oboe icon indicating copy to clipboard operation
oboe copied to clipboard
verified publisher icon google

Crash in aaudio::AudioStreamLegacy::getBestTimestamp()

Open extreamsd opened this issue 4 years ago • 9 comments

Android version(s): 11 Android device(s): Samsung SM-T500 Oboe version: 1.6.1 App name used for testing: Audio Evolution Mobile Studio

I'm not sure if you are interested in these kind of stack traces since they are from customers who usually cannot reproduce issues, but here is the trace:

#00 pc 000000000008cea4 /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) #01 pc 0000000000025918 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::getBestTimestamp(int, long*, long*, android::ExtendedTimestamp*)+356) #02 pc 0000000000029d84 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamTrack::getTimestamp(int, long*, long*)+220) #03 pc 000000000001e4e8 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::AudioStreamAAudio::getTimestamp(int, long*, long*)+108) #04 pc 000000000001e578 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::AudioStreamAAudio::calculateLatencyMillis()+60) #05 pc 000000000031214c /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libCore.so (Transport::onAudioReady(oboe::AudioStream*, void*, int)+1668) #06 pc 000000000001ef70 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (non-virtual thunk to oboe::AudioSourceCaller::onProcessFixedBlock(unsigned char*, int)+80) #07 pc 00000000000224a8 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (FixedBlockReader::read(unsigned char*, int)+160) #08 pc 0000000000022948 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::SourceFloatCaller::onProcess(int)+52) #09 pc 0000000000027cbc /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::flowgraph::FlowGraphPortFloatOutput::pullData(long, int)+128) #10 pc 0000000000027e14 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::flowgraph::FlowGraphSink::pullData(int)+72) #11 pc 0000000000029c70 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::flowgraph::SinkFloat::read(void*, int)+68) #12 pc 0000000000021bd8 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (non-virtual thunk to oboe::FilterAudioStream::onAudioReady(oboe::AudioStream*, void*, int)+72) #13 pc 000000000001f488 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::AudioStream::fireDataCallback(void*, int)+104) #14 pc 000000000001d9a4 /data/app/~~rgPx6Ut9nfsdblOnLgTDjA==/com.extreamsd.aemobile--o34yNaqcH60uit7xcWmfA==/lib/arm64/libaeoboe.so (oboe::AudioStreamAAudio::callOnAudioReady(AAudioStreamStruct*, void*, int)+40) #15 pc 0000000000022a4c /system/lib64/libaaudio_internal.so (aaudio::AudioStream::maybeCallDataCallback(void*, int)+192) #16 pc 0000000000024aa4 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::callDataCallbackFrames(unsigned char*, int)+304) #17 pc 00000000000251a0 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::processCallbackCommon(int, void*)+944) #18 pc 000000000008bee8 /system/lib64/libaudioclient.so (android::AudioTrack::processAudioBuffer()+2824) #19 pc 000000000008b0d8 /system/lib64/libaudioclient.so (android::AudioTrack::AudioTrackThread::threadLoop()+272) #20 pc 00000000000154d4 /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+216) #21 pc 00000000000a4974 /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+144) #22 pc 0000000000014db0 /system/lib64/libutils.so (thread_data_t::trampoline(thread_data_t const*)+408) #23 pc 00000000000f41b8 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+64) #24 pc 000000000008ede4 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)

Even though there is no further contextual information, perhaps it's important to know about these crashes anyway in case you see more frequent crashes in getBestTimestamp().

extreamsd avatar Jan 30 '22 10:01 extreamsd

See https://developer.android.com/ndk/guides/audio/aaudio/aaudio#thread-safety

AAudio is not completely thread safe. Oboe is a wrapper on AAudio so this issue is likely to also happen for Oboe.

robertwu1 avatar Jan 31 '22 19:01 robertwu1

@extreamsd - was the crash from an assert() or something like a SIGSEGV?

The crash is happening during a legacy callback. https://github.com/google/oboe/issues/17 pc 00000000000251a0 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::processCallbackCommon(int, void*)+944)

The callback is calling calculateLatencyMillis() while calls getTimestamp().

There were known issues with calling getTimestamp() from a legacy callback: https://github.com/google/oboe/wiki/TechNote_ReleaseBuffer

The original assert was fixed in R and the user was running R. Also the stack does not match the old bug. But it may be related.

