Re: Crash using a binder from a pthread

541 views
Skip to first unread message

homb...@gmail.com

unread,
Mar 26, 2013, 4:42:21 AM3/26/13
to android-...@googlegroups.com
Actually this crash also happens using AudioTrack and I would say it just happens with any class that's using binders internally to communicate with a server.

Anyway I finally found a solution for this issue: calling ProcessState::self()->startThreadPool() at the beginning of my code seems to fix it. I still don't understand why this call is necessary though. I thought it was only necessary when creating a service expecting to receive binder requests.

Lucas


On Monday, March 25, 2013 4:05:06 PM UTC+1, shai lavi wrote:
To know if this can be done u should understand deeply the AudioRecord class
Dive into the source code.

On Monday, March 25, 2013 10:29:29 AM UTC+2, homb...@gmail.com wrote:
Hi,

I am facing a very weird crash when I try to use an AudioRecord object inside a pthread. After a few days investigation, I have narrowed down the problem to the binders connection/disconnection from MediaServer. The following code is reproducing the crash:

void* launchAudioRecord(void*) {
  AudioRecord* audioRecord = new AudioRecord(AUDIO_SOURCE_MIC,
      SAMPLE_RATE, AUDIO_FORMAT_PCM_16_BIT, AUDIO_CHANNEL_IN_MONO);
  delete audioRecord;
  return 0;
}

TEST(AsrTest, AudioRecordTest) {
  pthread_t thread1;
  pthread_create(&thread1, NULL, &launchAudioRecord, NULL);
  pthread_join(thread1, NULL);

  pthread_t thread2;
  pthread_create(&thread2, NULL, &launchAudioRecord, NULL);
  pthread_join(thread2, NULL);
}

This the logcat output:

