Dear Linphone developers,
Recently I found a crash only on the specific device. Although I think the device's customised Android has indeed some problem, I believe Linphone Android app should not crash.
Steps to replicate:
1. Make a SIP call in Linphone.
2. Making or receiving a GSM call. The SIP call will be automatically put on hold.
3. Hangup the GSM call. Go back to Linphone.
4. Resume the SIP call, and hangup.
5. Crash when hangup.
Commit used to test:
3fe5f7c3cd15cdc0a57cfb2e6b2d305a61b4bcfc
Details:
The customised Android seems to take away the audio control immediately after receiving or making a GSM call, then in Linphone's log, we can see
02-15 11:54:55.779 30358-4080/org.linphone W/AudioRecord: dead IAudioRecord, creating a new one from obtainBuffer()
02-15 11:54:56.187 30358-4080/org.linphone E/AudioRecord: Could not get audio input for record source 7, sample rate 16000, format 0x1, channel mask 0x10, session 4515, flags 0
02-15 11:54:56.187 30358-4080/org.linphone W/AudioRecord: restoreRecord_l() failed status -22
02-15 11:54:56.187 30358-4080/org.linphone E/AudioRecord-JNI: Error -22 during AudioRecord native read
Then Linphone receives the PHONE_STATE change broadcast, and pause the call. After hangup the GSM call, go back to Linphone, and resume the call, the call does not have audio. The related Linphone logs are
02-15 11:55:11.821 30358-30358/org.linphone E/AudioRecord: Could not get audio input for record source 7, sample rate 16000, format 0x1, channel mask 0x10, session 4533, flags 0
02-15 11:55:11.821 30358-30358/org.linphone E/AudioRecord-JNI: Error creating AudioRecord instance: initialization check failed with status -22.
02-15 11:55:11.821 30358-30358/org.linphone E/android.media.AudioRecord: Error code -20 when initializing native AudioRecord object.
02-15 11:55:11.821 30358-30358/org.linphone E/Linphone: AudioRecord is not initialized properly. It may be caused by RECORD_AUDIO permission not granted
02-15 11:55:11.824 30358-30358/org.linphone E/AudioTrack: Could not get audio output for session 4534, stream type 0, usage 2, sample rate 48000, format 0x1, channel mask 0x1, flags 0x100
02-15 11:55:11.824 30358-30358/org.linphone E/libOpenSLES: AudioTrack::initCheck status 4294967274
02-15 11:55:11.824 30358-30358/org.linphone W/libOpenSLES: Leaving Object::Realize (SL_RESULT_CONTENT_UNSUPPORTED)
02-15 11:55:11.824 30358-30358/org.linphone E/Linphone: OpenSLES Error 9 while realizing output sink
02-15 11:55:11.824 30358-30358/org.linphone E/Linphone: Couldn't init OpenSLES sink
Finally, when I hangup the call, app crash with the following crash log
02-15 11:55:15.565 30358-30358/org.linphone A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 30358 (org.linphone)
02-15 11:55:15.566 812-812/? I/DEBUG: dbgd_get_additional_log pid:30358
02-15 11:55:15.619 812-812/? I/DEBUG: system return_code[ -1 ] <No child processes> No.10
02-15 11:55:15.672 812-812/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-15 11:55:15.672 812-812/? A/DEBUG: Build fingerprint: 'KYOCERA/KYV38_jp_kdi/KYV38:6.0.1/1.000RI.37.c/1.000RI.37.c:user/release-keys'
02-15 11:55:15.672 812-812/? A/DEBUG: Revision: '0'
02-15 11:55:15.672 812-812/? A/DEBUG: ABI: 'arm64'
02-15 11:55:15.672 812-812/? A/DEBUG: pid: 30358, tid: 30358, name: org.linphone >>> org.linphone <<<
02-15 11:55:15.672 812-812/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
02-15 11:55:15.693 812-812/? A/DEBUG: x0 0000000000000000 x1 0000000000000001 x2 0000000000000001 x3 000000559c602d60
02-15 11:55:15.694 812-812/? A/DEBUG: x4 0000000000000000 x5 0000000000000001 x6 0000000000000000 x7 0000007fa0796a70
02-15 11:55:15.694 812-812/? A/DEBUG: x8 0000007f885940f8 x9 0000007fa0796a70 x10 0000000000000003 x11 0000000000000150
02-15 11:55:15.694 812-812/? A/DEBUG: x12 000000559c57e5e0 x13 000000559bcb3000 x14 0000000000000001 x15 0000000000000005
02-15 11:55:15.694 812-812/? A/DEBUG: x16 0000007f97145e88 x17 0000007f9712cd94 x18 4000000000000000 x19 000000559c463b30
02-15 11:55:15.694 812-812/? A/DEBUG: x20 000000559bf42960 x21 000000559c72d3d0 x22 0000000000000000 x23 0000007febc018e8
02-15 11:55:15.694 812-812/? A/DEBUG: x24 0000007febc01ca8 x25 0000007febc019ac x26 0000007febc01fe0 x27 0000007f9d400000
02-15 11:55:15.694 812-812/? A/DEBUG: x28 0000007febc01700 x29 0000007febc01590 x30 0000007f9712cdb8