Because of these issues, we recommend NOT calling getTimestamp or calculateLatencyMillis() from a callback. Because audio output is stable, you only need to call it once from the app once the stream is running and the results should remain valid.

I just noticed that our autodocs do not mention that recommendation. I added #1499

philburk avatar Mar 03 '22 17:03 philburk

We are tracking this internally at b/275752736 | P4 | possible race in AudioStreamLegacy::getBestTimestamp()

philburk avatar Mar 29 '23 19:03 philburk

hello!

i think i'm encountering almost the same error on my side! however i'm using the juce framework (also oboe 1.6.1) so my stack looks a little different. Screenshot 2023-07-10 at 11 42 32 AM copy Screenshot 2023-07-10 at 11 42 32 AM copy 2

i did notice theres a bug fix in 1.7.0, but i wasn't sure if it was related...

  • Fixed an issue with AAudio segfaults if closed while reading or writing (https://github.com/google/oboe/pull/1497, Fixes https://github.com/google/oboe/issues/1484)

if it is, then i'm kind of in an awkward situation here because i'm not using this repo directly (the files juce included doesn't look entirely the same either) so even if i wanted to bump 1.7.0 i wouldn't know exactly how to upgrade.

but since @philburk commented here after 1.7.0 release then i assume this is still a work in progress?

is there anything I can do in the code? Juce forum haven't replied my issue...

tituschu0628 avatar Jul 11 '23 14:07 tituschu0628

This might be related to not using std:shared_ptr when opening the stream. We need to contact JUCE folks to make sure they are using the latest recommendations.

philburk avatar Oct 04 '23 22:10 philburk

hello, i think i'm encountering almost the same error on my side!

the code like this implementation 'com.google.oboe:oboe:1.7.0' std::shared_ptr<oboe::AudioStream> mAudioStream;

void AudioStreamerPlayer::initStream(int channelCount, int frequency, int deviceId) {
        // open stream
        oboe::AudioStreamBuilder builder;
        result = builder.setDirection(oboe::Direction::Output)
                ->setSharingMode(oboe::SharingMode::Shared)
                ->setPerformanceMode(oboe::PerformanceMode::LowLatency)
                ->setDeviceId(mDeviceId)
                ->setFormat(oboe::AudioFormat::I16)
                ->setSampleRate(frequency)
                ->setChannelCount(channelCount)
                ->setDataCallback(this)
                ->openStream(mAudioStream);
        if (result == oboe::Result::OK) {
            auto state = mAudioStream->setBufferSizeInFrames(2 * mAudioStream->getFramesPerBurst());
            if (state) {
                LOGD("AudioStreamerPlayer", "AudioStreamerPlayer change buffer size to %d", state.value());
            } else {
                LOGE("AudioStreamerPlayer", "buffer size could not be changed  %d", state.error());
            }

            result = mAudioStream->requestStart();
            if (result != oboe::Result::OK) {
                LOGE("Error starting playback stream. Error: %s", oboe::convertToText(result));
                mAudioStream->close();
                mAudioStream.reset();
            } else {
                isPlaying = true;
            }
        }
}

unsigned int AudioStreamerPlayer::getLatency() {
    std::lock_guard<std::mutex> lock(mLock);
    if (mAudioStream && isPlaying) {
        oboe::ResultWithValue<double> latencyResult = mAudioStream->calculateLatencyMillis();
        if (latencyResult) {
            return static_cast<unsigned int> (latencyResult.value() + 0.5);
        }
    }
    // if can not query latency, use 50; Need to find another way to handle this
    return DEFAULT_LATENCY_TIME;
}

I have encountered this problem twice already while do stress testing for app. The tombstone file like this AudioStreamerPlayer::getLatency() --> mAudioStream->calculateLatencyMillis() --> AudioStreamAAudio::getTimestamp -->AudioStreamTrack::getTimestamp-->AudioStreamLegacy::getBestTimestamp ExtendedTimestamp(crash)

