A bug in The Native Camera code of the Qualcomm Snapdragon devices

This is new bug that happens only on Samsung Qualcomm Snapdragon Android 11 devices. (Samsung Galaxy S21 Ultra 5G, Samsung Galaxy Note20 Ultra 5G,Samsung Galaxy S10+…)

I have no idea how to even start debugging it - any clue will be helpful

I have reported it to Samsung developer support a month ago - no answers until now,
It happens mostly when choosing high FPS like 60,120 or 240

backtrace:
#00 pc 000000000004ef24 /apex/com.android.runtime/lib64/bionic/libc.so (abort+164)
#00 pc 0000000000042b00 /apex/com.android.runtime/lib64/bionic/libc.so (scudo::die()+8)
#00 pc 0000000000042444 /apex/com.android.runtime/lib64/bionic/libc.so (scudo::dieOnMapUnmapError(bool)+56)
#00 pc 0000000000042bbc /apex/com.android.runtime/lib64/bionic/libc.so (scudo::map(void*, unsigned long, char const*, unsigned long, scudo::MapPlatformData*)+184)
#00 pc 000000000004655c /apex/com.android.runtime/lib64/bionic/libc.so (scudo::MapAllocator<scudo::MapAllocatorCache<256u, 256u, 33554432ul, 0, 1000> >::allocate(unsigned long, unsigned long, unsigned long*, bool)+408)
#00 pc 00000000000445a0 /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::allocate(unsigned long, scudo::Chunk::Origin, unsigned long, bool)+864)
#00 pc 00000000000441c0 /apex/com.android.runtime/lib64/bionic/libc.so (scudo_calloc+48)
#00 pc 000000000003badc /apex/com.android.runtime/lib64/bionic/libc.so (calloc+52)
#00 pc 0000000000006fb8 /system/lib64/libcamera_metadata.so (allocate_camera_metadata+60)
#00 pc 000000000006377c /system/lib64/libcamera_client.so (android::CameraMetadata::resizeIfNeeded(unsigned long, unsigned long)+144)
#00 pc 0000000000063c10 /system/lib64/libcamera_client.so (android::CameraMetadata::updateImpl(unsigned int, void const*, unsigned long)+312)
#00 pc 0000000000154424 /system/lib64/libandroid_runtime.so (CameraMetadata_writeValues(_JNIEnv*, _jclass*, int, _jbyteArray*, long)+848)
#00 pc 000000000024df88 /system/framework/arm64/boot-framework.oat (art_jni_trampoline+200)
#00 pc 000000000200b640 /memfd:jit-cache (android.hardware.camera2.impl.CameraMetadataNative.setBase+752)
#00 pc 0000000002006e70 /memfd:jit-cache (android.hardware.camera2.impl.CameraMetadataNative.set+336)
#00 pc 0000000002003b50 /memfd:jit-cache (android.hardware.camera2.impl.CameraDeviceImpl$CameraDeviceCallbacks.onResultReceived+544)
#00 pc 0000000002002ff8 /memfd:jit-cache (android.hardware.camera2.ICameraDeviceCallbacks$Stub.onTransact+856)
#00 pc 000000000074e96c /system/framework/arm64/boot-framework.oat (android.os.Binder.execTransactInternal+844)
#00 pc 000000000074e4f8 /system/framework/arm64/boot-framework.oat (android.os.Binder.execTransact+296)
#00 pc 0000000000134564 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548)
#00 pc 0000000000198e94 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+204)
#00 pc 00000000005320fc /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
#00 pc 0000000000533698 /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithVarArgsart::ArtMethod*(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+448)
#00 pc 000000000053387c /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+92)
#00 pc 000000000038e02c /apex/com.android.art/lib64/libart.so (art::JNI::CallBooleanMethodV(_JNIEnv*, _jobject*, _jmethodID*, std::__va_list)+660)
#00 pc 000000000009eaa8 /system/lib64/libandroid_runtime.so (_JNIEnv::CallBooleanMethod(_jobject*, _jmethodID*, …)+124)
#00 pc 000000000012cf8c /system/lib64/libandroid_runtime.so (JavaBBinder::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+160)
#00 pc 000000000004a834 /system/lib64/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+232)
#00 pc 0000000000053ab4 /system/lib64/libbinder.so (android::IPCThreadState::executeCommand(int)+700)
#00 pc 0000000000053748 /system/lib64/libbinder.so (android::IPCThreadState::getAndExecuteCommand()+156)
#00 pc 0000000000054304 /system/lib64/libbinder.so (android::IPCThreadState::joinThreadPool(bool)+116)
#00 pc 000000000007cdf4 /system/lib64/libbinder.so (android::PoolThread::threadLoop()+400)
#00 pc 000000000001553c /system/lib64/libutils.so (android::thread::_threadLoop(void*)+320)
#00 pc 00000000000a48a8 /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+144)
#00 pc 0000000000014db0 /system/lib64/libutils.so (thread_data_t::trampoline(thread_data_t const*)+408)
#00 pc 00000000000b6234 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+64)
#00 pc 0000000000050e64 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)

Hello, I think you might get better assistance if you submit a support request here