SIGABRT in libaudioeffect_jni.so effectCallback

Description

Audio playback randomly stops. Crash repeatedly occurs in the same location.

May be a duplicate of #2105 (closed)

VLC_Crash_Log.txt VLC_Crash_Log_2.txt VLC_Crash_Log_3.txt

Log attached above and crash below are from separate occurrences.

Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 23410 (Binder:22622_7), pid 22622 (main)
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/blueline/blueline:11/RQ3A.210805.001.A1/7474174:user/release-keys'
Revision: 'MP1.0'
ABI: 'arm64'
pid: 22622, tid: 23410, name: Binder:22622_7  >>> org.videolan.vlc.debug <<<
uid: 10494
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: 'JNI DETECTED ERROR IN APPLICATION: use of invalid jobject 0x2100000010'
    x0  0000000000000000  x1  0000000000005b72  x2  0000000000000006  x3  0000007b4eb02790
    x4  0000007cb3ec0820  x5  0000007cb3ec0820  x6  0000007cb3ec0820  x7  0000007cb3ec4080
    x8  00000000000000f0  x9  7155dca0c51b3cfa  x10 0000000000000000  x11 ffffffc0fffffbdf
    x12 0000000000000001  x13 000000fe58c6ab4c  x14 002ffb83e5a69678  x15 000000002093ecf6
    x16 0000007e8537bc80  x17 0000007e8535d870  x18 0000007b4cc12000  x19 000000000000585e
    x20 0000000000005b72  x21 00000000ffffffff  x22 0000007bf383a25f  x23 0000000000000000
    x24 0000007bf381a0b7  x25 0000000000000001  x26 0000007bf383100c  x27 0000007bf3e36000
    x28 0000007c13e70600  x29 0000007b4eb02810
    lr  0000007e853112a0  sp  0000007b4eb02770  pc  0000007e853112cc  pst 0000000000000000