Tombstone maker: 'xCrash 3.1.0' Crash type: 'native' Start time: '2023-12-06T19:00:56.441+0800' Crash time: '2023-12-07T07:59:43.018+0800' App ID: 'com.cmcc.sc.app' App version: '1.0.0.3.7bff47fb.1206' Rooted: 'Yes' API level: '30' OS version: '11' Kernel version: 'Linux version 4.19.219 #256 SMP PREEMPT Tue Feb 21 16:50:00 CST 2023 (aarch64)' ABI list: 'arm64-v8a,armeabi-v7a,armeabi' Manufacturer: 'Centerm' Brand: 'Centerm' Model: 'VAR211' Build fingerprint: 'Centerm/rk356x_box/rk356x_box:11/RQ3A.210705.001/V8.30.06:userdebug/release-keys' ABI: 'arm64' pid: 20711, tid: 25546, name: pool-11-thread- >>> com.cmcc.sc.app <<< signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr -------- x0 0000000000000000 x1 00000000000063ca x2 0000000000000006 x3 00000078c4f14f60 x4 0000000029aaaaf1 x5 0000000029aaaaf1 x6 0000000029aaaaf1 x7 0000007bc8865010 x8 00000000000000f0 x9 0000007bc20b67c0 x10 ffffff80fffffbdf x11 0000000000000001 x12 0000000000000000 x13 00000078c42d3040 x14 0000000000888904 x15 0000000000000000 x16 0000007bc214ec80 x17 0000007bc2130320 x18 0000000000000000 x19 00000000000050e7 x20 00000000000063ca x21 00000000ffffffff x22 0000000000000001 x23 0000007929d09d70 x24 00000078c4f17000 x25 0000000000000000 x26 0000000000000041 x27 0000000000000041 x28 00000078701e7b88 x29 00000078c4f14fe0 sp 00000078c4f14f40 lr 0000007bc20e4148 pc 0000007bc20e4178

backtrace: #00 pc 000000000004e178 /apex/com.android.runtime/lib64/bionic/libc.so (abort+168) #01 pc 00000000000258d0 /system/lib64/libaaudio_internal.so (_ZN6aaudio17AudioStreamLegacy16getBestTimestampEiPlS1_PN7android17ExtendedTimestampE+352) #02 pc 00000000000293f8 /system/lib64/libaaudio_internal.so (ZN6aaudio16AudioStreamTrack12getTimestampEiPlS1+220) #03 pc 0000000000028548 /data/app/~~QziJkTG8praoUPGnGlAGqQ==/com.cmcc.sc.app-iHwinl9OvCedWjV9qK6CkQ==/lib/arm64/liboboe.so (ZN4oboe17AudioStreamAAudio12getTimestampEiPlS1+108) #04 pc 00000000000285d8 /data/app/~~QziJkTG8praoUPGnGlAGqQ==/com.cmcc.sc.app-iHwinl9OvCedWjV9qK6CkQ==/lib/arm64/liboboe.so (_ZN4oboe17AudioStreamAAudio22calculateLatencyMillisEv+60) #05 pc 000000000062b1a0 /data/app/~~QziJkTG8praoUPGnGlAGqQ==/com.cmcc.sc.app-iHwinl9OvCedWjV9qK6CkQ==/lib/arm64/libcmccspice.so (_ZN19AudioStreamerPlayer10getLatencyEv+168) #06 pc 000000000062da60 /data/app/~~QziJkTG8praoUPGnGlAGqQ==/com.cmcc.sc.app-iHwinl9OvCedWjV9qK6CkQ==/lib/arm64/libcmccspice.so (getLatency+44)

in order to keep audio and picture synchronizing, i will call AudioStreamerPlayer::getLatency() once a second. The crash is happed when stream just started, and do not known how to reproduce or trigger it.

@philburk from the backtrace i can not find why it will crash on ExtendedTimestamp or getBestTimestamp， is there anything I can do in the code to avoid the crash?

arieshfut avatar Dec 12 '23 12:12 arieshfut

@arieshfut - I cannot match this to any known bug.

Is it happening on any release other than R?

Does it seem to happen when plugging or unplugging a headset, or connecting or disconnecting Bluetooth?

Does it still happen with Oboe 1.8.0?

Can you reproduce it reliably? If so then please provide repro steps.

philburk avatar Dec 13 '23 20:12 philburk

Is it happening on any release other than R? ---- I only have two types of devices android 9 and android 11, and only find on android R version.

Does it seem to happen when plugging or unplugging a headset, or connecting or disconnecting Bluetooth? ---- plug headset first, and then start play video by oboe.

