QVideoFrame::toImage crashes frequently on Android when receiving frames from a QVideoSink. This is a backtrace of the crash:

 08-02 09:39:24.310  F  [27001/27001] DEBUG    *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
 08-02 09:39:24.310  F  [27001/27001] DEBUG    Build fingerprint: 'DOOGEE/S90Pro_EEA/S90Pro:9/PPR1.180610.011/1563002187:user/release-keys'
 08-02 09:39:24.310  F  [27001/27001] DEBUG    Revision: '0'
 08-02 09:39:24.310  F  [27001/27001] DEBUG    ABI: 'arm64'
 08-02 09:39:24.310  F  [27001/27001] DEBUG    pid: 26643, tid: 26660, name: qtMainLoopThrea  >>> org.qtproject.example.appCameraTest <<<
 08-02 09:39:24.310  F  [27001/27001] DEBUG    signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x78
 08-02 09:39:24.310  F  [27001/27001] DEBUG    Cause: null pointer dereference
 08-02 09:39:24.310  F  [27001/27001] DEBUG        x0  0000000000000000  x1  0000000000000000  x2  0000000000000004  x3  0000000000000001
 08-02 09:39:24.310  F  [27001/27001] DEBUG        x4  0000000000000010  x5  0000000000000008  x6  0000000000000000  x7  ffffffffffffffff
 08-02 09:39:24.310  F  [27001/27001] DEBUG        x8  0000000000000000  x9  0000000000000001  x10 0000007a8248230a  x11 0000007a824b22d6
 08-02 09:39:24.310  F  [27001/27001] DEBUG        x12 0000007a8286ed1c  x13 0000000000000020  x14 0000000000000002  x15 0000000000000001
 08-02 09:39:24.310  F  [27001/27001] DEBUG        x16 0000007b25468a08  x17 0000007b25c83918  x18 0000000000000000  x19 0000000000000000
 08-02 09:39:24.311  F  [27001/27001] DEBUG        x20 0000000000000000  x21 0000007a631e3160  x22 0000007a8337bd20  x23 0000007a631e3160
 08-02 09:39:24.311  F  [27001/27001] DEBUG        x24 0000007a6cacb240  x25 0000007a6cacb520  x26 0000000000000000  x27 0000007a631e3090
 08-02 09:39:24.311  F  [27001/27001] DEBUG        x28 0000007a7fdfeaa0  x29 0000007a8337ba20
 08-02 09:39:24.311  F  [27001/27001] DEBUG        sp  0000007a8337b910  lr  0000007a8286e534  pc  0000007a8286ef10
 08-02 09:39:24.317  W  [602/26900] mtkcam-AppStreamMgr [0-FrameHandler::updateResult] frameNo:2 is not in FrameQueue; FrameQueue: 3 4 5 6 7; ResultQueue: 2
 08-02 09:39:24.322  W  [602/26984] MtkCam/StreamingPipe/RSCNode [prepareRSCEnqueData]sensor(0) Frame 4 rsso(prev/curr)=(0x0_0x0,0x7b6969a200_288x219)
 08-02 09:39:24.323  E  [602/26982] libc     Access denied finding property "lce.smooth.enable"
 08-02 09:39:24.323  E  [602/26982] libc     Access denied finding property "lce.curve.enable"
 08-02 09:39:24.323  E  [602/26982] libc     Access denied finding property "dce.curve.enable"
 08-02 09:39:24.323  E  [602/26982] libc     Access denied finding property "dce.dw.enable"
 08-02 09:39:24.324  E  [602/26982] libc     Access denied finding property "dce.bw.enable"
 08-02 09:39:24.330  F  [27001/27001] DEBUG
 08-02 09:39:24.330  F  [27001/27001] DEBUG    backtrace:
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #00 pc 000000000051bf10  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Gui_arm64-v8a.so
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #01 pc 000000000051cad0  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Gui_arm64-v8a.so
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #02 pc 0000000000445b2c  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Gui_arm64-v8a.so (QRhi::endOffscreenFrame(QFlags<QRhi::EndFrameFlag>)+64)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #03 pc 00000000000b8a80  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Multimedia_arm64-v8a.so (qImageFromVideoFrame(QVideoFrame const&, QVideoFrame::RotationAngle, bool, bool)+2736)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #04 pc 00000000000b2f00  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Multimedia_arm64-v8a.so (QVideoFrame::toImage() const+160)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #05 pc 000000000001fd5c  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libappCameraTest_arm64-v8a.so (VideoProcessor::processFrame(QVideoFrame const&)+248)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #06 pc 00000000000206a8  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libappCameraTest_arm64-v8a.so (_ZN9QtPrivate11FunctorCallINS_11IndexesListIJLi0EEEENS_4ListIJRK11QVideoFrameEEEvM14VideoProcessorFvS6_EE4callESA_PS8_PPv+148)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #07 pc 0000000000020604  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libappCameraTest_arm64-v8a.so (_ZN9QtPrivate15FunctionPointerIM14VideoProcessorFvRK11QVideoFrameEE4callINS_4ListIJS4_EEEvEEvS6_PS1_PPv+76)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #08 pc 0000000000020524  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libappCameraTest_arm64-v8a.so (_ZN9QtPrivate11QSlotObjectIM14VideoProcessorFvRK11QVideoFrameENS_4ListIJS4_EEEvE4implEiPNS_15QSlotObjectBaseEP7QObjectPPvPb+156)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #09 pc 0000000000375368  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so (QObject::event(QEvent*)+452)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #10 pc 0000000000344878  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #11 pc 00000000003447f4  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so (QCoreApplication::notifyInternal2(QObject*, QEvent*)+176)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #12 pc 00000000003454b4  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so (QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*)+508)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #13 pc 00000000004403cc  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so (QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)+76)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #14 pc 00000000005d1904  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Gui_arm64-v8a.so (QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)+20)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #15 pc 00000000000571dc  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libplugins_platforms_qtforandroid_arm64-v8a.so
