v1.0.3 Fatal signal 11 (SIGSEGV)

[greenrift]

trafficstars

Related to: https://github.com/wseemann/FFmpegMediaPlayer/issues/29

I'm using version 1.0.3 in a project via Gradle dependency. I noticed that if I change streams quickly (ie: stop one, and start another), I get a fairly predictable "Fatal signal 11 (SIGSEGV), code 1, fault addr 0xfffffffd in tid 5601" crash.

I can reporuce this in the demo APK provided in this repo and used the AAC stream: http://ice2.somafm.com/groovesalad-64-aac

Tap on "Go" a few times and the crash will occur again. It seems like the "stop" or "release" methods are causing the crash. Sometimes the SIGSEGV is preceded with something similar to "invalid address or address of corrupt block 0xab8db6c0 passed to dlfree"

[nithi2023]

Any Update?

[tested0002]

I have the same issue when switching streams more often.

[branemk]

Same issue when switching streams more often.

[facundomedica]

Same issue here, is there any way to debug it?

[simonsiu2017]

same issue here

[RushiMThakker]

same here.please give a quick solution

[rafiip]

same here . i will appreciate if u provide us with a fix

[adelinolobao]

same here, anyone manage to fix it?

[nikacotAndroid]

Any updates for this one?

[wseemann]

Can someone provide an actual log or stacktrace of the crash rather than posting pointless "+1's" and "me toos"?

[greenrift]

@wseemann Not sure if this will help, but here is a recent crash log:

F/libc ( 1248): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x8 in tid 1985 (Thread-662) I/DEBUG ( 1139): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** I/DEBUG ( 1139): Build fingerprint: 'generic_x86/sdk_google_atv_x86/generic_x86:5.1.1/LMY48X/2916408:userdebug/test-keys' I/DEBUG ( 1139): Revision: '0' I/DEBUG ( 1139): ABI: 'x86' I/DEBUG ( 1139): pid: 1248, tid: 1985, name: Thread-662 >>> myapp.com <<< I/DEBUG ( 1139): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8 I/DEBUG ( 1139): eax 00000000 ebx aea4be6c ecx 000f4240 edx 00720065 I/DEBUG ( 1139): esi 00690056 edi 00000000 I/DEBUG ( 1139): xcs 00000073 xds 0000007b xes 0000007b xfs 00000097 xss 0000007b I/DEBUG ( 1139): eip aea42f0d ebp a36b77b0 esp a1704c20 flags 00210246 I/DEBUG ( 1139): I/DEBUG ( 1139): backtrace: I/DEBUG ( 1139): #00 pc 00006f0d /data/app/myapp.com-2/lib/x86/libffmpeg_mediaplayer_jni.so (get_audio_clock+29) I/DEBUG ( 1139): #01 pc 00007024 /data/app/myapp.com-2/lib/x86/libffmpeg_mediaplayer_jni.so (get_master_clock+52) I/DEBUG ( 1139): #02 pc 00008875 /data/app/myapp.com-2/lib/x86/libffmpeg_mediaplayer_jni.so (video_refresh_timer+453) I/DEBUG ( 1139): #03 pc 0000894b /data/app/myapp.com-2/lib/x86/libffmpeg_mediaplayer_jni.so I/DEBUG ( 1139): #04 pc 000932a7 /data/app/myapp.com-2/lib/x86/libSDL2.so I/DEBUG ( 1139): #05 pc 000921cb /data/app/myapp.com-2/lib/x86/libSDL2.so (SDL_RunThread+75) I/DEBUG ( 1139): #06 pc 00092d40 /data/app/myapp.com-2/lib/x86/libSDL2.so I/DEBUG ( 1139): #07 pc 000211a8 /system/lib/libc.so (__pthread_start(void*)+56) I/DEBUG ( 1139): #08 pc 0001c529 /system/lib/libc.so (__start_thread+25) I/DEBUG ( 1139): #09 pc 000130f6 /system/lib/libc.so (__bionic_clone+70)

[greenrift]

@wseemann One more....