Does it still happen with Oboe 1.8.0? ---- this crash only happed twice. when i try oboe 1.8 can not reproduce it.

Can you reproduce it reliably? If so then please provide repro steps. ---- can not reproduce reliably. Afterwards, I will continue to observe and test

now i am trying to call getLatency function separate from audio stream callback, expect can fix this bug. @philburk thank you very much for your reply. I will do more testing and verification in the future. I also look forward to your new discoveries on this crash and reply to messages. Thank you again.

arieshfut avatar Dec 14 '23 01:12 arieshfut

@philburk Hello, two years have passed, I wonder if this problem has been solved, our project also has this function crash, adb logcat log is as follows:

08-15 08:19:20.198 12284 12284 F crashpad: O{;+1qpOl-$4ZjPE.OS5Wm{H[sdzXC5b|u7IyP^LZpF)>xr5WmNqe)RbkgRY+J+^k)Ds'DX2As;>OZwm@f;"^F>nr)npBsmw>xs[TL! 08-15 08:19:20.198 12284 12284 F crashpad: -----END CRASHPAD MINIDUMP----- 08-15 08:19:21.019 3184 8552 F libc : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 8552 (AudioTrack), pid 3184 (com.xzjhm.gwaz) 08-15 08:19:21.172 12301 12301 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 08-15 08:19:21.172 12301 12301 F DEBUG : Build fingerprint: 'OnePlus/OnePlus8Pro/OnePlus8Pro:12/V417IR/2406071527:user/release-keys' 08-15 08:19:21.172 12301 12301 F DEBUG : Revision: '0' 08-15 08:19:21.172 12301 12301 F DEBUG : ABI: 'x86' 08-15 08:19:21.172 12301 12301 F DEBUG : Timestamp: 2024-08-15 08:19:21.057400673+0800 08-15 08:19:21.172 12301 12301 F DEBUG : Process uptime: 44739s 08-15 08:19:21.172 12301 12301 F DEBUG : Cmdline: com.xzjhm.gwaz 08-15 08:19:21.172 12301 12301 F DEBUG : pid: 3184, tid: 8552, name: AudioTrack >>> com.xzjhm.gwaz <<< 08-15 08:19:21.172 12301 12301 F DEBUG : uid: 10096 08-15 08:19:21.172 12301 12301 F DEBUG : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr -------- 08-15 08:19:21.172 12301 12301 F DEBUG : eax 00000000 ebx 00000c70 ecx 00002168 edx 00000006 08-15 08:19:21.172 12301 12301 F DEBUG : edi e8f7055e esi b9dd6a80 08-15 08:19:21.172 12301 12301 F DEBUG : ebp ed5f7db0 esp b9dd6a28 eip ed5f7db9 08-15 08:19:21.172 12301 12301 F DEBUG : backtrace: 08-15 08:19:21.172 12301 12301 F DEBUG : #00 pc 00000db9 [vdso] (__kernel_vsyscall+9) 08-15 08:19:21.172 12301 12301 F DEBUG : #01 pc 0005e048 /apex/com.android.runtime/lib/bionic/libc.so (syscall+40) (BuildId: c8e77979bced6996f98ee4cc0489debe) 08-15 08:19:21.172 12301 12301 F DEBUG : #02 pc 0007ae31 /apex/com.android.runtime/lib/bionic/libc.so (abort+209) (BuildId: c8e77979bced6996f98ee4cc0489debe) 08-15 08:19:21.172 12301 12301 F DEBUG : #03 pc 0001eed0 /system/lib/libaaudio_internal.so (aaudio::AudioStreamLegacy::getBestTimestamp(int, long long*, long long*, android::ExtendedTimestamp*)+336) (BuildId: 5ce3aaa2e127ede2cdeaeba8054f0c06) 08-15 08:19:21.172 12301 12301 F DEBUG : #04 pc 00022ec1 /system/lib/libaaudio_internal.so (aaudio::AudioStreamTrack::getTimestamp(int, long long*, long long*)+225) (BuildId: 5ce3aaa2e127ede2cdeaeba8054f0c06) 08-15 08:19:21.172 12301 12301 F DEBUG : #05 pc 00004778 /system/lib/libaaudio.so (AAudioStream_getTimestamp+72) (BuildId: f0c8441a1dd65dc22bf55fdee4541ca5) 08-15 08:19:21.172 12301 12301 F DEBUG : #06 pc 0276d9aa /system/product/app/webview/webview.apk!libwebviewchromium.so (BuildId: c2d210540cb8407c13ed243d4572b9e8187fddc1) 08-15 08:19:21.184 1208 12306 I DropBoxManagerService: add tag=data_app_native_crash isTagEnabled=true flags=0x2 08-15 08:19:21.184 1208 1285 I BootReceiver: Copying /data/tombstones/tombstone_13 to DropBox (SYSTEM_TOMBSTONE) 08-15 08:19:21.184 1208 1285 I DropBoxManagerService: add tag=SYSTEM_TOMBSTONE isTagEnabled=true flags=0x6

