A more complicated thread sync issue about audioFlinger::EffectModule
来源：互联网 发布：开淘宝需要保证金吗 编辑：程序博客网 时间：2024/06/05 09:48
AudioFlinger中的一个线程同步引起的issue, 涉及到了audio方面更复杂点的Framework.
[Symptom]
11-09 21:47:37.879 161 6305 W AudioFlinger: removeEffect_l() 0x41cc53f0 cannot promote chain for effect 0x42445ac8
11-09 21:47:37.879 161 6305 W AudioPolicyManagerBase: unregisterEffect() unknown effect ID 12251
11-09 21:47:37.879 161 6305 V VPT20 : EffectRelease 0x433fedf0
11-09 21:47:37.879 161 6305 V VPT20 : Vpt_release start
11-09 21:47:37.879 161 6305 V VPT20 : EmptyDataProc start
11-09 21:47:37.879 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_EventBufferFlag
11-09 21:47:37.889 161 3294 E VPT20 : FillBuffer is no data
11-09 21:47:37.889 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_EventBufferFlag
11-09 21:47:37.889 161 3294 E VPT20 : FillBuffer is no data
11-09 21:47:37.889 161 6305 V VPT20 : EmptyDataProc end
11-09 21:47:37.889 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_CommandStateSet State:2
11-09 21:47:37.889 161 6305 V VPT20 : FreeBuffer start
11-09 21:47:37.889 161 6305 V VPT20 : FreeBuffer end
11-09 21:47:37.889 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_CommandStateSet State:1
11-09 21:47:37.889 161 6305 V VPT20 : Vpt_release end
11-09 21:47:37.889 161 6305 V VPT20 : EffectRelease end
11-09 21:47:37.889 161 6305 F libc : Fatal signal 11 (SIGSEGV) at 0x00000010 (code=1), thread 6305 (Binder_3)
11-09 21:47:37.999 156 156 I DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
11-09 21:47:37.999 156 156 I DEBUG : Build fingerprint: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:userdebug/release-keys'
11-09 21:47:37.999 156 156 I DEBUG : pid: 161, tid: 6305, name: Binder_3 >>> /system/bin/mediaserver <<<
11-09 21:47:37.999 156 156 I DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000010
11-09 21:47:38.619 610 611 D dalvikvm: GC_CONCURRENT freed 6991K, 44% free 11196K/19911K, paused 22ms+35ms, total 291ms
11-09 21:47:38.849 156 156 I DEBUG : r0 00000000 r1 00000010 r2 00000001 r3 00000001
11-09 21:47:38.849 156 156 I DEBUG : r4 4268cd30 r5 4268cd38 r6 42445ac8 r7 00000001
11-09 21:47:38.849 156 156 I DEBUG : r8 4268cdd4 r9 000000a1 sl 40319a6c fp 00000001
11-09 21:47:38.849 156 156 I DEBUG : ip 00000003 sp 4268cd20 lr 4023dbbb pc 40235228 cpsr 40000030
11-09 21:47:38.849 156 156 I DEBUG : d0 7361656c65527465 d1 7520292874636520
11-09 21:47:38.849 156 156 I DEBUG : d2 65206e776f6e6b65 d3 444920746365666e
11-09 21:47:38.849 156 156 I DEBUG : d4 ff431cfd2fddff23 d5 af7feaffff0de3ff
11-09 21:47:38.849 156 156 I DEBUG : d6 5100fa19e8fffcff d7 000000005a251022
11-09 21:47:38.849 156 156 I DEBUG : d8 0000000000000000 d9 0000000000000000
11-09 21:47:38.849 156 156 I DEBUG : d10 0000000000000000 d11 0000000000000000
11-09 21:47:38.849 156 156 I DEBUG : d12 0000000000000000 d13 0000000000000000
11-09 21:47:38.849 156 156 I DEBUG : d14 0000000000000000 d15 0000000000000000
11-09 21:47:38.849 156 156 I DEBUG : d16 0000000000000000 d17 00000000000001f4
11-09 21:47:38.849 156 156 I DEBUG : d18 00000000000179a5 d19 9d32811804279cf3
11-09 21:47:38.849 156 156 I DEBUG : d20 bf3b893feeaf5f7d d21 62f3fff0876afffe
11-09 21:47:38.849 156 156 I DEBUG : d22 250561599109be60 d23 1a36dab6b20e5dad
11-09 21:47:38.849 156 156 I DEBUG : d24 3fe999a1f2459fc7 d25 000000000000374c
11-09 21:47:38.849 156 156 I DEBUG : d26 00000000000001f2 d27 0000000000000000
11-09 21:47:38.849 156 156 I DEBUG : d28 00000000000174fe d29 0000000000000213
11-09 21:47:38.849 156 156 I DEBUG : d30 0000000000003b66 d31 0000000000017316
11-09 21:47:38.849 156 156 I DEBUG : scr 60000010
11-09 21:47:38.859 156 156 I DEBUG :
11-09 21:47:38.859 156 156 I DEBUG : backtrace:
11-09 21:47:38.859 156 156 I DEBUG : #00 pc 00038228 /system/lib/libaudioflinger.so (android::wp<android::AudioFlinger::EffectHandle>::promote() const+7)
11-09 21:47:38.859 156 156 I DEBUG : #01 pc 00040bb7 /system/lib/libaudioflinger.so (android::AudioFlinger::EffectHandle::disconnect(bool)+76)
11-09 21:47:38.859 156 156 I DEBUG : #02 pc 00053531 /system/lib/libmedia.so (android::BnEffect::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+244)
11-09 21:47:38.859 156 156 I DEBUG : #03 pc 00014391 /system/lib/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+60)
11-09 21:47:38.859 156 156 I DEBUG : #04 pc 00016f15 /system/lib/libbinder.so (android::IPCThreadState::executeCommand(int)+520)