V/CrashDescriptorUtil( 1820): extractNativeCrashFromBody inputTrace=*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** V/CrashDescriptorUtil( 1820): Build fingerprint: 'Amazon/bueller/bueller:5.1.1/LVY48F/51.5.5.1_user_551203220:user/release-keys' V/CrashDescriptorUtil( 1820): Revision: '3' V/CrashDescriptorUtil( 1820): ABI: 'arm' V/CrashDescriptorUtil( 1820): pid: 4302, tid: 4477, oom: 0, name: Thread-6934 >>> tv.somafm.com.somafm <<< V/CrashDescriptorUtil( 1820): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x9cc757b8 V/CrashDescriptorUtil( 1820): r0 9cc2f020 r1 9cc2f020 r2 00000000 r3 9fd72021 V/CrashDescriptorUtil( 1820): r4 9cc75020 r5 9cc2f020 r6 00000000 r7 00000000 V/CrashDescriptorUtil( 1820): r8 00000001 r9 00000000 sl 000024e9 fp 00000000 V/CrashDescriptorUtil( 1820): ip 1ac2c0d4 sp 9cc2ed40 lr 9fd72029 pc 9fd71e4c cpsr 600e0030 V/CrashDescriptorUtil( 1820): d0 0000000000000000 d1 0000000000000000 V/CrashDescriptorUtil( 1820): d2 0000000000000000 d3 0000000000000000 V/CrashDescriptorUtil( 1820): d4 702cde40702cde40 d5 702cde40702cde40 V/CrashDescriptorUtil( 1820): d6 702cde40702cde40 d7 702cde40702cde40 V/CrashDescriptorUtil( 1820): d8 0000000000000000 d9 0000000000000000 V/CrashDescriptorUtil( 1820): d10 0000000000000000 d11 0000000000000000 V/CrashDescriptorUtil( 1820): d12 0000000000000000 d13 0000000000000000 V/CrashDescriptorUtil( 1820): d14 0000000000000000 d15 0000000000000000 V/CrashDescriptorUtil( 1820): d16 b75b9990b75b9990 d17 0000000500000000 V/CrashDescriptorUtil( 1820): d18 12c61e4012c8ecf0 d19 0000000000000000 V/CrashDescriptorUtil( 1820): d20 708ed35000000000 d21 12c8ed0000000000 V/CrashDescriptorUtil( 1820): d22 0000000012c27600 d23 000010ce0000006c V/CrashDescriptorUtil( 1820): d24 702cde40702cde40 d25 702cde40702cde40 V/CrashDescriptorUtil( 1820): d26 702cde40702cde40 d27 702cde40702cde40 V/CrashDescriptorUtil( 1820): d28 702cde40702cde40 d29 702cde40702cde40 V/CrashDescriptorUtil( 1820): d30 702cde40702cde40 d31 702cde40702cde40 V/CrashDescriptorUtil( 1820): scr 80000013 V/CrashDescriptorUtil( 1820): V/CrashDescriptorUtil( 1820): backtrace: V/CrashDescriptorUtil( 1820): #00 pc 00006e4c /data/app/myapp.com-1/lib/arm/libffmpeg_mediaplayer_jni.so (video_refresh_timer+11) V/CrashDescriptorUtil( 1820): #01 pc 00007025 /data/app/myapp.com-1/lib/arm/libffmpeg_mediaplayer_jni.so V/CrashDescriptorUtil( 1820): #02 pc 00059539 /data/app/myapp.com-1/lib/arm/libSDL2.so V/CrashDescriptorUtil( 1820): #03 pc 00058d15 /data/app/myapp.com-1/lib/arm/libSDL2.so (SDL_RunThread+32) V/CrashDescriptorUtil( 1820): #04 pc 00059283 /data/app/myapp.com-1/lib/arm/libSDL2.so V/CrashDescriptorUtil( 1820): #05 pc 000165cb /system/lib/libc.so (_ZL15__pthread_startPv+30) V/CrashDescriptorUtil( 1820): #06 pc 000145eb /system/lib/libc.so (__start_thread+6) V/CrashDescriptorUtil( 1820): V/CrashDescriptorUtil( 1820): stack: V/CrashDescriptorUtil( 1820): 9cc2ed00 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed04 b6def263 /system/lib/libc.so (pthread_mutex_unlock+118) V/CrashDescriptorUtil( 1820): 9cc2ed08 00000001
V/CrashDescriptorUtil( 1820): 9cc2ed0c 0000009a
V/CrashDescriptorUtil( 1820): 9cc2ed10 b758cb40 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed14 00000003
V/CrashDescriptorUtil( 1820): 9cc2ed18 9fd72021 /data/app/myapp.com-1/lib/arm/libffmpeg_mediaplayer_jni.so V/CrashDescriptorUtil( 1820): 9cc2ed1c b6e0357b /system/lib/libc.so (dlmalloc_real+3494) V/CrashDescriptorUtil( 1820): 9cc2ed20 b6e30000 /system/lib/libc.so V/CrashDescriptorUtil( 1820): 9cc2ed24 b71dd5b0 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed28 b745f140 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed2c 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed30 b71dd5b0 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed34 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed38 000f4240
V/CrashDescriptorUtil( 1820): 9cc2ed3c 00000000
V/CrashDescriptorUtil( 1820): #00 9cc2ed40 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed44 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed48 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed4c 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed50 9fd72021 /data/app/myapp.com-1/lib/arm/libffmpeg_mediaplayer_jni.so V/CrashDescriptorUtil( 1820): 9cc2ed54 b746fd40 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed58 9da48090
V/CrashDescriptorUtil( 1820): 9cc2ed5c 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed60 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed64 9fd72029 /data/app/myapp.com-1/lib/arm/libffmpeg_mediaplayer_jni.so V/CrashDescriptorUtil( 1820): #01 9cc2ed68 9fd72021 /data/app/myapp.com-1/lib/arm/libffmpeg_mediaplayer_jni.so V/CrashDescriptorUtil( 1820): 9cc2ed6c 9d9e453b /data/app/myapp.com-1/lib/arm/libSDL2.so V/CrashDescriptorUtil( 1820): #02 9cc2ed70 00000000
V/CrashDescriptorUtil( 1820): 9cc2ed74 b71e1d10 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed78 b739f788 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed7c 9d9e4495 /data/app/myapp.com-1/lib/arm/libSDL2.so V/CrashDescriptorUtil( 1820): 9cc2ed80 9da48090
V/CrashDescriptorUtil( 1820): 9cc2ed84 b736ad38 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed88 b736ad38 [heap] V/CrashDescriptorUtil( 1820): 9cc2ed8c b6dee5ad /system/lib/libc.so (_ZL15__pthread_startPv) V/CrashDescriptorUtil( 1820): 9cc2ed90 9cc2edd0 [stack:4477] V/CrashDescriptorUtil( 1820): 9cc2ed94 9d9e3d17 /data/app/myapp.com-1/lib/arm/libSDL2.so (SDL_RunThread+34) V/CrashDescriptorUtil( 1820): #03 9cc2ed98 9d9e4279 /data/app/myapp.com-1/lib/arm/libSDL2.so V/CrashDescriptorUtil( 1820): 9cc2ed9c b739f788 [heap] V/CrashDescriptorUtil( 1820): 9cc2eda0 b736ad70 [heap] V/CrashDescriptorUtil( 1820): 9cc2eda4 b736ad30 [heap] V/CrashDescriptorUtil( 1820): 9cc2eda8 00000078
V/CrashDescriptorUtil( 1820): 9cc2edac 9d9e4287 /data/app/myapp.com-1/lib