The running environment is mumu emulator, Android kernel 12 version, long time (more than 12 hours) continuous playback of audio will appear this problem. The results obtained in connection with the simulator technology are as follows:

微信图片_20240815155639

KaboXue avatar Aug 15 '24 07:08 KaboXue

/**

  • Known issue #1489 - Android 11 (API 30) Audio Crash:
  • SIGABRT in AudioTrack thread caused by aaudio::AudioStreamLegacy::getBestTimestamp()
  • Stack trace:
    • libaaudio_internal.so (aaudio::AudioStreamLegacy::getBestTimestamp)
    • libaudioclient.so (android::AudioTrack::processAudioBuffer)
    • libutils.so (android::Thread::_threadLoop)
  • Issue specifically occurs in Android 11 emulators due to audio stream handling
  • Workaround:
    • Use physical device
    • Use Android emulator with API level != 30 */

ClichyMercury avatar Jan 13 '25 08:01 ClichyMercury

@philburk any update?my project has the same problem 05-08 07:46:22.514 11099 11744 F libc : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 11744 (AudioTrack), pid 11099 (mobile.bscqtwhz) 05-08 07:46:22.582 87 87 I lowmemorykiller: Before limit: other_free=3343420kB, other_file=3639864kB 05-08 07:46:22.582 87 87 I lowmemorykiller: Ignore critical memory pressure event (free memory=3343420kB, cache=3639864kB, limit=2048000kB) 05-08 07:46:22.584 30883 30883 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone 05-08 07:46:22.584 125 125 I tombstoned: received crash request for pid 11744 05-08 07:46:22.584 30883 30883 I crash_dump64: performing dump of process 11099 (target tid = 11744) 05-08 07:46:22.589 30883 30883 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 05-08 07:46:22.589 30883 30883 F DEBUG : Build fingerprint: 'twsj/redroid_arm64_suqi_sdk/redroid_arm64_suqi_sdk:11/RSV1.210329.089/eng.leidam.20250424.165011:eng/test-keys' 05-08 07:46:22.589 30883 30883 F DEBUG : Revision: '0' 05-08 07:46:22.589 30883 30883 F DEBUG : ABI: 'arm64' 05-08 07:46:22.590 30883 30883 F DEBUG : Timestamp: 2025-05-08 07:46:22+0800 05-08 07:46:22.590 30883 30883 F DEBUG : pid: 11099, tid: 11744, name: AudioTrack >>> com.yeyou.mobile.bscqtwhz <<< 05-08 07:46:22.590 30883 30883 F DEBUG : uid: 10103 05-08 07:46:22.590 30883 30883 F DEBUG : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr -------- 05-08 07:46:22.590 30883 30883 F DEBUG : x0 0000000000000000 x1 0000000000002de0 x2 0000000000000006 x3 00006b282cc4e670 05-08 07:46:22.590 30883 30883 F DEBUG : x4 00000000040eeef6 x5 00000000040eeef6 x6 00000000040eeef6 x7 00006b2ad2088010 05-08 07:46:22.590 30883 30883 F DEBUG : x8 00000000000000f0 x9 86aa5ea4e61c0fa0 x10 0000000000000000 x11 ffffffc0fffffbdf 05-08 07:46:22.590 30883 30883 F DEBUG : x12 0000000000000001 x13 00006b27c1860040 x14 0000000000444450 x15 00006b282cc4f000 05-08 07:46:22.590 30883 30883 F DEBUG : x16 00006b2acc0a2c80 x17 00006b2acc084310 x18 00006b27d0308000 x19 0000000000002b5b 05-08 07:46:22.590 30883 30883 F DEBUG : x20 0000000000002de0 x21 00000000ffffffff x22 0000000000000001 x23 0000000000400801 05-08 07:46:22.590 30883 30883 F DEBUG : x24 00006b282cc4f000 x25 00006b28337d4500 x26 00006b2ace37fb30 x27 00006b2ace2f45a8 05-08 07:46:22.590 30883 30883 F DEBUG : x28 00006b282cc4ea08 x29 