11-09 21:47:38.859 156 156 I DEBUG : #05 pc 0001733d /system/lib/libbinder.so (android::IPCThreadState::joinThreadPool(bool)+184)
11-09 21:47:38.869 156 156 I DEBUG : #06 pc 0001af55 /system/lib/libbinder.so
11-09 21:47:38.869 156 156 I DEBUG : #07 pc 00010e37 /system/lib/libutils.so (android::Thread::_threadLoop(void*)+114)
11-09 21:47:38.869 156 156 I DEBUG : #08 pc 0001099d /system/lib/libutils.so
11-09 21:47:38.869 156 156 I DEBUG : #09 pc 00012df0 /system/lib/libc.so (__thread_entry+48)
11-09 21:47:38.869 156 156 I DEBUG : #10 pc 00012548 /system/lib/libc.so (pthread_create+172)
11-09 21:47:38.869 156 156 I DEBUG :
11-09 21:47:38.869 156 156 I DEBUG : stack:
11-09 21:47:38.869 156 156 I DEBUG : 4268cce0 402de779 /system/lib/libc.so (dlfree)
11-09 21:47:38.869 156 156 I DEBUG : 4268cce4 4268cd10 [stack:6305]
11-09 21:47:38.869 156 156 I DEBUG : 4268cce8 42445ac8
11-09 21:47:38.869 156 156 I DEBUG : 4268ccec 00000001
11-09 21:47:38.869 156 156 I DEBUG : 4268ccf0 4268cd38 [stack:6305]
11-09 21:47:38.869 156 156 I DEBUG : 4268ccf4 4268cdd4 [stack:6305]
11-09 21:47:38.869 156 156 I DEBUG : 4268ccf8 4268cd10 [stack:6305]
11-09 21:47:38.869 156 156 I DEBUG : 4268ccfc 402dff85 /system/lib/libc.so (free+12)
11-09 21:47:38.879 156 156 I DEBUG : 4268cd00 4268cd10 [stack:6305]
11-09 21:47:38.879 156 156 I DEBUG : 4268cd04 40233135 /system/lib/libaudioflinger.so (android::sp<android::AudioFlinger::Client>::~sp()+14)
11-09 21:47:38.879 156 156 I DEBUG : 4268cd08 4268cd10 [stack:6305]
11-09 21:47:38.879 156 156 I DEBUG : 4268cd0c 4023ad57 /system/lib/libaudioflinger.so (android::AudioFlinger::EffectModule::disconnect(android::wp<android::AudioFlinger::EffectHandle> const&, bool)+58)
11-09 21:47:38.879 156 156 I DEBUG : 4268cd10 42445ac8
11-09 21:47:38.879 156 156 I DEBUG : 4268cd14 41cc53f0 [heap]
11-09 21:47:38.879 156 156 I DEBUG : 4268cd18 df0027ad
11-09 21:47:38.879 156 156 I DEBUG : 4268cd1c 00000000
11-09 21:47:38.879 156 156 I DEBUG : #00 4268cd20 00000001
11-09 21:47:38.889 156 156 I DEBUG : 4268cd24 41c73f70
11-09 21:47:38.889 156 156 I DEBUG : 4268cd28 4268cd38 [stack:6305]
11-09 21:47:38.889 156 156 I DEBUG : 4268cd2c 4023dbbb /system/lib/libaudioflinger.so (android::AudioFlinger::EffectHandle::disconnect(bool)+80)
11-09 21:47:38.889 156 156 I DEBUG : #01 4268cd30 00000000
11-09 21:47:38.889 156 156 I DEBUG : 4268cd34 41f0a548
11-09 21:47:38.889 156 156 I DEBUG : 4268cd38 41c73f70
11-09 21:47:38.889 156 156 I DEBUG : 4268cd3c 41c73b38
11-09 21:47:38.889 156 156 I DEBUG : 4268cd40 00000000
11-09 21:47:38.889 156 156 I DEBUG : 4268cd44 41c73f70
11-09 21:47:38.889 156 156 I DEBUG : 4268cd48 4268ce04 [stack:6305]
11-09 21:47:38.889 156 156 I DEBUG : 4268cd4c 4268cdd4 [stack:6305]
11-09 21:47:38.889 156 156 I DEBUG : 4268cd50 00000004
11-09 21:47:38.889 156 156 I DEBUG : 4268cd54 400eb533 /system/lib/libmedia.so (android::BnEffect::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+246)
11-09 21:47:38.899 156 156 I DEBUG : #02 4268cd58 00000000
11-09 21:47:38.899 156 156 I DEBUG : 4268cd5c 40430aa9 /system/lib/libbinder.so (android::Parcel::releaseObjects()+54)
11-09 21:47:38.899 156 156 I DEBUG : 4268cd60 4268cdd4 [stack:6305]
11-09 21:47:38.899 156 156 I DEBUG : 4268cd64 41cc2b20 [heap]
11-09 21:47:38.899 156 156 I DEBUG : 4268cd68 00000000
11-09 21:47:38.899 156 156 I DEBUG : 4268cd6c 4268cdd4 [stack:6305]
11-09 21:47:38.899 156 156 I DEBUG : 4268cd70 00000034
11-09 21:47:38.899 156 156 I DEBUG : 4268cd74 4268ce04 [stack:6305]
11-09 21:47:38.899 156 156 I DEBUG : 4268cd78 41c73f74
11-09 21:47:38.899 156 156 I DEBUG : 4268cd7c 00000004
11-09 21:47:38.899 156 156 I DEBUG : 4268cd80 4022e809 /system/lib/libaudioflinger.so (non-virtual thunk to android::AudioFlinger::EffectHandle::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int))
11-09 21:47:38.899 156 156 I DEBUG : 4268cd84 4268cdd4 [stack:6305]
11-09 21:47:38.899 156 156 I DEBUG : 4268cd88 000000a1
11-09 21:47:38.899 156 156 I DEBUG : 4268cd8c 40319a6c
11-09 21:47:38.899 156 156 I DEBUG : 4268cd90 00000001
11-09 21:47:38.899 156 156 I DEBUG : 4268cd94 4042b393 /system/lib/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+62)
11-09 21:47:38.909 156 156 I DEBUG :
11-09 21:47:38.909 156 156 I DEBUG : memory near r4:
11-09 21:47:38.909 156 156 I DEBUG : 4268cd10 42445ac8 41cc53f0 df0027ad 00000000 .ZDB.S.A.'......