[wseemann]

This issue should be fixed in the newest version (v1.0.4).

[adelinolobao]

Hi @wseemann

I tried to run the newest version v1.0.4 and I'm still getting this issue with Fatal signal 11.

I attached the stack trace with all the logs. For me the issue happens when I call the FFmpegMediaPlayer.reset() method as you can see in the logs.

backtrace_logs.txt

If you need anything else just let me know

[harryio]

@wseemann Getting same error on v1.0.4 when I'm trying to switch between different data sources. I tried to create a new instance for every new data source but that didn't helped with the issue either.

[YouKim]

@wseemann I think buffer should be initialized to NULL after AudioPlayer is allocated or AudioPlayer should be allocated using calloc.

    AudioPlayer *player = malloc(sizeof(AudioPlayer));
    player->buffer = 0; // OR NULL

Otherwise, buffer has random address which should not be freed. Got clue from backtrace_logs.txt attached by adelinolobao. Thx

[irmanfauzi]

I'm using 1.0.4. Error occurs when .stop() or .reset() is called.

[NineToeNerd]

I'm on version 1.0.4, same issue if .stop() or .reset() is called.

The code where it is happening:

if (mediaPlayer.isPlaying()) {
    mediaPlayer.stop();
    mediaPlayer.reset();
}

(When I replace mediaPlayer.stop() with mediaPlayer.pause() it doesn't crash until the next line -- mediaPlayer.reset(). If I replace reset() with release() it still crashes.)

This is all I get in my logs:

A/libc: invalid address or address of corrupt block 0xb987bae8 passed to dlfree
A/libc: Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1), thread 4232 (iogospel.tablet)

For me it has only happened on some of the emulators I have tested my app on. The other devices I tested on have had no issues when calling these functions. Out of the devices I tested, I've listed below which ones had issues and which ones did not.

Emulators giving errors: Pixel C API 19, Nexus 7 API 19, Nexus 10 API 19

Devices with no errors: Samsung Galaxy S5 & S7

Emulators with no errors: Nexus 5 API 19, Pixel C API 24, Pixel C API 22

One thing I noticed was the Pixel C emulator does not have a crash unless I choose a lower API level. This could be true for other emulators, as well.

[davidengler]

Same as @NineToeNerd (Samsung Galaxy S7 Android 8.0)