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #16 pc 000000000034bc5c  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so (QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)+332)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #17 pc 0000000000344d48  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libQt6Core_arm64-v8a.so (QCoreApplication::exec()+136)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #18 pc 000000000001e07c  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libappCameraTest_arm64-v8a.so (main+236)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #19 pc 000000000004d4a0  /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/lib/arm64/libplugins_platforms_qtforandroid_arm64-v8a.so
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #20 pc 0000000000565de0  /system/lib64/libart.so (art_quick_generic_jni_trampoline+144)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #21 pc 000000000055d04c  /system/lib64/libart.so (art_quick_invoke_static_stub+604)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #22 pc 00000000000cf760  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #23 pc 00000000002823b8  /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #24 pc 000000000027c374  /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+948)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #25 pc 000000000052db9c  /system/lib64/libart.so (MterpInvokeStatic+204)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #26 pc 000000000054f514  /system/lib64/libart.so (ExecuteMterpImpl+14612)
 08-02 09:39:24.330  F  [27001/27001] DEBUG        #27 pc 00000000000159f4  /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/base.apk (deleted) (org.qtproject.qt.android.QtNative$7.run)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #28 pc 0000000000255e70  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1181525464+496)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #29 pc 000000000025b9f0  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #30 pc 000000000027c358  /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #31 pc 000000000052d610  /system/lib64/libart.so (MterpInvokeInterface+1392)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #32 pc 000000000054f594  /system/lib64/libart.so (ExecuteMterpImpl+14740)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #33 pc 0000000000017d28  /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.qtproject.example.appCameraTest-dJO_a8qXgOm9ukr3sx0pZQ==/base.apk (deleted) (org.qtproject.qt.android.QtThread$1.run+148)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #34 pc 0000000000255e70  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1181525464+496)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #35 pc 000000000025b9f0  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #36 pc 000000000027c358  /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #37 pc 000000000052d610  /system/lib64/libart.so (MterpInvokeInterface+1392)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #38 pc 000000000054f594  /system/lib64/libart.so (ExecuteMterpImpl+14740)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #39 pc 00000000000cab1c  /system/framework/boot.vdex (java.lang.Thread.run+12)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #40 pc 0000000000255e70  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1181525464+496)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #41 pc 000000000051cdd8  /system/lib64/libart.so (artQuickToInterpreterBridge+1032)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #42 pc 0000000000565efc  /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #43 pc 000000000055cd88  /system/lib64/libart.so (art_quick_invoke_stub+584)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #44 pc 00000000000cf740  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #45 pc 00000000004633d0  /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #46 pc 0000000000464498  /system/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue*)+424)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #47 pc 000000000048f808  /system/lib64/libart.so (art::Thread::CreateCallback(void*)+1120)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #48 pc 0000000000083114  /system/lib64/libc.so (__pthread_start(void*)+36)
 08-02 09:39:24.331  F  [27001/27001] DEBUG        #49 pc 00000000000233bc  /system/lib64/libc.so (__start_thread+68)

To reproduce this, I used this minimal example: https://github.com/carlonluca/CameraTest. To reproduce the crash with it:

1. Run the app
2. Send to the background
3. Resume

also:

1. Run the app
2. Stop the camera using the button
3. Resume the app
4. Start the camera

The crash in QVideoFrame::toImage is not always in QRhi::endOffscreenFrame, I also saw it in QRhi::thread.

I reproduced the crash with 6.5.1. I could also reproduce in 6.5.2, but it is affected by #115460 so it is more difficult to see it.

Something similar also happens in different scenarios, like using StackView and moving from a page to another.