11-09 21:47:38.909 156 156 I DEBUG : 4268cd20 00000001 41c73f70 4268cd38 4023dbbb ....p?.A8.hB..#@
11-09 21:47:38.909 156 156 I DEBUG : 4268cd30 00000000 41f0a548 41c73f70 41c73b38 ....H..Ap?.A8;.A
11-09 21:47:38.909 156 156 I DEBUG : 4268cd40 00000000 41c73f70 4268ce04 4268cdd4 ....p?.A..hB..hB
11-09 21:47:38.909 156 156 I DEBUG : 4268cd50 00000004 400eb533 00000000 40430aa9 ....3..@......C@
11-09 21:47:38.909 156 156 I DEBUG :
11-09 21:47:38.909 156 156 I DEBUG : memory near r5:
11-09 21:47:38.919 156 156 I DEBUG : 4268cd18 df0027ad 00000000 00000001 41c73f70 .'..........p?.A
11-09 21:47:38.919 156 156 I DEBUG : 4268cd28 4268cd38 4023dbbb 00000000 41f0a548 8.hB..#@....H..A
11-09 21:47:38.919 156 156 I DEBUG : 4268cd38 41c73f70 41c73b38 00000000 41c73f70 p?.A8;.A....p?.A
11-09 21:47:38.919 156 156 I DEBUG : 4268cd48 4268ce04 4268cdd4 00000004 400eb533 ..hB..hB....3..@
11-09 21:47:38.919 156 156 I DEBUG : 4268cd58 00000000 40430aa9 4268cdd4 41cc2b20 ......C@..hB +.A
11-09 21:47:38.919 156 156 I DEBUG :
11-09 21:47:38.919 156 156 I DEBUG : memory near r6:
11-09 21:47:38.919 156 156 I DEBUG : 42445aa8 70696f76 616c665f 00003d67 00000013 voip_flag=......
11-09 21:47:38.919 156 156 I DEBUG : 42445ab8 70696f76 616c665f 00003d67 00000169 voip_flag=..i...
11-09 21:47:38.919 156 156 I DEBUG : 42445ac8 42445ac0 42445ac0 00000000 00000000 .ZDB.ZDB........
11-09 21:47:38.919 156 156 I DEBUG : 42445ad8 42445e88 00000000 41f0a468 41c62fb8 .^DB....h..A./.A
11-09 21:47:38.919 156 156 I DEBUG : 42445ae8 00002fdb 00002fd1 ec7178ec 4432e5e1 ./.../...xq...2D
11-09 21:47:38.919 156 156 I DEBUG :
11-09 21:47:38.919 156 156 I DEBUG : memory near r8:
11-09 21:47:38.919 156 156 I DEBUG : 4268cdb4 4042df17 00000010 4042da21 41cd6f98 ..B@....!.B@.o.A
11-09 21:47:38.919 156 156 I DEBUG : 4268cdc4 00000002 00000006 404aee57 41c73f74 ........W.J@t?.A
11-09 21:47:38.919 156 156 I DEBUG : 4268cdd4 00000000 40c990c0 00000034 00000034 .......@4...4...
11-09 21:47:38.919 156 156 I DEBUG : 4268cde4 00000034 40c990f4 00000000 00000000 4......@........
11-09 21:47:38.919 156 156 I DEBUG : 4268cdf4 00000000 00010001 4042da21 41cd6f98 ........!.B@.o.A
11-09 21:47:38.919 156 156 I DEBUG :
11-09 21:47:38.919 156 156 I DEBUG : memory near sl:
11-09 21:47:38.919 156 156 I DEBUG : 40319a4c 00000000 00000000 00000000 00000000 ................
11-09 21:47:38.919 156 156 I DEBUG : 40319a5c 00000000 00000000 00000000 00000000 ................
11-09 21:47:38.919 156 156 I DEBUG : 40319a6c 48e06d21 00000000 00000000 00000000 !m.H............
11-09 21:47:38.929 156 156 I DEBUG : 40319a7c 00000000 00000000 00000000 00000000 ................
11-09 21:47:38.929 156 156 I DEBUG : 40319a8c 00000000 00000000 00000000 00000000 ................
11-09 21:47:38.929 156 156 I DEBUG :
11-09 21:47:38.929 156 156 I DEBUG : memory near sp:
11-09 21:47:38.929 156 156 I DEBUG : 4268cd00 4268cd10 40233135 4268cd10 4023ad57 ..hB51#@..hBW.#@
11-09 21:47:38.929 156 156 I DEBUG : 4268cd10 42445ac8 41cc53f0 df0027ad 00000000 .ZDB.S.A.'......
