SIGSEGV Faults on Android when processing stereo

[flamewave000]

Our player utilizes the below code to process the stereo based on the examples provided and the documentation of the processStereo method.

static bool audioProcessing(void * clientData, int16_t *audio, int32_t numberOfFrames, int32_t sampleRate) {
    auto player = static_cast<AudioProcessor *>(clientData)->player;
    if (player == nullptr) return false;
    float playerOutput[(numberOfFrames * (8 / sizeof(float))) + (64 / sizeof(float))];
    player->outputSamplerate = (uint32_t) sampleRate;
    if (player->processStereo(playerOutput, false, (uint32_t) numberOfFrames)) {
        Superpowered::FloatToShortInt(playerOutput, audio, (uint32_t) numberOfFrames);
        return true;
    }
    return false;
}

We have been plagued with SIGSEGV crashes from this one call to processStereo (about 50-60% of our reported crashes in the Play Store). Given that the code for the function is blackboxed in C++ I have been unable to debug the issue. Here is the reported crash from Google:

backtrace:
  #00  pc 0x000000000012e604  /data/app/~~7iCZqMj6gDYqYnUqpkXLXA==/app.....musicplayer-wTrI6x50RejhzbKh47a6lg==/lib/arm64/libSuperpoweredAdaptor.so (Superpowered::playerProcess::processAUTHREAD(float**, bool, unsigned int, float*, double, double, bool, double, double)+1348) (BuildId: 4ebdd90e1b567429a1f23383ff9b37791a725f3b)
  #01  pc 0x000000000012d22c  /data/app/~~7iCZqMj6gDYqYnUqpkXLXA==/app.....musicplayer-wTrI6x50RejhzbKh47a6lg==/lib/arm64/libSuperpoweredAdaptor.so (Superpowered::AdvancedAudioPlayer::processStereo(float*, bool, unsigned int, float)+76) (BuildId: 4ebdd90e1b567429a1f23383ff9b37791a725f3b)
  #02  pc 0x00000000000c4160  /data/app/~~7iCZqMj6gDYqYnUqpkXLXA==/app.....musicplayer-wTrI6x50RejhzbKh47a6lg==/lib/arm64/libSuperpoweredAdaptor.so (AudioProcessor::audioProcessing(void*, short*, int, int)+124) (BuildId: 4ebdd90e1b567429a1f23383ff9b37791a725f3b)
  #03  pc 0x00000000000c1a04  /data/app/~~7iCZqMj6gDYqYnUqpkXLXA==/app.....musicplayer-wTrI6x50RejhzbKh47a6lg==/lib/arm64/libSuperpoweredAdaptor.so (SuperpoweredAndroidAudioIO_OutputCallback(SLAndroidSimpleBufferQueueItf_ const* const*, void*)) (BuildId: 4ebdd90e1b567429a1f23383ff9b37791a725f3b)
  #04  pc 0x000000000001c27c  /system/lib64/libwilhelm.so (audioTrack_handleMoreData_lockPlay(CAudioPlayer_struct*, android::AudioTrack::Buffer const&)+124)
  #05  pc 0x000000000001ee9c  /system/lib64/libwilhelm.so (android::AudioTrackCallback::onMoreData(android::AudioTrack::Buffer const&)+44)
  #06  pc 0x0000000000096e98  /system/lib64/libaudioclient.so (android::AudioTrack::processAudioBuffer()+2856)
  #07  pc 0x0000000000096080  /system/lib64/libaudioclient.so (android::AudioTrack::AudioTrackThread::threadLoop()+272)
  #08  pc 0x0000000000013440  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+416)
  #09  pc 0x00000000000caf4c  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+140)
  #10  pc 0x00000000000c163c  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204)
  #11  pc 0x0000000000054930  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)

[flamewave000]

I have discovered a way to reliably produce this SEG Fault. It appears to be that when trying to load a song file via an InputStream and Superpowered's AudioInMemory + AdvancedAudioPlayer::openMemory a segmentation fault occurs very regularly. When I have the debugger attached, it has a 90% fail rate. With the debugger not attached, it's about a 20-30% fail rate.

Our application will occasionally have to open a file in this manner due to Android's SAF system, and we currently have plans on going to this method of opening files full time since Google has Deprecated direct public file access via file paths (mandating the use of SAF and the MediaStore).