backtrace:
      #00 pc 000000000004e2cc  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: 49090ae59e6ae37f8beae53c551820ad)
      #01 pc 000000000055d080  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort(char const*)+2308) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #02 pc 0000000000013978  /system/lib64/libbase.so (android::base::SetAborter(std::__1::function<void (char const*)>&&)::$_3::__invoke(char const*)+76) (BuildId: 01a12dd5224373edcc3a74506f64a9c9)
      #03 pc 0000000000012fa4  /system/lib64/libbase.so (android::base::LogMessage::~LogMessage()+320) (BuildId: 01a12dd5224373edcc3a74506f64a9c9)
      #04 pc 00000000003851b8  /apex/com.android.art/lib64/libart.so (art::JavaVMExt::JniAbort(char const*, char const*)+2572) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #05 pc 0000000000385328  /apex/com.android.art/lib64/libart.so (art::JavaVMExt::JniAbortF(char const*, char const*, ...)+188) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #06 pc 00000000005b27f4  /apex/com.android.art/lib64/libart.so (art::Thread::DecodeJObject(_jobject*) const+848) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #07 pc 0000000000376398  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::ScopedCheck::CheckInstance(art::ScopedObjectAccess&, art::(anonymous namespace)::ScopedCheck::InstanceKind, _jobject*, bool)+132) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #08 pc 000000000037503c  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::ScopedCheck::CheckPossibleHeapValue(art::ScopedObjectAccess&, char, art::(anonymous namespace)::JniValueType)+564) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #09 pc 000000000037468c  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::ScopedCheck::Check(art::ScopedObjectAccess&, bool, char const*, art::(anonymous namespace)::JniValueType*)+612) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #10 pc 0000000000379e30  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::CheckJNI::CheckCallArgs(art::ScopedObjectAccess&, art::(anonymous namespace)::ScopedCheck&, _JNIEnv*, _jobject*, _jclass*, _jmethodID*, art::InvokeType, art::(anonymous namespace)::VarArgs const*)+132) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #11 pc 0000000000378d7c  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::CheckJNI::CallMethodV(char const*, _JNIEnv*, _jobject*, _jclass*, _jmethodID*, std::__va_list, art::Primitive::Type, art::InvokeType)+728) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #12 pc 00000000003694b8  /apex/com.android.art/lib64/libart.so (art::(anonymous namespace)::CheckJNI::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+76) (BuildId: 0183cc6150704cdc371a87b659800e56)
      #13 pc 0000000000005e6c  /system/lib64/libaudioeffect_jni.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+124) (BuildId: 3b169ce20c010d353849349956079bf0)
      #14 pc 0000000000005d28  /system/lib64/libaudioeffect_jni.so (effectCallback(int, void*, void*)+384) (BuildId: 3b169ce20c010d353849349956079bf0)
      #15 pc 0000000000048488  /system/lib64/libaudioclient.so (android::AudioEffect::controlStatusChanged(bool)+108) (BuildId: 5c4f5ed260ef48757d4390c20fa7afad)
      #16 pc 0000000000049844  /system/lib64/libaudioclient.so (android::AudioEffect::EffectClient::controlStatusChanged(bool)+120) (BuildId: 5c4f5ed260ef48757d4390c20fa7afad)
      #17 pc 00000000000a8094  /system/lib64/libaudioclient.so (android::BnEffectClient::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+356) (BuildId: 5c4f5ed260ef48757d4390c20fa7afad)
      #18 pc 000000000004982c  /system/lib64/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+232) (BuildId: 52a96623e462096184c4425671cc1c5d)
      #19 pc 0000000000052210  /system/lib64/libbinder.so (android::IPCThreadState::executeCommand(int)+1032) (BuildId: 52a96623e462096184c4425671cc1c5d)
      #20 pc 0000000000051d58  /system/lib64/libbinder.so (android::IPCThreadState::getAndExecuteCommand()+156) (BuildId: 52a96623e462096184c4425671cc1c5d)
      #21 pc 0000000000052590  /system/lib64/libbinder.so (android::IPCThreadState::joinThreadPool(bool)+60) (BuildId: 52a96623e462096184c4425671cc1c5d)
      #22 pc 0000000000078678  /system/lib64/libbinder.so (android::PoolThread::threadLoop()+24) (BuildId: 52a96623e462096184c4425671cc1c5d)
      #23 pc 00000000000154d0  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+260) (BuildId: 5d6af74124211886d954d61c96514a46)
      #24 pc 00000000000a0be0  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+144) (BuildId: 1dec5134a09522f9c83c48dae0aec3be)
      #25 pc 0000000000014d94  /system/lib64/libutils.so (thread_data_t::trampoline(thread_data_t const*)+412) (BuildId: 5d6af74124211886d954d61c96514a46)
      #26 pc 00000000000afd4c  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+64) (BuildId: 49090ae59e6ae37f8beae53c551820ad)
      #27 pc 0000000000050288  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 49090ae59e6ae37f8beae53c551820ad)

Steps to reproduce

1. Start audio playback
2. Wait

Context

App version

3.4.0 Beta 5

Android version

11

Device model

Pixel 3

App mode

Smartphone

changed the description

assigned to @tguillem

@rhstone Thanks for the report. What audio format are you playing? Could you share it or share the format/codec information?

I noticed it occurred while playing 256 kbps MP3s, 2 channel, 44.1 kHz.

Your android firmware is quite recent, right (210805)? Was it working before the android upgrade ?

The crash seems to be on the Android side and not on VLC (this doesn't change the fact we need to solve it ;)).

I get fairly regular updates on the Pixel, so I'm not sure when it started exactly. I just uploaded two additional log files. The first was captured on July 12th, if that helps to narrow down the timeframe.

Looks like the issue is occurring at this line: https://android.googlesource.com/platform/frameworks/base/+/master/media/jni/audioeffect/android_media_AudioEffect.cpp#177

I don't see any recent changes in the logs, which leads me to suspect the invalid value had a strong reference somewhere else in the code which was keeping it from being garbage collected. Someone probably inadvertently removed the reference in a different location, which is now triggering the problem in audio effect.

I seems that ALOGV is unavailable in release builds. Perhaps ALOGW can be programmatically enabled?

changed the description

changed the description

changed milestone to %3.4.x

I found this crash in the play Store console. It's an Android 11 only crash that affects different manufacturers.

It occurred in the VLC for Android 3.3.4 version as well, so it's not a regression.

@rhstone could you provide logcat logs via adb ?

@tguillem I'll try to reproduce it with logcat running--I can see how the additional messages would be beneficial. It may take a few days to get another crash.

@rhstone Thanks! So, this is not systematic at all?

Is it happening at the end of a media playback ?

marked this issue as related to #2221 (closed)

Fixed by tguillem/vlc@c900a218

closed