11-09 21:47:38.929 156 156 I DEBUG : 4268cd20 00000001 41c73f70 4268cd38 4023dbbb ....p?.A8.hB..#@
11-09 21:47:38.929 156 156 I DEBUG : 4268cd30 00000000 41f0a548 41c73f70 41c73b38 ....H..Ap?.A8;.A
11-09 21:47:38.929 156 156 I DEBUG : 4268cd40 00000000 41c73f70 4268ce04 4268cdd4 ....p?.A..hB..hB
11-09 21:47:38.929 156 156 I DEBUG :
11-09 21:47:38.929 156 156 I DEBUG : code around pc:
11-09 21:47:38.929 156 156 I DEBUG : 40235208 81f0e8bd 00011b8e 00011136 00011b5c ........6...\...
11-09 21:47:38.929 156 156 I DEBUG : 40235218 000110db 0001104d 4604b538 60202000 ....M...8..F. `
11-09 21:47:38.929 156 156 I DEBUG : 40235228 460d680b 6848b133 f7f34621 b108ebd8 .h.F3.Hh!F......
11-09 21:47:38.929 156 156 I DEBUG : 40235238 60216829 bd384620 f100b573 46060410 )h!` F8.s......F
11-09 21:47:38.939 156 156 I DEBUG : 40235248 f7fa4620 f106fc2b 46680108 ffe4f7ff F..+.....hF....
11-09 21:47:38.939 156 156 I DEBUG :
11-09 21:47:38.939 156 156 I DEBUG : code around lr:
11-09 21:47:38.939 156 156 I DEBUG : 4023db98 b11b9b02 46299803 ecfef7ea 202cf894 ......)F......,
11-09 21:47:38.939 156 156 I DEBUG : 4023dba8 f894b19a b183302d 46686921 f7f73110 ....-0..!ihF.1..
11-09 21:47:38.939 156 156 I DEBUG : 4023dbb8 9800fb33 6923b130 0110f104 6a5b2200 3...0.#i....."[j
11-09 21:47:38.939 156 156 I DEBUG : 4023dbc8 ffb9f7ff f7f44668 6920ff56 f104b128 ....hF..V. i(...
11-09 21:47:38.939 156 156 I DEBUG : 4023dbd8 f7ea0110 2000ecbe 69a16120 6a20b319 ....... a.i.. j
11-09 21:47:39.299 2882 2895 W AudioEffect: IEffect died
11-09 21:47:39.299 602 13457 W IMediaDeathNotifier: media server died
11-09 21:47:39.299 422 627 W IMediaDeathNotifier: media server died
11-09 21:47:39.299 422 681 W AudioEffect: IEffect died
11-09 21:47:39.309 1175 2873 W IMediaDeathNotifier: media server died
11-09 21:47:39.309 422 681 W AudioEffects-JNI: EVENT_ERROR
11-09 21:47:39.309 2882 2895 W AudioEffects-JNI: EVENT_ERROR
11-09 21:47:39.309 422 627 W MediaMetadataRetriever: MediaMetadataRetriever server died!
11-09 21:47:39.309 6929 7416 W MediaMetadataRetriever: MediaMetadataRetriever server died!
1
11-09 21:47:39.329 7895 7906 W MediaMetadataRetriever: MediaMetadataRetriever server died!
11-09 21:47:39.339 422 676 W AudioSystem: AudioFlinger server died!
11-09 21:47:39.339 422 676 E AudioEffectService: binderDied : AudioFlinger is dead.
11-09 21:47:39.339 422 710 W AudioSystem: AudioPolicyService server died!
11-09 21:47:39.339 602 31905 W AudioSystem: AudioFlinger server died!
11-09 21:47:39.339 602 8752 W AudioSystem: AudioPolicyService server died!
11-09 21:47:39.349 1175 3802 W AudioSystem: AudioFlinger server died!
11-09 21:47:39.629 2882 2894 W AudioSystem: AudioFlinger server died!
[Analysis]
The translated StackTrace:
#00 pc 00038228 /system/lib/libaudioflinger.so
android::wp<android::AudioFlinger::EffectHandle>::promote() const
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/include/utils/RefBase.h:433
#01 pc 00040bb7 /system/lib/libaudioflinger.so
android::AudioFlinger::EffectHandle::disconnect(bool)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/av/services/audioflinger/AudioFlinger.cpp:9401
#02 pc 00053531 /system/lib/libmedia.so
android::BnEffect::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/av/media/libmedia/IEffect.cpp:184
#03 pc 00014391 /system/lib/libbinder.so
android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/libs/binder/Binder.cpp:108
#04 pc 00016f15 /system/lib/libbinder.so
android::IPCThreadState::executeCommand(int)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/libs/binder/IPCThreadState.cpp:1034
#05 pc 0001733d /system/lib/libbinder.so
android::IPCThreadState::joinThreadPool(bool)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/libs/binder/IPCThreadState.cpp:473
#06 pc 0001af55 /system/lib/libbinder.so
android::PoolThread::threadLoop()
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/libs/binder/ProcessState.cpp:67
#07 pc 00010e37 /system/lib/libutils.so
android::Thread::_threadLoop(void*)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/libs/utils/Threads.cpp:793
#08 pc 0001099d /system/lib/libutils.so
thread_data_t::trampoline(thread_data_t const*)
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/frameworks/native/libs/utils/Threads.cpp:132
#09 pc 00012df0 /system/lib/libc.so
__thread_entry
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/bionic/libc/bionic/pthread.c:217
#10 pc 00012548 /system/lib/libc.so
pthread_create
/opt/Weekly_Release/Integration/5855/LINUX_JB_userdebug_single/bionic/libc/bionic/pthread.c:356
The releated source code lists as follows.
It can be found that the crash occurs in DISCONNECT handling of BBinder.
