SIGABRT crash on Android 14+ (API 34+): NewStringUTF called with non-Modified-UTF-8 ARCore anchor ID in ARUtilsCreateJavaARAnchorFromAnchor

[LeoBessin]

Environment

• Package: @reactvision/react-viro
• Platform: Android 14+ (API 34+)
• Architecture: arm64-v8a
• Affected file: viro_renderer-release.aar → jni/arm64-v8a/libviro_renderer.so

---

Summary

On Android 14+ (API 34+), the app crashes with a SIGABRT during AR anchor
creation. The crash occurs inside ARUtilsCreateJavaARAnchorFromAnchor at
file offset 0x55E5EC in libviro_renderer.so.

This issue was identified and analyzed with the help of Claude (Anthropic),
which traced the binary-level root cause and proposed both a workaround and a
proper fix.

---

Root Cause

The native function ARUtilsCreateJavaARAnchorFromAnchor calls
env->NewStringUTF(anchorId) where anchorId is the raw byte string returned
by ARCore for the anchor's identifier.

Starting with Android 14 (API 34), ART's strict JNI enforcement was
significantly tightened. NewStringUTF now aborts the process if the
provided byte string contains any bytes that are not valid
Modified UTF-8.
ARCore anchor IDs are arbitrary opaque byte strings and are not guaranteed to
be valid Modified UTF-8, which triggers this abort.

The resulting crash in logcat looks like:

A/libc: Fatal signal 6 (SIGABRT) 
backtrace:
#00  ARUtilsCreateJavaARAnchorFromAnchor + 212

The anchor ID is only used inside Viro's Java layer to populate
ARAnchor.mAnchorId. It is never exposed to the JavaScript layer in typical
usage, so passing null or a sanitized replacement does not affect AR
functionality.

---

Steps to Reproduce

1. Use @reactvision/react-viro with AR features (e.g. ViroARScene with
   anchor tracking)
2. Run on a physical device with Android 14+ (API 34+)
3. Trigger AR anchor creation (e.g. place an object, detect a surface)
4. The app crashes immediately with SIGABRT

---

References
Android 14 JNI changes — stricter NewStringUTF validation
JNI Tips — Modified UTF-8

[LeoBessin]

Temporary Workaround

As a stopgap, the broken instruction can be binary-patched inside the .aar
before bundling. The following Python script replaces the blr x8
(NewStringUTF call) at offset 0x55E5EC with mov x0, xzr (returns a
null jstring instead of crashing):

#!/usr/bin/env python3
"""
Patch libviro_renderer.so inside viro_renderer-release.aar to prevent
a SIGABRT crash at ARUtilsCreateJavaARAnchorFromAnchor+212.

Root cause: the function calls env->NewStringUTF(anchorId) at file offset
0x55e5ec. On Android 14+ (API 34+), ART's strict JNI validation aborts if the
anchor ID byte string contains non-Modified-UTF-8 bytes. The anchor ID is only
used inside Viro's Java layer to populate ARAnchor.mAnchorId; our app never
reads it from JS.

Patch: replace the `blr x8` (call NewStringUTF) instruction with
`mov x0, xzr` (return null jstring). ARAnchor is constructed with a null
anchorId, which is a legal String assignment in Java.
"""
import os, sys, zipfile, shutil

AAR_PATH = "node_modules/@reactvision/react-viro/android/viro_renderer/viro_renderer-release.aar"
SO_ENTRY = "jni/arm64-v8a/libviro_renderer.so"

CRASH_OFFSET  = 0x55E5EC
EXPECTED_BYTES = bytes([0x00, 0x01, 0x3F, 0xD6])  # blr x8
PATCH_BYTES    = bytes([0xE0, 0x03, 0x1F, 0xAA])  # mov x0, xzr

def patch_so(data):
    actual = bytes(data[CRASH_OFFSET:CRASH_OFFSET+4])
    if actual == PATCH_BYTES:
        print("  already patched — skipping"); return data
    if actual != EXPECTED_BYTES:
        print(f"  WARNING: unexpected bytes {actual.hex()}, patch NOT applied"); return data
    data[CRASH_OFFSET:CRASH_OFFSET+4] = PATCH_BYTES
    print(f"  patched 0x{CRASH_OFFSET:08x}: {EXPECTED_BYTES.hex()} -> {PATCH_BYTES.hex()}")
    return data

def patch_aar(path):
    tmp = path + ".tmp"
    with zipfile.ZipFile(path, "r") as zin, zipfile.ZipFile(tmp, "w", zipfile.ZIP_DEFLATED) as zout:
        for item in zin.infolist():
            data = zin.read(item.filename)
            if item.filename == SO_ENTRY:
                data = bytes(patch_so(bytearray(data)))
            zout.writestr(item, data)
    shutil.move(tmp, path)

patch_aar(os.path.normpath(AAR_PATH))

Run this script after npm install / yarn install, before building the APK.

Note: this patch targets the specific .so build currently shipped in
the package. If the .so is rebuilt, the offset may change and the script
will print a warning without applying the patch.

Proper Fix (for maintainers)

In the C++ source for ARUtilsCreateJavaARAnchorFromAnchor, the anchor ID
should be sanitized before being passed to NewStringUTF. Possible approaches:

Hex-encode or base64-encode the raw anchor ID bytes before calling NewStringUTF — this guarantees valid ASCII/Modified-UTF-8 output.
Use NewString with a UTF-16 representation instead of NewStringUTF.
Substitute a generated UUID if the anchor ID value itself is not semantically meaningful to callers.

[LeoBessin]

As mentioned I am not a regular user of this package or React Native ; I came across this issue while working on a school project. I hope this report is useful and contributes to improving the library :)