00006b282cc4e6f0 05-08 07:46:22.590 30883 30883 F DEBUG : lr 00006b2acc037e20 sp 00006b282cc4e650 pc 00006b2acc037e4c pst 0000000000001000 05-08 07:46:22.596 30883 30883 F DEBUG : backtrace: 05-08 07:46:22.596 30883 30883 F DEBUG : #00 pc 000000000004de4c /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: 17c288f4ddfc5418742b1dc8ef97908c) 05-08 07:46:22.596 30883 30883 F DEBUG : #01 pc 00000000000252a4 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::getBestTimestamp(int, long*, long*, android::ExtendedTimestamp*)+356) (BuildId: d38e68bff283a151c7beb766cc79a7d7) 05-08 07:46:22.596 30883 30883 F DEBUG : #02 pc 0000000000028e68 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamTrack::getTimestamp(int, long*, long*)+220) (BuildId: d38e68bff283a151c7beb766cc79a7d7) 05-08 07:46:22.596 30883 30883 F DEBUG : #03 pc 000000000286b6fc /data/user/0/com.yeyou.mobile.bscqtwhz/app_tbs_64/core_share/libmttwebview.so (BuildId: ad909bff1110bd8ba81b9c77d8fa8a4166ab993d) 05-08 07:46:22.596 30883 30883 F DEBUG : #04 pc 0000000000022364 /system/lib64/libaaudio_internal.so (aaudio::AudioStream::maybeCallDataCallback(void*, int)+192) (BuildId: d38e68bff283a151c7beb766cc79a7d7) 05-08 07:46:22.596 30883 30883 F DEBUG : #05 pc 000000000002432c /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::callDataCallbackFrames(unsigned char*, int)+300) (BuildId: d38e68bff283a151c7beb766cc79a7d7) 05-08 07:46:22.596 30883 30883 F DEBUG : #06 pc 000000000002bb9c /system/lib64/libaaudio_internal.so (FixedBlockReader::processVariableBlock(unsigned char*, int)+228) (BuildId: d38e68bff283a151c7beb766cc79a7d7) 05-08 07:46:22.596 30883 30883 F DEBUG : #07 pc 0000000000024a18 /system/lib64/libaaudio_internal.so (aaudio::AudioStreamLegacy::processCallbackCommon(int, void*)+1104) (BuildId: d38e68bff283a151c7beb766cc79a7d7) 05-08 07:46:22.596 30883 30883 F DEBUG : #08 pc 000000000007444c /system/lib64/libaudioclient.so (android::AudioTrack::processAudioBuffer()+2376) (BuildId: 9e91d36a119b303c826da15fb7f4da7f) 05-08 07:46:22.596 30883 30883 F DEBUG : #09 pc 0000000000073814 /system/lib64/libaudioclient.so (android::AudioTrack::AudioTrackThread::threadLoop()+272) (BuildId: 9e91d36a119b303c826da15fb7f4da7f) 05-08 07:46:22.596 30883 30883 F DEBUG : #10 pc 0000000000015598 /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+460) (BuildId: d1aa3b02347f658128fc75fb371856b9) 05-08 07:46:22.596 30883 30883 F DEBUG : #11 pc 00000000000a0be0 /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+144) (BuildId: e6a955c8a8e32da3ba58dea71afa8853) 05-08 07:46:22.596 30883 30883 F DEBUG : #12 pc 0000000000014d94 /system/lib64/libutils.so (thread_data_t::trampoline(thread_data_t const*)+412) (BuildId: d1aa3b02347f658128fc75fb371856b9) 05-08 07:46:22.596 30883 30883 F DEBUG : #13 pc 00000000000af7dc /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+64) (BuildId: 17c288f4ddfc5418742b1dc8ef97908c) 05-08 07:46:22.596 30883 30883 F DEBUG : #14 pc 000000000004fe08 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 17c288f4ddfc5418742b1dc8ef97908c)

lefu999 avatar May 09 '25 09:05 lefu999

@KaboXue wrote:

Android kernel 12 version, long time (more than 12 hours) continuous playback of audio will appear this problem.