129status_t BnEffect::onTransact(
130 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
131{
132 switch (code) {
133 case ENABLE: {
134 ALOGV("ENABLE");
135 CHECK_INTERFACE(IEffect, data, reply);
136 reply->writeInt32(enable());
137 return NO_ERROR;
138 } break;
139
140 case DISABLE: {
141 ALOGV("DISABLE");
142 CHECK_INTERFACE(IEffect, data, reply);
143 reply->writeInt32(disable());
144 return NO_ERROR;
145 } break;
146
147 case COMMAND: {
148 ALOGV("COMMAND");
149 CHECK_INTERFACE(IEffect, data, reply);
150 uint32_t cmdCode = data.readInt32();
151 uint32_t cmdSize = data.readInt32();
152 char *cmd = NULL;
153 if (cmdSize) {
154 cmd = (char *)malloc(cmdSize);
155 data.read(cmd, cmdSize);
156 }
157 uint32_t replySize = data.readInt32();
158 uint32_t replySz = replySize;
159 char *resp = NULL;
160 if (replySize) {
161 resp = (char *)malloc(replySize);
162 }
163 status_t status = command(cmdCode, cmdSize, cmd, &replySz, resp);
164 reply->writeInt32(status);
165 if (replySz < replySize) {
166 replySize = replySz;
167 }
168 reply->writeInt32(replySize);
169 if (replySize) {
170 reply->write(resp, replySize);
171 }
172 if (cmd) {
173 free(cmd);
174 }
175 if (resp) {
176 free(resp);
177 }
178 return NO_ERROR;
179 } break;
180
181 case DISCONNECT: {
182 ALOGV("DISCONNECT");
183 CHECK_INTERFACE(IEffect, data, reply);
184 disconnect(); ********************
185 return NO_ERROR;
186 } break;
187
188 case GET_CBLK: {
189 CHECK_INTERFACE(IEffect, data, reply);
190 reply->writeStrongBinder(getCblk()->asBinder());
191 return NO_ERROR;
192 } break;
193
194 default:
195 return BBinder::onTransact(code, data, reply, flags);
196 }
197}
In frameworks/av/services/audioflinger/AudioFlinger.cpp
9387void AudioFlinger::EffectHandle::disconnect()
9388{
9389 disconnect(true);
9390}
9391
9392void AudioFlinger::EffectHandle::disconnect(bool unpinIfLast)
9393{
9394 ALOGV("disconnect(%s)", unpinIfLast ? "true" : "false");
9395 if (mEffect == 0) {
9396 return;
9397 }
9398 mEffect->disconnect(this, unpinIfLast);
9399
9400 if (mHasControl && mEnabled) {
9401 sp<ThreadBase> thread = mEffect->thread().promote(); *******crash occurs in*****
9402 if (thread != 0) {
9403 thread->checkSuspendOnEffectEnabled(mEffect, false, mEffect->sessionId());
9404 }
9405 }
9406
9407 // release sp on module => module destructor can be called now
9408 mEffect.clear();
9409 if (mClient != 0) {
9410 if (mCblk != NULL) {
9411 // unlike ~TrackBase(), mCblk is never a local new, so don't delete
9412 mCblk->~effect_param_cblk_t(); // destroy our shared-structure.
9413 }
9414 mCblkMemory.clear(); // free the shared memory before releasing the heap it belongs to
9415 // Client destructor must run with AudioFlinger mutex locked
9416 Mutex::Autolock _l(mClient->audioFlinger()->mLock);
9417 mClient.clear();
9418 }
9419}
429template<typename T>
430sp<T> wp<T>::promote() const
431{
432 sp<T> result;
433 if (m_ptr && m_refs->attemptIncStrong(&result)) { ****** crash occurs here ******
434 result.set_pointer(m_ptr);
435 }
436 return result;
437}
In wp<T>.promote(), we can know the SIGSEGV gives out at line #433, but we can't position precisely where the signal gives out.
So, dump the assemble code.
Dump of assembler code for function android::wp<android::AudioFlinger::ThreadBase>::promote() const:
0x00038220 <+0>: push {r3, r4, r5, lr}
0x00038222 <+2>: mov r4, r0 r0 points to the returned sp<ThreadBase>, local result variable is optimized out.
0x00038224 <+4>: movs r0, #0
0x00038226 <+6>: str r0, [r4, #0] assign result.m_ptr with NULL;
0x00038228 <+8>: ldr r3, [r1, #0] evaluate this.m_ptr, !!crash here!!
0x0003822a <+10>: mov r5, r1
0x0003822c <+12>: cbz r3, 0x3823c <android::wp<android::AudioFlinger::ThreadBase>::promote() const+28>
0x0003822e <+14>: ldr r0, [r1, #4]
0x00038230 <+16>: mov r1, r4
0x00038232 <+18>: blx 0x2b9e4
0x00038236 <+22>: cbz r0, 0x3823c <android::wp<android::AudioFlinger::ThreadBase>::promote() const+28>
0x00038238 <+24>: ldr r1, [r5, #0]
0x0003823a <+26>: str r1, [r4, #0] assign result.m_ptr with this.m_ptr
0x0003823c <+28>: mov r0, r4
0x0003823e <+30>: pop {r3, r4, r5, pc}
End of assembler dump.
From the code, the SIGSEGV crash occurs when the m_ptr of wp<ThreadBase> is to be evaluated in if block.
m_ptr is at the offset of 0x00 of wp<ThreadBase>, so, the 'this' pointer points to the wp<ThreadBase> object is wild pointer with value 0x10.
According to definitions of class EffectModule and class EffectHandle,
1545 class EffectModule: public RefBase { @ AudioFlinger.h
1546 public:
.......
1595 const wp<ThreadBase>& thread() { return mThread; } ***************
.......
1621 bool mPinned;
.......