Kotlin code that opens a file InputStream:

val input = contentResolver.openInputStream(file.uri)
if (input == null) {
    error("Failed to open input stream")
    return
}
try {
    engine.open(input)
} catch (e: Throwable) {
    Log.e("MainActivity", e.message, e)
}

Kotlin code that reads the file and passes it to the JNI in 8KiB chunks

fun open(stream: InputStream) {  
    internalOpenMemory()
    launch {
       stream.use {
          var read: Int
          val bytes = ByteArray(8 * 1024)
          do {
             read = it.read(bytes)
             internalOpenMemoryAppend(bytes)
          } while (read > 0)
       }
       internalOpenMemoryComplete()
    }
}
// External JNI functions
private external fun internalOpenMemory()  
private external fun internalOpenMemoryAppend(data: ByteArray)  
private external fun internalOpenMemoryComplete()

JNI Functions that handle appending the byte data to the AudioInMemory data table.

#define PREAMBLE extern "C" __attribute__((visibility("default")))
struct AudioProcessor {
    Superpowered::AdvancedAudioPlayer player;
	struct {
	    Superpowered::AudioInMemory *table;
	    size_t size;
	} currentData;
};
template<typename R> inline R *getSelf(JNIEnv *env, jobject k_obj);

PREAMBLE void Java_com_superpowered_AdvancedAudioPlayer_internalOpenMemory(JNIEnv *env, jobject k_obj) {
    auto self = getSelf<AudioProcessor>(env, k_obj);
    self->currentData.table = static_cast<Superpowered::AudioInMemory *>(Superpowered::AudioInMemory::create(0, 0, 0, false));
    self->currentData.size = 0;
    // AdvancedAudioPlayer::openMemory
    self->player.openMemory(self->currentData.table);
}
PREAMBLE void Java_com_superpowered_AdvancedAudioPlayer_internalOpenMemoryAppend(JNIEnv *env, jobject k_obj, jbyteArray data) {
    auto self = getSelf<AudioProcessor>(env, k_obj);
    jsize size = env->GetArrayLength(data);
    if (size <= 0) return;
    jboolean isCopy = false;
    jbyte *bytes = env->GetByteArrayElements(data, &isCopy);
    if (!bytes) {
       std::cerr << "AdvancedAudioPlayer::internalAppendData > Failed to retrieve data chunk from JVM" << std::endl;
       return;
    }
    void *c_data = malloc(size * sizeof(char));
    memcpy(c_data, bytes, size);
    if (isCopy)
       env->ReleaseByteArrayElements(data, bytes, 0);
    Superpowered::AudioInMemory::append(self->currentData.table, c_data, size);
    self->currentData.size += size;
}
PREAMBLE void Java_com_superpowered_AdvancedAudioPlayer_internalOpenMemoryComplete(JNIEnv *env, jobject k_obj) {
    auto self = getSelf<AudioProcessor>(env, k_obj);
    Superpowered::AudioInMemory::setSize(self->currentData.table, self->currentData.size);
    Superpowered::AudioInMemory::complete(self->currentData.table);
}
#undef PREAMBLE

Debugger Call Stack:

art_sigsegv_fault 0x00000076044840a0
art::FaultManager::HandleFault(int, siginfo *, void *) 0x00000076044845d4
art::SignalChain::Handler(int, siginfo *, void *) 0x0000005f5f04aea0
__kernel_rt_sigreturn 0x000000789b09e8b0
Superpowered::getID3Skip(Superpowered::decoderInternals *, int *) 0x0000007597fbe180
Superpowered::Decoder::open(const char *, bool, int, int, int, Superpowered::httpRequest *) 0x0000007597fbda80
Superpowered::threadedPcmProviderOpen(bool *, Superpowered::readThreadOpenInput *, Superpowered::readThreadOpenOutput *, Superpowered::threadedPcmProviderInternals *, Superpowered::readThreadInput *, Superpowered::readThreadOutput *) 0x0000007598028178
[Inlined] Superpowered::threadedPcmProviderPair::shadowIteration() 0x0000007598028fd4
Superpowered::threadedPcmProviderPair::shadowThreadFunc(void *) 0x0000007598028f84
__pthread_start(void *) 0x0000007894ef975c
__start_thread 0x0000007894e99154

LogCat Entry:

libc ...superpoweredtest [ A ] Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x9000112dd7114 in tid 23810 (superpoweredtest), pid 23494 (superpoweredtest)

[ivannador]

Most likely SAF owns the memory you pass in AudioInMemory. With retainCount 0 the player will take ownership of the memory and free it at will. Please try set retainCount to 1. Also - release the AudioInMemory object when finished. With retainCount 1 this is necessary.

[ivannador]

No further input from user, closing.

[flamewave000]

The SAF fix did apply to my comment about the AiM issue, but we are still currently using raw file paths with Superpowered in the field.

The original SIGSEGV fault that is unrelated to AiM and SAF is still occurring in the field and remains the primary crash contributor for our app (42-52% of all crashes reported).