An int32 frame counter will wrap at around 12 hours. Your code is detecting that and calling abort().

@arieshfut - Do you think your crash may be happening after 12 hours?!

philburk avatar May 10 '25 17:05 philburk

@philburk Thank you for your response.

An int32 frame counter will wrap at around 12 hours. Your code is detecting that and calling abort(). ---- @philburk what do you mean: int32 frame counter, where is the frame counter? Could you help point me to the specific code file or location? I’d like to review the code to trace the root cause of the issue.

I cannot confirm whether the crash reported[Dec 12, 2023] by me exceeded 12 hours.

However, yesterday we encountered this crash again on Android 11. After verification, the audio playback started at 10:53 AM and triggered the crash at 11:19 PM, which indeed exceeded 12 hours.

【here is crash info】 06-25 23:19:10.596 18011 3169 E DEBUG : Process Name: 'cm.komect.aqb.android.cloudcomputer' 06-25 23:19:10.596 18011 3169 E DEBUG : Thread Name: 'pool-9-thread-1' 06-25 23:19:10.596 18011 3169 E DEBUG : pid: 1728, tid: 3169 >>> cm.komect.aqb.android.cloudcomputer <<< 06-25 23:19:10.596 18011 3169 E DEBUG : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr -------- 06-25 23:19:10.596 18011 3169 E DEBUG : x0 0000000000000000 x1 0000000000000c61 x2 0000000000000006 x3 000000744e97b790 06-25 23:19:10.596 18011 3169 E DEBUG : x4 0000000000000000 x5 0000000000000000 x6 0000000000000000 x7 000000752496ce30 06-25 23:19:10.596 18011 3169 E DEBUG : x8 00000000000000f0 x9 00000077952a37c0 x10 ffffff80fffffbdf x11 0000000000000001 06-25 23:19:10.596 18011 3169 E DEBUG : x12 0000000000000000 x13 000000741ae33040 x14 00000000008010e8 x15 0000000029aaaaf1 06-25 23:19:10.596 18011 3169 E DEBUG : x16 000000779533bc80 x17 000000779531d320 x18 199999999999999a x19 00000000000006c0 06-25 23:19:10.596 18011 3169 E DEBUG : x20 0000000000000c61 x21 00000000ffffffff x22 0000000000000001 x23 00000074fc688d70 06-25 23:19:10.596 18011 3169 E DEBUG : x24 000000744e97d000 x25 0000000000000000 x26 0000000000000041 x27 0000000000000041 06-25 23:19:10.596 18011 3169 E DEBUG : x28 0000007451af8ad8 x29 000000744e97b810 x30 00000077952d1148 06-25 23:19:10.596 18011 3169 E DEBUG : sp 000000744e97b770 pc 00000077952d1178 pstate 0000000000001000 06-25 23:19:10.596 18011 3169 E DEBUG : v0 00000000000000000000000010000000 v1 00000000000000000000000000000000 06-25 23:19:10.596 18011 3169 E DEBUG : v2 00002f19d4c25ee200002f19d4c25ee2 v3 00000000000008000000000000000000 06-25 23:19:10.596 18011 3169 E DEBUG : v4 00000000000008000000000000000000 v5 00000000000000000000000000000400 06-25 23:19:10.596 18011 3169 E DEBUG : v6 00000000000000000000000000000000 v7 80200802802008028020080280200802 06-25 23:19:10.597 18011 3169 E DEBUG : v8 00000000000000000000000000000000 v9 00000000000000000000000000000000 06-25 23:19:10.597 18011 3169 E DEBUG : v10 00000000000000000000000000000000 v11 00000000000000000000000000000000 06-25 23:19:10.597 18011 3169 E DEBUG : v12 00000000000000000000000000000000 v13 00000000000000000000000000000000 06-25 23:19:10.597 18011 3169 E DEBUG : v14 00000000000000000000000000000000 v15 00000000000000000000000000000000 06-25 23:19:10.597 18011 3169 E DEBUG : v16 40100401401004014010040140100401 v17 00000008000000000008000000080004 06-25 23:19:10.597 18011 3169 E DEBUG : v18 00000000000008000000000000000000 v19 00000000000000000000000000000000 06-25 23:19:10.597 18011 3169 E DEBUG : v20 0000000000030d400000000000000001 