I/logkernel(   77): binder: 118:231 transaction failed 29201, size 28-4
E/IMemory (  726): binder=0x1d5d8 transaction failed fd=-2147483647, size=0, err=-2147483646 (Unknown error: 2147483646)
E/IMemory (  726): cannot dup fd=-2147483647, size=0, err=-2147483646 (Bad file number)
E/IMemory (  726): cannot map BpMemoryHeap (binder=0x1d5d8), size=0, fd=-1 (Bad file number)
F/libc    (  726): Fatal signal 11 (SIGSEGV) at 0x00000018 (code=1)
I/DEBUG   (  113): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (  113): Build fingerprint: 'TomTom/am335x/am335x:4.0.3.1/HES-ICS-Drop-0/git:tests/test-keys'
I/DEBUG   (  113): pid: 726, tid: 730  >>> ./AsrNativeUnitTest <<<
I/DEBUG   (  113): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000018
I/DEBUG   (  113):  r0 00000000  r1 00000040  r2 00000001  r3 0001d630
I/DEBUG   (  113):  r4 0001ccf8  r5 0001ccfc  r6 0001d590  r7 00000001
I/DEBUG   (  113):  r8 00003e80  r9 a09db195  10 00000001  fp 0001ccf8
I/DEBUG   (  113):  ip a0542e7c  sp 4094cdd8  lr a04a60d4  pc a09ddeda  cpsr 200d0030
I/DEBUG   (  113):  d0  00000000c18af967  d1  0000000000000000
I/DEBUG   (  113):  d2  0000002000000001  d3  0000002200000002
I/DEBUG   (  113):  d4  0000000100000001  d5  0000000600000002
I/DEBUG   (  113):  d6  0000000000000000  d7  bd6bc8e31db1a6c1
I/DEBUG   (  113):  d8  0000000000000000  d9  0000000000000000
I/DEBUG   (  113):  d10 0000000000000000  d11 0000000000000000
I/DEBUG   (  113):  d12 0000000000000000  d13 0000000000000000
I/DEBUG   (  113):  d14 0000000000000000  d15 0000000000000000
I/DEBUG   (  113):  d16 0000000000000000  d17 0000000500000001
I/DEBUG   (  113):  d18 41bdb1a6c1000000  d19 0000000000000000
I/DEBUG   (  113):  d20 0000000000000000  d21 0000000000000000
I/DEBUG   (  113):  d22 0000000000000000  d23 0000000000000000
I/DEBUG   (  113):  d24 0000000000000000  d25 0000000000000000
I/DEBUG   (  113):  d26 0000000000000000  d27 0000000000000000
I/DEBUG   (  113):  d28 0000000000000000  d29 0000000000000000
I/DEBUG   (  113):  d30 0000000000000000  d31 0000000000000000
I/DEBUG   (  113):  scr 00000010
I/DEBUG   (  113):
I/DEBUG   (  113):          #00  pc 00037eda  /system/lib/libmedia.so (_ZN7android11AudioRecord12openRecord_lEjjjiji)
I/DEBUG   (  113):          #01  pc 00038870  /system/lib/libmedia.so (_ZN7android11AudioRecord3setEijijijPFviPvS1_ES1_ibi)
I/DEBUG   (  113):          #02  pc 00038a58  /system/lib/libmedia.so (_ZN7android11AudioRecordC2EijijijPFviPvS1_ES1_ii)
I/DEBUG   (  113):          #03  pc 0000a45c  /data/local/AsrNativeUnitTest
I/DEBUG   (  113):          #04  pc 0000cf4c  /system/lib/libc.so (__thread_entry)
I/DEBUG   (  113):          #05  pc 0000cb64  /system/lib/libc.so (pthread_create)
I/DEBUG   (  113):
I/DEBUG   (  113): code around pc:
I/DEBUG   (  113): a09ddeb8 6863eac8 681ab133 f8524629 19585c0c  ..ch3..h)FR..\X.
I/DEBUG   (  113): a09ddec8 eac4f7f9 980c6066 eb4af7f9 f1006160  ....f`....J.`a..
I/DEBUG   (  113): a09dded8 61810140 0002f06f f1036963 f7f9013c  @..ao...ci..<...
I/DEBUG   (  113): a09ddee8 6960eb34 727af44f 0c00f04f 86c24665  4.`iO.zrO...eF..
I/DEBUG   (  113): a09ddef8 f8a16961 9b0cc038 6818b133 f850a90c  ai..8...3..h..P.
I/DEBUG   (  113):
I/DEBUG   (  113): code around lr:
I/DEBUG   (  113): a04a60b4 e1a01005 e1a02004 e8bd4070 eaffffe6  ..... ..p@......
I/DEBUG   (  113): a04a60c4 e92d4038 e1a05000 e1a04001 ebffffcf  8@-..P...@......
I/DEBUG   (  113): a04a60d4 e1940f9f e0802005 e1843f92 e3530000  ..... ...?....S.
I/DEBUG   (  113): a04a60e4 1afffffa e8bd8038 e1a01000 e3a00001  ....8...........
I/DEBUG   (  113): a04a60f4 eafffff2 e1a01000 e3e00000 eaffffef  ................
I/DEBUG   (  113):
I/DEBUG   (  113): stack:
I/DEBUG   (  113):     4094cd98  0001d5d8  [heap]
I/DEBUG   (  113):     4094cd9c  a055d591  /system/lib/libbinder.so
I/DEBUG   (  113):     4094cda0  0001d630  [heap]
I/DEBUG   (  113):     4094cda4  0001d670  [heap]
I/DEBUG   (  113):     4094cda8  4094cdc8 
I/DEBUG   (  113):     4094cdac  a05293c5  /system/lib/libutils.so
I/DEBUG   (  113):     4094cdb0  0001d630  [heap]
I/DEBUG   (  113):     4094cdb4  00000000 
I/DEBUG   (  113):     4094cdb8  0001ccfc  [heap]
I/DEBUG   (  113):     4094cdbc  a055ccd3  /system/lib/libbinder.so
I/DEBUG   (  113):     4094cdc0  00000000 
I/DEBUG   (  113):     4094cdc4  0001d5c0  [heap]
I/DEBUG   (  113):     4094cdc8  0001d630  [heap]
I/DEBUG   (  113):     4094cdcc  a052939d  /system/lib/libutils.so
I/DEBUG   (  113):     4094cdd0  df0027ad 
I/DEBUG   (  113):     4094cdd4  00000000 
I/DEBUG   (  113): #00 4094cdd8  00003e80 
I/DEBUG   (  113):     4094cddc  00000001 
I/DEBUG   (  113):     4094cde0  00000010 
I/DEBUG   (  113):     4094cde4  00001000 
I/DEBUG   (  113):     4094cde8  00000000 
I/DEBUG   (  113):     4094cdec  0001cd50  [heap]
I/DEBUG   (  113):     4094cdf0  4094cdf8 
I/DEBUG   (  113):     4094cdf4  00003e80 
I/DEBUG   (  113):     4094cdf8  00000000 
I/DEBUG   (  113):     4094cdfc  00000000 
I/DEBUG   (  113):     4094ce00  0001cdd0  [heap]
I/DEBUG   (  113):     4094ce04  a09ddb2f  /system/lib/libmedia.so
I/DEBUG   (  113):     4094ce08  0001d590  [heap]
I/DEBUG   (  113):     4094ce0c  00000000 
I/DEBUG   (  113):     4094ce10  00001000 
I/DEBUG   (  113):     4094ce14  00003e80 
I/DEBUG   (  113):     4094ce18  00000008 
I/DEBUG   (  113):     4094ce1c  00000000 
I/DEBUG   (  113):     4094ce20  00000009 
I/DEBUG   (  113):     4094ce24  0001cd04  [heap]
I/DEBUG   (  113):     4094ce28  00000000 
I/DEBUG   (  113):     4094ce2c  a09de875  /system/lib/libmedia.so
I/DEBUG   (  113): #01 4094ce30  00001000 
I/DEBUG   (  113):     4094ce34  00000000 
I/DEBUG   (  113):     4094ce38  00000009 
I/DEBUG   (  113):     4094ce3c  0000005c 
I/DEBUG   (  113):     4094ce40  a011b548  /system/lib/libc.so
I/DEBUG   (  113):     4094ce44  00000000 
I/DEBUG   (  113):     4094ce48  00000060 
I/DEBUG   (  113):     4094ce4c  00000001 
I/DEBUG   (  113):     4094ce50  00001000 
I/DEBUG   (  113):     4094ce54  00000078 
I/DEBUG   (  113):     4094ce58  00000002 
I/DEBUG   (  113):     4094ce5c  00000000 
I/DEBUG   (  113):     4094ce60  ffffffed 
I/DEBUG   (  113):     4094ce64  00000000 
I/DEBUG   (  113):     4094ce68  00000000 
I/DEBUG   (  113):     4094ce6c  0001ccf8  [heap]
I/DEBUG   (  113):     4094ce70  0000a435  /data/local/AsrNativeUnitTest
I/DEBUG   (  113):     4094ce74  00000008 
I/DEBUG   (  113):     4094ce78  00000001 
I/DEBUG   (  113):     4094ce7c  a09dea5d  /system/lib/libmedia.so
I/BootReceiver(  251): Copying /data/tombstones/tombstone_06 to DropBox (SYSTEM_TOMBSTONE)
I/logkernel(   77): binder: release proc 726, transaction 3224, not freed

