OpenSLES GetPosition crashes on Android 8.0 to Android 9

[loongee]

As I mentioned our app #359, we forced all devices use oboe_OPENSLES because of the aaudio crash, some OpenSLES crashes were reported from users:

devices: HUAWEI honor play / XIAOMI 5s plus / OPPO R11s / etc.
os: Android 8.0/Android 8.1/Android 9
oboe version:1.1.1
crash rate: about 1-2 times / 1000 users every day. (not much, but worth paying attention)

backtrace:

SIGSEGV(SEGV_MAPERR):
#00 pc 0001a6ae /system/lib/libc.so (strlen+137) [armeabi-v7a::ffab37c8640406bcbadd87b455c7ff46]
#1 pc 0003eb29 /system/lib/libc.so (__vfprintf+3944) [armeabi-v7a::ffab37c8640406bcbadd87b455c7ff46]
#2 pc 000523c1 /system/lib/libc.so (vsnprintf+128) [armeabi-v7a::ffab37c8640406bcbadd87b455c7ff46]
#3 pc 0000655b /system/lib/liblog.so (__android_log_print+54) [armeabi-v7a::6aedbe30130fe25d7e313740345b4e2a]
#4 pc 0000c13d /system/lib/libwilhelm.so [armeabi-v7a::676572a8626e0b0c6946a4269520c543]
#5 pc 000214df /system/lib/libwilhelm.so [armeabi-v7a::676572a8626e0b0c6946a4269520c543]
#6 pc 003a823b /data/app/com.tencent.qgame-vY2whcSbQ0xopZbS8PsS_g==/lib/arm/libqgplayer-lib.so (_ZN4oboe25AudioOutputStreamOpenSLES25updateServiceFrameCounterEv+46) [armeabi-v7a::de1dfbeb99205ca392b18fc844c4926b]
#7 pc 003a8bf7 /data/app/com.tencent.qgame-vY2whcSbQ0xopZbS8PsS_g==/lib/arm/libqgplayer-lib.so (ZN4oboe19AudioStreamOpenSLES21processBufferCallbackEPKPK30SLAndroidSimpleBufferQueueItf+32) [armeabi-v7a::de1dfbeb99205ca392b18fc844c4926b]
#8 pc 003a804b /data/app/com.tencent.qgame-vY2whcSbQ0xopZbS8PsS_g==/lib/arm/libqgplayer-lib.so (_ZN4oboe25AudioOutputStreamOpenSLES12requestStartEv+102) [armeabi-v7a::de1dfbeb99205ca392b18fc844c4926b]

the #06 frame is on the line:

SLresult slResult = (*mPlayInterface)->GetPosition(mPlayInterface, &msec);

logcat:

01-22 07:23:39.288 21838 15928 I libOpenSLES: Emulating old channel mask behavior (ignoring positional mask 0x3, using default mask 0x3 based on channel count of 2)
01-22 07:23:39.288 21838 15928 D AudioTrack: set(): streamType 3, sampleRate 48000, format 0x1, channelMask 0x3, frameCount 0, flags #104, notificationFrames -2, sessionId 65569, transferType 0, uid -1, pid -1
01-22 07:23:39.288 21838 15928 V AudioTrack: set() streamType 3 frameCount 0 flags 0104
01-22 07:23:39.289 21838 15928 D AudioTrack: client name com.tencent.qgame(21838)
01-22 07:23:39.292 21838 21919 E : nFreeSize: 82662014976
01-22 07:23:39.293 21838 15928 V AudioTrack: createTrack_l() output 21 afLatency 82
01-22 07:23:39.310 21838 21919 E : nFreeSize: 82662010880
01-22 07:23:39.320 21838 21919 E : nFreeSize: 82662010880
01-22 07:23:39.321 21838 15930 D SurfaceUtils: set up nativeWindow 0xcedd8008 for 960x540, color 0x7fa30c06, rotation 0, usage 0x20002900
01-22 07:23:39.326 21838 15928 I AudioTrack: AUDIO_OUTPUT_FLAG_FAST successful; frameCount 384 -> 384
01-22 07:23:39.326 21838 15928 D AudioTrack: Client defaulted notificationFrames to 192 for frameCount 384
01-22 07:23:39.333 21838 15928 D AudioTrack: NO in A2dpOutput,mNotificationFramesAct:192,frameCount:384
01-22 07:23:39.334 21838 21919 E : nFreeSize: 82662010880
01-22 07:23:39.338 21838 15928 W libOpenSLES: Leaving AndroidConfiguration::GetConfiguration (SL_RESULT_FEATURE_UNSUPPORTED)
01-22 07:23:39.340 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.341 21838 26657 D : PlayerBase::stop() from IPlayer
01-22 07:23:39.341 21838 21919 W MtaSDK : [StatService(8223): SourceFile:709] - Invalid invocation since previous onResume on diff page.
01-22 07:23:39.342 21838 26657 D AudioTrack: stop() called with 0 frames delivered
01-22 07:23:39.343 21838 21919 E : nFreeSize: 82662006784
01-22 07:23:39.348 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.349 21838 21919 E : nFreeSize: 82661998592
01-22 07:23:39.351 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.352 21838 15928 E libOpenSLES: frameworks/wilhelm/src/itf/IPlay.cpp:204: pthread_mutex_lock_timeout_np returned 110
01-22 07:23:39.356 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.359 21838 21919 E : nFreeSize: 82661998592
01-22 07:23:39.364 21838 21919 E : nFreeSize: 82661998592
01-22 07:23:39.375 21838 15930 D SurfaceUtils: set up nativeWindow 0xcedd8008 for 1920x1088, color 0x7fa30c06, rotation 0, usage 0x20002900
01-22 07:23:39.394 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.398 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.404 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.411 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.435 21838 26657 D : PlayerBase::pause() from IPlayer
01-22 07:23:39.435 21838 26657 V AudioTrack: ~AudioTrack, releasing session id 65569 from 21838 on behalf of 21838
01-22 07:23:39.436 21838 15930 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x2000
01-22 07:23:39.437 21838 21838 D SensorManager: acc x -3.4720764 y 9.001236 z 2.652298 ts 432458471283682 count 2 to android.view.OrientationEventListener$SensorEventListenerImpl@71726af
01-22 07:23:39.438 21838 21838 D OrientationEventListener: Orientation is:21 X:3.4720764 Y:-9.001236 Z:-2.652298
01-22 07:23:39.438 21838 21838 W ViewRootImpl[MainActivity]: Cancelling event due to no window focus: KeyEvent { action=ACTION_UP, keyCode=KEYCODE_BACK, scanCode=0, metaState=0, flags=0x68, repeatCount=0, eventTime=366674251, downTime=366674212, deviceId=-1, source=0x101 }
01-22 07:23:39.444 21838 21838 I chatty : uid=10162(com.tencent.qgame) identical 7 lines
01-22 07:23:39.444 21838 21838 W ViewRootImpl[MainActivity]: Cancelling event due to no window focus: KeyEvent { action=ACTION_UP, keyCode=KEYCODE_BACK, scanCode=0, metaState=0, flags=0x68, repeatCount=0, eventTime=366674251, downTime=366674212, deviceId=-1, source=0x101 }
01-22 07:23:39.476 21838 21919 E : nFreeSize: 82661994496
--------- beginning of crash

It's obviously not oboe's fault, but also want you to know that.

[dturner]

Thank you for filing these bug reports - really useful.

It looks like an audio stream is being closed uncleanly, then a subsequent open stream is causing a crash.

@philburk to investigate

[philburk]

I think updateServiceFrameCounter() was colliding with a close().
This patch might help: #377