSEGV inside libmediapipe_tasks_vision_jni.so during task-creation warmup (not during inference). The crash is reproducible across 6 different devices, 4 Android OS versions (8.1 through 16) ### Describe the expected behaviour createFromOptions() should complete without crashing. The AndroidPacketCreator native handle must be valid before nativeInstallServiceObject invokes nativeCreateRgbaImage during the graph warmup sequence. ### Standalone code/steps you may have used to try to get what you need The crash occurs in a flow that: 1. Creates a GestureRecognizer via GestureRecognizer.createFromOptions(context, options) on a background thread (RunningMode.IMAGE, Delegate.CPU). 2. Creates a FaceDetector via FaceDetector.createFromOptions(context, options) on a separate background thread shortly after (RunningMode.IMAGE, Delegate.CPU). We have not been able to produce a minimal isolated reproducer yet. We have not been able to produce a minimal isolated reproducer yet. All crashes are captured from production Crashlytics sessions. ### Other info / Complete Logs Variant A - fault address 0x00000000000001a0, .so BuildId af74b706c3b53dc1902f8ecf2e70d597: ```shell null pointer dereference: SIGSEGV 0x00000000000001a0 #00 pc 0x85f324 libmediapipe_tasks_vision_jni.so Java_com_google_mediapipe_framework_AndroidPacketCreator_nativeCreateRgbaImage (BuildId: af74b706c3b53dc1902f8ecf2e70d597) #01 pc 0x5a2edc libmediapipe_tasks_vision_jni.so Java_com_google_mediapipe_tasks_core_ModelResourcesCacheService_nativeInstallServiceObject (BuildId: af74b706c3b53dc1902f8ecf2e70d597) ``` Variant B (1 session) — fault address 0x0000000000000000 (null function-pointer call), different .so BuildId 95175561dd3048334a682d43bec35aa5 — consistent with a different ABI binary. The crash occurs entirely within nativeCreateRgbaImage (no nativeInstallServiceObject in the symbolicated frames) ``` Crashed: Thread: SIGSEGV 0x0000000000000000 #00 pc 0x0 #01 pc 0x58f889 libmediapipe_tasks_vision_jni.so Java_com_google_mediapipe_framework_AndroidPacketCreator_nativeCreateRgbaImage (BuildId: 95175561dd3048334a682d43bec35aa5) #02 pc 0x58f2f3 libmediapipe_tasks_vision_jni.so Java_com_google_mediapipe_framework_AndroidPacketCreator_nativeCreateRgbaImage (BuildId: 95175561dd3048334a682d43bec35aa5) ... (further frames all within nativeCreateRgbaImage) ```