Unity3d and probably NGUI causing crash on nexus 6 (5.1) - unity3d

Question

I am getting following crash just on Nexus 6(5.1 OS) device. I am unable to make out what is causing this kind of crash and how to approach it. Will appreciate any help.
Unity3d version : 4.6.5f1
NGUI version: 2.6.4
Crashlog from device:
05-12 11:22:02.401: E/chromium(7468): ### WebView Version 42.0.2311.138 (code 2311138)
05-12 11:22:02.401: E/chromium(7468): --------- beginning of crash
05-12 11:22:02.401: A/libc(7468): Fatal signal 11 (SIGSEGV), code -6, fault addr 0x1d2c in tid 7489 (main)
05-12 11:22:02.474: I/DEBUG(353): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
05-12 11:22:02.474: I/DEBUG(353): Build fingerprint: 'google/shamu/shamu:5.1/LMY47I/1767468:user/release-keys'
05-12 11:22:02.474: I/DEBUG(353): Revision: '33696'
05-12 11:22:02.474: I/DEBUG(353): ABI: 'arm'
05-12 11:22:02.474: I/DEBUG(353): pid: 7468, tid: 7489, name: main >>> com.xxx.xxxx <<<
05-12 11:22:02.474: I/DEBUG(353): signal 11 (SIGSEGV), code -6 (SI_TKILL), fault addr 0xc
05-12 11:22:02.506: I/DEBUG(353): r0 858fe2b0 r1 00000052 r2 00000052 r3 00000000
05-12 11:22:02.506: I/DEBUG(353): r4 858fe2b0 r5 00000052 r6 00000052 r7 aad91da0
05-12 11:22:02.506: I/DEBUG(353): r8 af3e9150 r9 af3e9138 sl 00000003 fp aefb5a00
05-12 11:22:02.506: I/DEBUG(353): ip 00000000 sp af3e90c0 lr aac2a577 pc aacbe97c cpsr 200b0030
05-12 11:22:02.507: I/DEBUG(353): backtrace:
05-12 11:22:02.507: I/DEBUG(353): #00 pc 0017797c /system/vendor/lib/egl/libGLESv2_adreno.so (EsxCmdBuf::GetSpace(unsigned int)+15)
05-12 11:22:02.507: I/DEBUG(353): #01 pc 000e3573 /system/vendor/lib/egl/libGLESv2_adreno.so (EsxFramebufferObject::LoadStoreCmdBufGetSpace(EsxCmdBufType, unsigned int)+42)
05-12 11:22:02.507: I/DEBUG(353): #02 pc 00174ba5 /system/vendor/lib/egl/libGLESv2_adreno.so (EsxBltLib::StoreBin(EsxFramebufferObject*, EsxRenderingLayout const*, unsigned int)+108)
05-12 11:22:02.507: I/DEBUG(353): #03 pc 00116881 /system/vendor/lib/egl/libGLESv2_adreno.so (EsxContext::processAndSubmitRendering(EsxFlushReason)+3936)
05-12 11:22:02.507: I/DEBUG(353): #04 pc 00177435 /system/vendor/lib/egl/libGLESv2_adreno.so (EsxCmdMgr::Flush(EsxFlushReason)+412)
05-12 11:22:02.508: I/DEBUG(353): #05 pc 0011693d /system/vendor/lib/egl/libGLESv2_adreno.so (EsxContext::SwapBuffers(EsxRect const*, unsigned int, EglResourceAccessInfo*)+140)
05-12 11:22:02.508: I/DEBUG(353): #06 pc 0011dd43 /system/vendor/lib/egl/libGLESv2_adreno.so (EglContext::SwapBuffers(EsxRect const*, unsigned int, EglResourceAccessInfo*)+54)
05-12 11:22:02.508: I/DEBUG(353): #07 pc 0011ae89 /system/vendor/lib/egl/libGLESv2_adreno.so (EglApi::SwapBuffers(void*, void*)+140)
05-12 11:22:02.508: I/DEBUG(353): #08 pc 00005dc5 /system/vendor/lib/egl/libEGL_adreno.so (eglSwapBuffers+28)
05-12 11:22:02.508: I/DEBUG(353): #09 pc 0001237f /system/lib/libEGL.so (eglSwapBuffers+290)
05-12 11:22:02.508: I/DEBUG(353): #10 pc 003cee58 /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #11 pc 003d4374 /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #12 pc 0039ef74 /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #13 pc 001fc76c /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #14 pc 002a0124 /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #15 pc 003d24e4 /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #16 pc 003de1b0 /data/app/com.xxx.xxxx-1/lib/arm/libunity.so
05-12 11:22:02.509: I/DEBUG(353): #17 pc 0067a5af /data/dalvik-cache/arm/data#app#com.xxx.xxxx-1#base.apk#classes.dex
05-12 11:22:03.064: I/AudioFlinger(356): BUFFER TIMEOUT: remove(4097) from active list on thread 0xb59c4000

Answer 1

You got fault addr 0xc, r3 00000000, is not exactly the same as my case.
In my case, it happens when there are no objects rendered on camera, and camera.targetTexture has been set to aRenderTexture, Destroy(aRenderTexture) will crash.
Fix Code 1 (not recommend but works):
Destroy(aRenderTexture, 1.0f)
Fix Code 2 (maybe a better way, attach the follow script on your crashed camera):
using UnityEngine;
[RequireComponent (typeof (Camera))]
public class CrashFix : MonoBehaviour {
void Awake () {
Camera _cam = gameObject.GetComponent<Camera>();
GameObject _invisibleObj = GameObject.CreatePrimitive(PrimitiveType.Quad);
_invisibleObj.name = "CrashFix";
_invisibleObj.layer = GetFirstLayerNumberFromMask(_cam.cullingMask);
_invisibleObj.transform.parent = gameObject.transform;
_invisibleObj.transform.localScale = new Vector3(0.001f, 0.001f, 0.001f);
_invisibleObj.transform.position =
_cam.transform.position + _cam.transform.forward * (_cam.nearClipPlane+_cam.farClipPlane)/2f;
Material _mat = new Material(Shader.Find("UI/Default"));
_mat.color = new Color32(0,0,0,0);
var mr = _invisibleObj.GetComponent<MeshRenderer>();
mr.sharedMaterial = _mat;
Destroy(_invisibleObj.GetComponent<Collider>());
}
private int GetFirstLayerNumberFromMask(int mask)
{
if (mask == 0) return 0;
int result = 0;
while(true){
if ((mask & 1) == 1) return result;
mask >>= 1;
++result;
}
}
}