1632mutable Mutex mLock; // mutex for process, commands and handles list protection
1633 wp<ThreadBase> mThread; // parent thread ***************
1634 wp<EffectChain> mChain; // parent effect chain
.......
1648 };
1656 class EffectHandle: public android::BnEffect { @ AudioFlinger.h
.........
1703 protected:
1704 friend class AudioFlinger; // for mEffect, mHasControl, mEnabled
1705 EffectHandle(const EffectHandle&);
1706 EffectHandle& operator =(const EffectHandle&);
1707
1708 sp<EffectModule> mEffect; // pointer to controlled EffectModule
1709 sp<IEffectClient> mEffectClient; // callback interface for client notifications
1710 /*const*/ sp<Client> mClient; // client for shared memory allocation, see disconnect()
1711 sp<IMemory> mCblkMemory; // shared memory for control block
1712 effect_param_cblk_t* mCblk; // control block for deferred parameter setting via shared memory
1713 uint8_t* mBuffer; // pointer to parameter area in shared memory
1714 int mPriority; // client application priority to control the effect
1715 bool mHasControl; // true if this handle is controlling the effect
1716 bool mEnabled; // cached enable state: needed when the effect is
1717 // restored after being suspended
1718 };
The mEffect is sp<EffectModule> type.
EffectModule::thread() returns class EffectModule's mThread field which is at offset 0x10 of EffectModule.
So the mEffect.m_ptr is NULL, that is to say that object EffectHandle::mEffect has been cleared.
Notice some Effect object is released before the crash occurs.
-----------------------------------------------------------------------------------------------------------------------------------------------------
From the EffectModule object address and mId value printed in the log, part of the original EffectModule object may be re-drawn.
11-09 21:47:37.879 161 6305 W AudioFlinger: removeEffect_l() 0x41cc53f0--(ThreadBase*) cannot promote chain foreffect 0x42445ac8(EffectModule*)
11-09 21:47:37.879 161 6305 W AudioPolicyManagerBase: unregisterEffect() unknowneffect ID 12251 (0x2fdb)
11-09 21:47:37.879 161 6305 V VPT20 : EffectRelease 0x433fedf0 (effect_handle_t mEffectInterface of EffecModule)
11-09 21:47:38.919 156 156 I DEBUG : memory near r6:
11-09 21:47:38.919 156 156 I DEBUG : 42445aa8 70696f76 616c665f 00003d67 00000013 voip_flag=......
11-09 21:47:38.919 156 156 I DEBUG : 42445ab8 70696f76 616c665f 00003d67 00000169 voip_flag=..i...
42445ac8 42445ac0 vtbl ?? may memory has been reused?
42445acc 42445ac0 RefBase::mRefs ?? may memory has been reused?
42445ad0 00000000 mPinned
42445ad4 00000000 mLock
42445ad8 42445e88 00000000 wp<ThreadBase> {m_ptr, m_refs}
42445ae0 41f0a468 41c62fb8 wp<EffectChain> {m_ptr, m_refs}
42445ae8 00002fdb mId
42445aec 00002fd1 mSessionId
42445af0 ec7178ec 4432e5e1 mDescriptor {......}
8686void AudioFlinger::EffectModule::disconnect(const wp<EffectHandle>& handle, bool unpinIfLast)
8687{
8688 ALOGV("disconnect() %p handle %p", this, handle.unsafe_get());
8689 // keep a strong reference on this EffectModule to avoid calling the
8690 // destructor before we exit
8691 sp<EffectModule> keep(this);
8692 {
8693 sp<ThreadBase> thread = mThread.promote();
8694 if (thread != 0) {
8695 thread->disconnectEffect(keep, handle, unpinIfLast); ==calls==>>
8696 }
8697 }
8698}
8364void AudioFlinger::ThreadBase::disconnectEffect(const sp<EffectModule>& effect,
8365 const wp<EffectHandle>& handle,
8366 bool unpinIfLast) {
8367
8368 Mutex::Autolock _l(mLock);
8369 ALOGV("disconnectEffect() %p effect %p", this, effect.get());
8370 // delete the effect module if removing last handle on it
8371 if (effect->removeHandle(handle) == 0) {
8372 if (!effect->isPinned() || unpinIfLast) {
8373 removeEffect_l(effect); ===>>
8374 AudioSystem::unregisterEffect(effect->id()); ------ printed out
8375 }
8376 }
8377}
In AudioFlinger::EffectModule::disconnect(const wp<EffectHandle>& handle, bool unpinIfLast), AudioFlinger::ThreadBase::disconnectEffect is called.
AudioFlinger::ThreadBase::disconnectEffect in turn calls removeEffect_l and AudioSystem::unregisterEffect(..).
From the log,
AudioFlinger::ThreadBase::removeEffect_l claims that W AudioFlinger: removeEffect_l() 0x41cc53f0 cannot promote chain for effect 0x42445ac8,
AudioSystem::unregisterEffect(..) claims that AudioPolicyManagerBase: unregisterEffect() unknown effect ID 12251.
This gives us a light that the EffectModule maybe has been destroyed.
8641size_t AudioFlinger::EffectModule::removeHandle(const wp<EffectHandle>& handle)
8642{
8643 Mutex::Autolock _l(mLock);
8644 size_t size = mHandles.size();
8645 size_t i;
8646 for (i = 0; i < size; i++) {
8647 if (mHandles[i] == handle) break;
8648 }
8649 if (i == size) {
8650 return size;
8651 }
8652 ALOGV("removeHandle() %p removed handle %p in position %d", this, handle.unsafe_get(), i);
8653
8654 bool enabled = false;
8655 EffectHandle *hdl = handle.unsafe_get();
8656 if (hdl != NULL) {
8657 ALOGV("removeHandle() unsafe_get OK");
8658 enabled = hdl->enabled();
8659 }
8660 mHandles.removeAt(i);
8661 size = mHandles.size();
8662 // if removed from first place, move effect control from this handle to next in line
8663 if (i == 0 && size != 0) {
8664 sp<EffectHandle> h = mHandles[0].promote();
8665 if (h != 0) {
8666 h->setControl(true /*hasControl*/, true /*signal*/ , enabled /*enabled*/);
8667 }
8668 }
8669
8670 // Prevent calls to process() and other functions on effect interface from now on.
