Crash Investigation on Android: Oboe AudioStream::close() Backtrace

[yj77777]

Android version(s):Android 14
Android device(s):HUAWEIJAD-AL80
Oboe version:1.9.3
App name used for testing:
(Please try to reproduce the issue using the OboeTester or an Oboe sample.)

Short description
A crash occurs after calling the following code:

    if (_stream) {
        _stream->stop();
        _stream->close();
        _stream.reset();
    }

crash log and backtrace：

09-20 15:39:23.735 31736 7113 I [CORE_LOG]: [CORE_LOG] bds_AudioPlayer_Android_OBOE.cpp:187:[onAudioReady][OBOE] onAudioReady: Stream 960
09-20 15:39:23.863 31736 24778 I [CORE_LOG]: [CORE_LOG] bds_AudioPlayer_Android_OBOE.cpp:82:[do_stop]stop to audio player OBOE start
09-20 15:39:23.863 31736 24778 D AAudio : AAudioStream_requestStop(s#46) called
09-20 15:39:25.138 31736 24778 D AAudioStream: joinThread_l() pthread_join succeeded
09-20 15:39:25.138 31736 24778 D AAudioStream: setState(s#46) from 4 to 9
09-20 15:39:25.141 25945 7112 D AAudioServiceStreamBase: run() Shared exiting after 11025 loops <<<<<<<<<<<<<< TIMESTAMPS
09-20 15:39:25.145 25945 7110 D AAudioServiceEndpointPlay: callbackLoop() exiting, enabled = 0, state = 4, result = 96 <<<<<<<<<<<<< MIXER
09-20 15:39:25.149 25945 29676 D AAudioStream: joinThread_l() pthread_join succeeded
09-20 15:39:25.152 25945 29676 D AAudioStream: setState(s#158) from 4 to 9
09-20 15:39:25.163 25945 7109 D AAudioServiceStreamBase: run() MMAP exiting after 21848 loops <<<<<<<<<<<<<< TIMESTAMPS
09-20 15:39:25.333 31736 24778 D AAudioStream: setState(s#46) from 9 to 10
09-20 15:39:25.333 31736 24778 D AAudio : AAudioStream_requestStop(s#46) called
09-20 15:39:25.335 26185 26185 D MediaSessionService: Audio playback is changed, config=AudioPlaybackConfiguration piid:2093159 deviceId:3 type:AAudio u/pid:10382/31736 state:stopped attr:AudioAttributes: usage=USAGE_MEDIA content=CONTENT_TYPE_UNKNOWN flags=0x0 tags= bundle=null sessionId:-1, removed=false
09-20 15:39:25.343 31736 24778 D AAudio : AAudioStream_close(s#46) called ---------------
09-20 15:39:25.343 31736 24778 D AAudioStream: setState(s#46) from 10 to 11
09-20 15:39:25.343 25945 29676 D AAudioStream: joinThread() - but has no thread or already join()ed
09-20 15:39:25.343 25945 29676 D AAudioStream: setState(s#158) from 9 to 11
09-20 15:39:25.444 25945 29676 D AAudioServiceEndpoint: ~AAudioServiceEndpoint() called
09-20 15:39:25.444 25945 29676 D AAudioServiceStreamBase: ~AAudioServiceStreamBase() called
09-20 15:39:25.444 25945 29676 D AAudioStream: setState(s#158) from 11 to 11
09-20 15:39:25.444 25945 29676 D AAudioStream: setState(s#158) from 11 to 12
09-20 15:39:25.444 25945 29676 D AAudioStream: ~AudioStream(s#158) mPlayerBase strongCount = 1
09-20 15:39:25.444 25945 29676 D AAudioServiceEndpoint: ~AAudioServiceEndpoint() called
09-20 15:39:25.445 25945 29676 D AAudioServiceStreamBase: ~AAudioServiceStreamBase() called
09-20 15:39:25.445 31736 24778 D AAudioStream: setState(s#46) from 11 to 11
09-20 15:39:25.445 31736 24778 D AAudioStream: setState(s#46) from 11 to 12
09-20 15:39:25.445 31736 24778 D AAudioStream: ~AudioStream(s#46) mPlayerBase strongCount = 2
09-20 15:39:25.445 31736 24778 D AAudio : AAudioStream_close(s#46) returned 0 ---------
09-20 15:39:25.445 31736 24778 I [CORE_LOG]: [CORE_LOG] bds_AudioPlayer_Android_OBOE.cpp:88:[do_stop]stop to audio player OBOE success
09-20 15:39:25.447 31736 11862 F libc : Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7126931d40 in tid 11862 (sdk_runTaskSync), pid 31736 (sdk_runTaskSync)
09-20 15:39:26.665 11873 11873 F DEBUG : backtrace:
09-20 15:39:26.665 11873 11873 F DEBUG : #00 pc 00000000000efd40 /data/app/~~smLZvIhy1STEUjfI-6hwaw==/com.mm.speech.demo-8x1ezv79co9OjVUqioGgxQ==/lib/arm64/libc++_shared.so!libc++_shared.so (BuildId: 113625a9268e23a9dc7c03b91dbb13d9c5fde6ee)
09-20 15:39:26.665 11873 11873 F DEBUG : #1 pc 000000000002e900 /data/app/~~smLZvIhy1STEUjfI-6hwaw==/com.mm.speech.demo-8x1ezv79co9OjVUqioGgxQ==/lib/arm64/liboboe.so (oboe::AudioStream::close()+40) (BuildId: c08f5766dc1cd854b4b1df16b4dcda6a161ab88d)
09-20 15:39:26.665 11873 11873 F DEBUG : #2 pc 00000000000312a8 /data/app/~~smLZvIhy1STEUjfI-6hwaw==/com.mm.speech.demo-8x1ezv79co9OjVUqioGgxQ==/lib/arm64/liboboe.so (non-virtual thunk to oboe::FilterAudioStream::onErrorAfterClose(oboe::AudioStream*, oboe::Result)+32) (BuildId: c08f5766dc1cd854b4b1df16b4dcda6a161ab88d)
09-20 15:39:26.666 11873 11873 F DEBUG : #3 pc 000000000002db80 /data/app/~~smLZvIhy1STEUjfI-6hwaw==/com.mm.speech.demo-8x1ezv79co9OjVUqioGgxQ==/lib/arm64/liboboe.so (BuildId: c08f5766dc1cd854b4b1df16b4dcda6a161ab88d)
09-20 15:39:26.666 11873 11873 F DEBUG : #4 pc 00000000000ebe70 /apex/com.android.runtime/lib64/bionic/libc.so!libc.so (__pthread_start(void*)+264) (BuildId: a85ef5fb74e0282813cd1edb10854577)
09-20 15:39:26.666 11873 11873 F DEBUG : #5 pc 000000000008b7f0 /apex/com.android.runtime/lib64/bionic/libc.so!libc.so (__start_thread+64) (BuildId: a85ef5fb74e0282813cd1edb10854577)

