[BUG] Simperf incorrectly resolves symbol names in libunity.so

[jsjtxietian]

Description

When I use simpleperf to collect callstack for a demo built by official Unity2022.3.47, simpleperf incorrectly resolves symbol names in libunity.so. I know it looks like a bug with unity since unity uses ndk23b to build the apk, but I suspect simpleperf should correctly resolve symbol name anyway so I choose to fire the bug here.

Interestingly, it correctly resolves symbol names in libil2cpp.so. Here is a similiar issue opened by me in prefetto google/perfetto#1005 which could provide more info, prefetto provides a load bias for libunity.so which causes the problem, but I'm not sure how simpleperf works.

Reproduction steps:
I use Pixel9, which is Android 14, make a demo release version apk by official Unity2022.3.47 ( create symbols.zip debugging and do not choose development build) , after that modify the apk to make it debuggable. And then use app_profiler.py to collect stack:
python .\android-ndk-r27c\simpleperf\app_profiler.py -p com.DefaultCompany.ForProfile -a com.unity3d.player.UnityPlayerActivity -r "- e cpu-clock -f 1000 --duration 10 -g" -lib .\Symbol\

The reproduction file is a little big but I can upload somewhere else if necessary. Or can anyone kindly show me how to debug this issue, so I can provide more info.

I am using a supported NDK

• I have checked and the NDK I'm using is currently supported

Affected versions

r27

[yabinc]

Here are several steps to debug the symbolization problem:

1. Use readelf -sW libunity.so to see if you can read symbols from libunity.so.
2. Run simpleperf dump perf.data to get the build id of libunity.so in perf.data, and see if it matches the build id of unstripped libunity.so.
3. Check if the unstripped libunity.so is put in binary_cache/ by app_profiler.py.

To investigate more, please upload perf.data and the unstripped libunity.so.

[jsjtxietian]

Thanks for the help!

1. Use readelf -sW libunity.so to see if you can read symbols from libunity.so => This is ok since it has symbol just got it wrong
2. Run simpleperf dump perf.data to get the build id of libunity.so in perf.data => Yes it matches
3. Check if the unstripped libunity.so is put in binary_cache/ by app_profiler.py => Yes

When I try to reproduce the issue, I found a new problem: the libunity.so 's symbol is not only wrong but also has a max depth of 1 from time to time:

I checked the dumped data and find that:

• If I provide the symbol for libunity.so (use -lib), the symbol is wrong and depth is 1
• If I do not provide the symbol (clear symbols under /data/local/tmp/native_libs/* and do not provide -lib ), most address will be resolved to _MultiplyMatrixArrayWithBase4x4_NEON (within expectation since I do not provide the symbol), but the raw address is right and I can get the correct symbol name from that raw address using llvm-addr2line

So I guess the problemis that something wrong happens when simpleperf resolves symbol name on device.

This is the material you required: The perf.data is recorded using python D:\Library\android-ndk-r27c\simpleperf\app_profiler.py -p com.DefaultCompany.ForProfile -r "-e cpu-clock -f 1000 --duration 10 -g" -lib ./arm64-v8a , the libunity.so can be found at Unity's install location: Editor\2022.3.47f1\Editor\Data\PlaybackEngines\AndroidPlayer\Variations\il2cpp\Release\Symbols\arm64-v8a and I included here, the report.html is to show the wrong result:

Test.zip

Let me know if you need anything else.