8671 // The effect engine will be released by the destructor when the last strong reference on
8672 // this object is released which can happen after next process is called.
8673 if (size == 0 && !mPinned) {
8674 mState = DESTROYED;
8675 }
8676
8677 return size;
8678}
For line #8664, is it safe for EffectHandle[0] if it is EffectModule's wrpper EffectHandle?? can this case be existed??
Though it maybe cause the EffectHandle destroyed, but EffectHandle::mEffect.m_ptr can't be NULL.
Except m_ptr is re-filled with zeros, it is most possible that mEffect.clear() is called.
8302void AudioFlinger::ThreadBase::removeEffect_l(const sp<EffectModule>& effect) {
8303
8304 ALOGV("removeEffect_l() %p effect %p", this, effect.get());
8305 effect_descriptor_t desc = effect->desc();
8306 if ((desc.flags & EFFECT_FLAG_TYPE_MASK) == EFFECT_FLAG_TYPE_AUXILIARY) {
8307 detachAuxEffect_l(effect->id());
8308 }
8309
8310 sp<EffectChain> chain = effect->chain().promote();
8311 if (chain != 0) {
8312 // remove effect chain if removing last effect
8313 if (chain->removeEffect_l(effect) == 0) {
8314 removeEffectChain_l(chain);
8315 }
8316 } else {
8317 ALOGW("removeEffect_l() %p cannot promote chain for effect %p", this, effect.get()); ********claims*****
8318 }
8319}
949status_t AudioPolicyManagerBase::unregisterEffect(int id)
950{
951 ssize_t index = mEffects.indexOfKey(id); ******** has been removed already **********
952 if (index < 0) {
953 LOGW("unregisterEffect() unknown effect ID %d", id); *****************claims******************
954 return INVALID_OPERATION;
955 }
956
957 EffectDescriptor *pDesc = mEffects.valueAt(index);
958
959 setEffectEnabled(pDesc, false);
960
961 if (mTotalEffectsMemory < pDesc->mDesc.memoryUsage) {
962 LOGW("unregisterEffect() memory %d too big for total %d",
963 pDesc->mDesc.memoryUsage, mTotalEffectsMemory);
964 pDesc->mDesc.memoryUsage = mTotalEffectsMemory;
965 }
966 mTotalEffectsMemory -= pDesc->mDesc.memoryUsage;
967 LOGV("unregisterEffect() effect %s, ID %d, memory %d total memory %d",
968 pDesc->mDesc.name, id, pDesc->mDesc.memoryUsage, mTotalEffectsMemory);
969
970 mEffects.removeItem(id);
971 delete pDesc;
972
973 return NO_ERROR;
974}
-------------------------------------------------------------------------------------------------------------------------------------------
From the log of above two functions print out, we can image that the EffectModule object is destroyed before those two functions called.
From the following log lines which is output by EffectRelease(), it is certain that the EffectModule is destroyed.
11-09 21:47:37.879 161 6305 V VPT20 : EffectRelease 0x433fedf0
11-09 21:47:37.879 161 6305 V VPT20 : Vpt_release start
11-09 21:47:37.879 161 6305 V VPT20 : EmptyDataProc start
11-09 21:47:37.879 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_EventBufferFlag
11-09 21:47:37.889 161 3294 E VPT20 : FillBuffer is no data
11-09 21:47:37.889 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_EventBufferFlag
11-09 21:47:37.889 161 3294 E VPT20 : FillBuffer is no data
11-09 21:47:37.889 161 6305 V VPT20 : EmptyDataProc end
11-09 21:47:37.889 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_CommandStateSet State:2
11-09 21:47:37.889 161 6305 V VPT20 : FreeBuffer start
11-09 21:47:37.889 161 6305 V VPT20 : FreeBuffer end
11-09 21:47:37.889 161 3294 V VPT20 : Vpt_cb_EventHandler OMX_CommandStateSet State:1
11-09 21:47:37.889 161 6305 V VPT20 : Vpt_release end
11-09 21:47:37.889 161 6305 V VPT20 : EffectRelease end
8591AudioFlinger::EffectModule::~EffectModule()
8592{
8593 ALOGV("Destructor %p", this);
8594 if (mEffectInterface != NULL) {
8595 if ((mDescriptor.flags & EFFECT_FLAG_TYPE_MASK) == EFFECT_FLAG_TYPE_PRE_PROC ||
8596 (mDescriptor.flags & EFFECT_FLAG_TYPE_MASK) == EFFECT_FLAG_TYPE_POST_PROC) {
8597 sp<ThreadBase> thread = mThread.promote();
8598 if (thread != 0) {
8599 audio_stream_t *stream = thread->stream();
8600 if (stream != NULL) {
8601 stream->remove_audio_effect(stream, mEffectInterface);
8602 }
8603 }
8604 }
8605 // release effect engine
8606 EffectRelease(mEffectInterface); ************
8607 }
8608}
It can be judged primarily as a race condition and thread sync issue.
EffectModule object is accessed via sp<EffectModule>, it should not destroyed abnormally.
So, the most case maybe EffectModule is destroyed explicitly via sp<T>.clear(), which decStrong reference and set sp<T>.m_ptr with NULL.