v21 000000000000001e0000000000000001 06-25 23:19:10.597 18011 3169 E DEBUG : v22 00000000000013880000000000000005 v23 000000000000000a0000000000002800 06-25 23:19:10.597 18011 3169 E DEBUG : v24 000000000000000000000000ebad8088 v25 000000000000000000000000ebad8089 06-25 23:19:10.597 18011 3169 E DEBUG : v26 000000000000000000000000ebad808a v27 000000000000000000000000ebad808b 06-25 23:19:10.597 18011 3169 E DEBUG : v28 000000000000000000000000ebad808c v29 000000000000000000000000ebad808d 06-25 23:19:10.597 18011 3169 E DEBUG : v30 000000000000000000000000ebad808e v31 006c00610066003d0065007600690074 06-25 23:19:10.597 18011 3169 E DEBUG : fpsr 08000011 fpcr 00000000 06-25 23:19:10.637 18011 3169 E DEBUG : #00 pc 0000000000013178 /apex/com.android.runtime/lib64/bionic/libc.so (abort+168) 06-25 23:19:10.638 18011 3169 E DEBUG : #01 pc 00000000000098d0 /system/lib64/libaaudio_internal.so (_ZN6aaudio17AudioStreamLegacy16getBestTimestampEiPlS1_PN7android17ExtendedTimestampE+352) 06-25 23:19:10.638 18011 3169 E DEBUG : #02 pc 000000000000d3f8 /system/lib64/libaaudio_internal.so (ZN6aaudio16AudioStreamTrack12getTimestampEiPlS1+220) 06-25 23:19:10.638 18011 3169 E DEBUG : #03 pc 000000000001c580 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/liboboe.so (_ZN4oboe17AudioStreamAAudio22calculateLatencyMillisEv+72) 06-25 23:19:10.638 18011 3169 E DEBUG : #04 pc 000000000037a4ac /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (_ZN19AudioStreamerPlayer10getLatencyEv+104) 06-25 23:19:10.638 18011 3169 E DEBUG : #05 pc 000000000037dbac /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so 06-25 23:19:10.638 18011 3169 E DEBUG : #06 pc 00000000010f0b34 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so 06-25 23:19:10.638 18011 3169 E DEBUG : #07 pc 00000000010f3d90 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (g_main_context_dispatch+252) 06-25 23:19:10.638 18011 3169 E DEBUG : #08 pc 00000000010f40d4 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so 06-25 23:19:10.638 18011 3169 E DEBUG : #09 pc 00000000010f43e4 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (g_main_loop_run+248) 06-25 23:19:10.638 18011 3169 E DEBUG : #10 pc 000000000037f3d0 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (connection_connect_session+152) 06-25 23:19:10.638 18011 3169 E DEBUG : #11 pc 000000000037ef14 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (connection_connect_client+600) 06-25 23:19:10.638 18011 3169 E DEBUG : #12 pc 00000000002930fc /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (spiceClientConnectScg+220) 06-25 23:19:10.638 18011 3169 E DEBUG : #13 pc 0000000000292e18 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/lib/arm64/libcmccspice.so (Java_com_cmcc_remote_desktop_connection_SpiceCommunicator_SpiceClientConnectScg+832) 06-25 23:19:10.638 18011 3169 E DEBUG : #14 pc 0000000000006994 /data/app/~~S35AFj8YOfRNT4xrx5xwHg==/cm.komect.aqb.android.cloudcomputer-A81xbAN8A0XWfUHPfVp7dQ==/oat/arm64/base.odex

arieshfut avatar Jun 26 '25 02:06 arieshfut

b/275752736 | P4 | possible race in AudioStreamLegacy::getBestTimestamp() was fixed in Android 13. See https://cs.android.com/android/_/android/platform/frameworks/av/+/58c1e6d0ff1f2975e55afc524296ba1f1ab73dbc. I'm not sure there's much that can be done on the app side besides closing the stream and reopening the stream after 12 hours or reopening the stream when it crashes on that signature for Android 11 or 12.

robertwu1 avatar Jun 26 '25 04:06 robertwu1