Please help check if it’s caused by my own calls (occasional, not reproducible every time)

[robertwu1]

Your crash is in onErrorAfterClose. Perhaps this is related to resetting your pointer after calling close.

Can you take a look at setDataCallback and setErrorCallback? Make sure you are using the callbacks with a shared_ptr.

The issue may be related to the callback using something that has been deleted

[yj77777]

Hi Oboe team,

We found the crash in onErrorAfterClose happens because callbacks may access _stream or this after the stream is closed and reset. To fix it, we added an _isClosing flag checked in callbacks and changed the callbacks to use shared_from_this() instead of raw this. _stream is now reset only after fully closing the stream. With this, the crash may no longer occurs.

Thanks for your guidance!

[yj77777]

After applying your suggestion, the original crash still occurs occasionally, with a probability of approximately 0.003%.

Below is the updated code.

I introduced a dedicated callback class instead of passing this directly:

class OboeCallback : public AudioStreamCallback {
public:
    explicit OboeCallback(AudioPlayer_Android_OBOE* parent)
        : _parent(parent) {}

    DataCallbackResult onAudioReady(AudioStream* audioStream,
                                    void* audioData,
                                    int32_t numFrames) override;

    void onErrorAfterClose(AudioStream* oboeStream,
                           Result error) override;
private:
    AudioPlayer_Android_OBOE* _parent;
};

The logic for stream creation has been updated to：

auto callback = std::make_shared<OboeCallback>(this);

oboe::AudioStreamBuilder builder;
oboe::Result result = builder.setDirection(oboe::Direction::Output)
    ->setDataCallback(callback)
    ->setErrorCallback(callback);

Stream shutdown logic remains the same:

if (_stream) {
    _stream->stop();
    _stream->close();
    _stream.reset();
}

Previously, the implementation was:

oboe::AudioStreamBuilder builder;
auto self = shared_from_this();

oboe::Result result = builder.setDirection(oboe::Direction::Output)
    ->setDataCallback(self)
    ->setErrorCallback(self);

if (_stream) {
    _stream->stop();
    _stream->close();
    _stream.reset();
}

Here, self is an instance of AudioPlayer_Android_OBOE, which is implemented as a singleton and is not destroyed during the application lifecycle.

Despite switching to a separate callback object to avoid potential lifetime issues, the crash still reproduces at a very low frequency. I would appreciate any further guidance on whether there are additional thread-safety or lifecycle constraints around AudioStreamCallback and close() / onErrorAfterClose() interactions that should be considered.

[flamme]

Could you share what is the returned value from onError? If onError returns false, oboe library will systematically close the stream. This may result in closing the stream twice.

[yj77777]

I didn't register the callback for onError.
The crash stack analysis is exactly the same as #2325.
https://github.com/google/oboe/blob/1.9.3/src/common/AudioStream.cpp#L44
https://github.com/google/oboe/blob/1.9.3/src/common/FilterAudioStream.h#L200
I also saw your discussion. How did you finally solve this crash