Find where mEffect.clear() is called besides AudioFlinger::EffectModule::~EffectModule() in AudioFlinger.cpp,
7699void AudioFlinger::purgeStaleEffects_l() {
7700
7701 ALOGV("purging stale effects");
7702
7721
7722 for (size_t i = 0; i < chains.size(); i++) {
7723 sp<EffectChain> ec = chains[i];
7724 int sessionid = ec->sessionId();
7725 sp<ThreadBase> t = ec->mThread.promote();
7726 if (t == 0) {
7727 continue;
7728 }
7740 if (!found) {
7741 // remove all effects from the chain
7742 while (ec->mEffects.size()) {
7743 sp<EffectModule> effect = ec->mEffects[0];
7744 effect->unPin();
7745 Mutex::Autolock _l (t->mLock);
7746 t->removeEffect_l(effect);
7747 for (size_t j = 0; j < effect->mHandles.size(); j++) {
7748 sp<EffectHandle> handle = effect->mHandles[j].promote();
7749 if (handle != 0) {
7750 handle->mEffect.clear(); // *** Reference solution: should be Mutex::Autolock(..) here *******
7751 if (handle->mHasControl && handle->mEnabled) {
7752 t->checkSuspendOnEffectEnabled_l(effect, false, effect->sessionId());
7753 }
7754 }
7755 }
7756 AudioSystem::unregisterEffect(effect->id());
7757 }
7758 }
7759 }
7760 return;
7761}
9944void AudioFlinger::EffectChain::setEffectSuspended_l(
9945 const effect_uuid_t *type, bool suspend)
9946{
9947 sp<SuspendedEffectDesc> desc;
9948 // use effect type UUID timelow as key as there is no real risk of identical
9949 // timeLow fields among effect type UUIDs.
9950 ssize_t index = mSuspendedEffects.indexOfKey(type->timeLow);
9951 if (suspend) {
9968 } else {
9969 if (index < 0) {
9970 return;
9971 }
9972 desc = mSuspendedEffects.valueAt(index);
9973 if (desc->mRefCount <= 0) {
9974 ALOGW("setEffectSuspended_l() restore refcount should not be 0 %d", desc->mRefCount);
9975 desc->mRefCount = 1;
9976 }
9977 if (--desc->mRefCount == 0) {
9978 ALOGV("setEffectSuspended_l() remove entry for %08x", mSuspendedEffects.keyAt(index));
9979 if (desc->mEffect != 0) {
9980 sp<EffectModule> effect = desc->mEffect.promote();
9981 if (effect != 0) {
9982 effect->setSuspended(false);
9983 sp<EffectHandle> handle = effect->controlHandle();
9984 if (handle != 0) {
9985 effect->setEnabled(handle->enabled());
9986 }
9987 }
9988 desc->mEffect.clear();
9989 }
9990 mSuspendedEffects.removeItemsAt(index);
9991 }
9992 }
9993}
10089void AudioFlinger::EffectChain::checkSuspendOnEffectEnabled(const sp<EffectModule>& effect,
10090 bool enabled)
10091{
10092 ssize_t index = mSuspendedEffects.indexOfKey(effect->desc().type.timeLow);
10093 if (enabled) {
10094 if (index < 0) {
10095 // if the effect is not suspend check if all effects are suspended
10112 sp<SuspendedEffectDesc> desc = mSuspendedEffects.valueAt(index);
10113 // if effect is requested to suspended but was not yet enabled, supend it now.
10114 if (desc->mEffect == 0) {
10115 desc->mEffect = effect;
10116 effect->setEnabled(false);
10117 effect->setSuspended(true);
10118 }
10119 } else {
10120 if (index < 0) {
10121 return;
10122 }
10123 ALOGV("checkSuspendOnEffectEnabled() disable restoring fx %08x",
10124 effect->desc().type.timeLow);
10125 sp<SuspendedEffectDesc> desc = mSuspendedEffects.valueAt(index);
10126 desc->mEffect.clear();
10127 effect->setSuspended(false);
10128 }
10129}
So, the app should be well thread synced based on the thread model.
With the help from audio framework dept, find that purgeStaleEffects_l() called in releaseAudioSession is called in another thread that not well synchronized with the crash thread.
More, maybe it should be considered to prevent the whole EffectHandle's from being destroyed.
And notice the wp<T>'s life cycle, remember in mind that sp<T>'s destroy may cause T t's destroy.
Use wp<T>.promote() to try to get sp<T> everytime.
- A more complicated thread sync issue about audioFlinger::EffectModule
- A common thread sync issue analysis of android application
- bug Report about a tomcat issue
- A. Complicated GCD
- 664A - Complicated GCD
- About encoding issue one
- CodeForces 664A Complicated GCD
- CodeForces 664A Complicated GCD
- A good document about android thread, Handler, Asyntask
- an issue about source update
- Gradle sync failed: Plugin is too old, please update to a more recent version
- More about Comparator
- know more about sementic
- Something more about ClassLoader
- Know more about checkpoint
- More about Vector
- more about AngularJS
- 【4】More About Triggers
- 多线程编程笔记（五）
- Linux可执行文件的启动及命令行参数和环境变量的传递
- ASP.NET常用信息保持状态学习笔记一
- File Lists作为数据源
- I. The Basics---Chapter 2----Fragment Position Display
- A more complicated thread sync issue about audioFlinger::EffectModule
- 在android上安装sqlite3工具
- 受益匪浅啊今天
- I. The Basics---Chapter 2----Vertex Attributes
- Shell正则表达式
- Linux下基于C的简单终端聊天程序
- android 电容屏（二）：驱动调试之基本概念篇
- MFC操作ini文件方法
- 使用消息队列实现两进程间实时通信的例子