02-15 11:55:15.694 812-812/? A/DEBUG: sp 0000007febc01580 pc 0000007f88594110 pstate 0000000020000000
02-15 11:55:15.712 812-812/? A/DEBUG: backtrace:
02-15 11:55:15.712 812-812/? A/DEBUG: #00 pc 00000000000a9110 /data/app/org.linphone-2/lib/arm64/libmediastreamer_voip-arm64-v8a.so
02-15 11:55:15.712 812-812/? A/DEBUG: #01 pc 000000000000adb4 /data/app/org.linphone-2/lib/arm64/libmediastreamer_base-arm64-v8a.so (ms_filter_postprocess+32)
02-15 11:55:15.712 812-812/? A/DEBUG: #02 pc 000000000001a080 /data/app/org.linphone-2/lib/arm64/libbctoolbox-arm64-v8a.so (bctbx_list_for_each+28)
02-15 11:55:15.712 812-812/? A/DEBUG: #03 pc 000000000000c158 /data/app/org.linphone-2/lib/arm64/libmediastreamer_base-arm64-v8a.so (ms_ticker_detach+120)
02-15 11:55:15.712 812-812/? A/DEBUG: #04 pc 000000000007ca3c /data/app/org.linphone-2/lib/arm64/libmediastreamer_voip-arm64-v8a.so (audio_stream_stop+84)
02-15 11:55:15.713 812-812/? A/DEBUG: #05 pc 00000000001085a8 /data/app/org.linphone-2/lib/arm64/liblinphone-arm64-v8a.so (linphone_call_stop_media_streams+316)
02-15 11:55:15.713 812-812/? A/DEBUG: #06 pc 0000000000112e5c /data/app/org.linphone-2/lib/arm64/liblinphone-arm64-v8a.so
02-15 11:55:15.713 812-812/? A/DEBUG: #07 pc 0000000000110d48 /data/app/org.linphone-2/lib/arm64/liblinphone-arm64-v8a.so (linphone_core_terminate_call+244)
02-15 11:55:15.713 812-812/? A/DEBUG: #08 pc 0000000000127e68 /system/lib64/libart.so (art_quick_generic_jni_trampoline+152)
02-15 11:55:15.713 812-812/? A/DEBUG: #09 pc 000000000011e224 /system/lib64/libart.so (art_quick_invoke_stub+580)
02-15 11:55:15.713 812-812/? A/DEBUG: #10 pc 000000000012e0dc /system/lib64/libart.so (_ZN3art9ArtMethod6InvokeEPNS_6ThreadEPjjPNS_6JValueEPKc+176)
02-15 11:55:15.713 812-812/? A/DEBUG: #11 pc 00000000004cc3b0 /system/lib64/libart.so (artInterpreterToCompiledCodeBridge+212)
02-15 11:55:15.713 812-812/? A/DEBUG: #12 pc 00000000002a7ac0 /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+480)
02-15 11:55:15.713 812-812/? A/DEBUG: #13 pc 00000000000dd580 /system/lib64/libart.so (_ZN3art11interpreter15ExecuteGotoImplILb0ELb0EEENS_6JValueEPNS_6ThreadEPKNS_7DexFile8CodeItemERNS_11ShadowFrameES2_+22320)
02-15 11:55:15.713 812-812/? A/DEBUG: #14 pc 00000000002858c8 /system/lib64/libart.so (artInterpreterToInterpreterBridge+220)
02-15 11:55:15.714 812-812/? A/DEBUG: #15 pc 00000000002a7ac0 /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+480)
02-15 11:55:15.714 812-812/? A/DEBUG: #16 pc 00000000002ad4d0 /system/lib64/libart.so (_ZN3art11interpreterL8DoInvokeILNS_10InvokeTypeE4ELb0ELb0EEEbPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+772)
02-15 11:55:15.714 812-812/? A/DEBUG: #17 pc 00000000000dcd9c /system/lib64/libart.so (_ZN3art11interpreter15ExecuteGotoImplILb0ELb0EEENS_6JValueEPNS_6ThreadEPKNS_7DexFile8CodeItemERNS_11ShadowFrameES2_+20300)
02-15 11:55:15.714 812-812/? A/DEBUG: #18 pc 00000000002858c8 /system/lib64/libart.so (artInterpreterToInterpreterBridge+220)
02-15 11:55:15.714 812-812/? A/DEBUG: #19 pc 00000000002a7ac0 /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+480)
02-15 11:55:15.714 812-812/? A/DEBUG: #20 pc 00000000000dd580 /system/lib64/libart.so (_ZN3art11interpreter15ExecuteGotoImplILb0ELb0EEENS_6JValueEPNS_6ThreadEPKNS_7DexFile8CodeItemERNS_11ShadowFrameES2_+22320)
02-15 11:55:15.714 812-812/? A/DEBUG: #21 pc 00000000002854d0 /system/lib64/libart.so (_ZN3art11interpreter30EnterInterpreterFromEntryPointEPNS_6ThreadEPKNS_7DexFile8CodeItemEPNS_11ShadowFrameE+96)
02-15 11:55:15.714 812-812/? A/DEBUG: #22 pc 0000000000537ec0 /system/lib64/libart.so (artQuickToInterpreterBridge+632)
02-15 11:55:15.714 812-812/? A/DEBUG: #23 pc 0000000000127fa4 /system/lib64/libart.so (art_quick_to_interpreter_bridge+100)
02-15 11:55:15.714 812-812/? A/DEBUG: #24 pc 000000000370bf0c /system/framework/arm64/boot.oat (offset 0x1fd5000)
I personally think the crash is because the AudioTrack or AudioRecord does not initialised properly, so when it try to do the cleaning and releasing, it encountered NULL pointer. Is it possible to make the call fail if we don't get AudioTrack or AudioRecord initialised properly? or do some NULL checking in the cleaning and releasing procedure?
Any comment is really appreciated.
Looking forward to hearing from you.
Best Regards,
Li