The traces from dmesg are:

<6>[ 1929.628845] binder: 118:729 transaction failed 29201, size 28-4
<6>[ 1929.635253] binder: send failed reply for transaction 3655 to 838:841
<3>[ 1930.527679] binder: release proc 838, transaction 3600, not freed
<3>[ 1930.534271] binder: release proc 838, transaction 3609, not freed
<3>[ 1930.540740] binder: release proc 838, transaction 3632, not freed
<3>[ 1930.547180] binder: release proc 838, transaction 3639, not freed

Is this a bug in AudioRecord class? Is there a limitation in the combination of binders and pthreads? Any help would be appreciated :-)

Cheers,

Lucas

Glenn Kasten

unread,
Mar 26, 2013, 12:57:52 PM3/26/13
to android-...@googlegroups.com

Reminder: use AudioRecord C++ and AudioTrack C++ only if you're building your own platform for a specific device.

Avoid them if you're writing a portable app, because those interfaces change in incompatible ways every release,

and may be different even within a release for various devices.

The correct APIs for portable apps are SDK android.media.* and NDK OpenSL ES.

homb...@gmail.com

unread,
Mar 26, 2013, 1:20:26 PM3/26/13
to android-...@googlegroups.com
Hi Glenn,

Thank you for your reminder, but I am actually building my own platform based on ICS and therefore using these interfaces.

Lucas

Dianne Hackborn

unread,
Mar 26, 2013, 8:07:38 PM3/26/13
to android-...@googlegroups.com
On Tue, Mar 26, 2013 at 1:42 AM, <homb...@gmail.com> wrote:
Anyway I finally found a solution for this issue: calling ProcessState::self()->startThreadPool() at the beginning of my code seems to fix it. I still don't understand why this call is necessary though. I thought it was only necessary when creating a service expecting to receive binder requests.

startThreadPool() initializes the binder's user space in the process.  If you don't do this in the process, then trying to use binder calls will fail.

--
Dianne Hackborn
Android framework engineer
hac...@android.com

Note: please don't send private questions to me, as I don't have time to provide private support, and so won't reply to such e-mails.  All such questions should be posted on public forums, where I and others can see and answer them.
Reply all
Reply to author
Forward
0 new messages