Calling requestStart without setting callback results in crash when using aaudio::AudioStreamLegacy

[dturner]

Devices tested:

Sony Xperia XZ (Model: F8331)
Android version: 8.0.0
Build number: 41.3.A.2.24

Nexus 6P
Android version: 8.1.0
Build number: OPM3.171019.012

Not affected: Pixel running 7.1.2

Steps to repro:

• Run the following code on app startup:

    oboe::AudioStreamBuilder builder;
    oboe::AudioStream* stream;
    auto result = builder.openStream(&stream);
    if (result != oboe::Result::OK) {
        __android_log_print(ANDROID_LOG_ERROR, "OboeCrashTest", "Could not open stream");
    }

    result = stream->requestStart();
    if (result !=  oboe::Result::OK){
        __android_log_print(ANDROID_LOG_ERROR, "OboeCrashTest", "Could not start stream");
    }

Expected result

• result is an error after builder.openStream or after stream->requestStart(), or the stream starts without error

Actual result

• App crashes with the following output:

01-10 19:32:18.464 569-569/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
01-10 19:32:18.464 569-569/? A/DEBUG: Build fingerprint: 'Sony/F8331/F8331:8.0.0/41.3.A.2.24/1453798961:user/release-keys'
01-10 19:32:18.464 569-569/? A/DEBUG: Revision: '0'
01-10 19:32:18.464 569-569/? A/DEBUG: ABI: 'arm64'
01-10 19:32:18.464 569-569/? A/DEBUG: pid: 473, tid: 561, name: AudioTrack  >>> com.donturner.oboecrashtest <<<
01-10 19:32:18.465 569-569/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x13
01-10 19:32:18.465 569-569/? A/DEBUG: Cause: null pointer dereference
01-10 19:32:18.465 569-569/? A/DEBUG:     x0   0000007c8c2a8b60  x1   0000007fd97d3e80  x2   0000000000000003  x3   0000000000001e02
01-10 19:32:18.465 569-569/? A/DEBUG:     x4   0000000000001e02  x5   00000000ffffffff  x6   0000007c909b1000  x7   000000000014a8e4
01-10 19:32:18.465 569-569/? A/DEBUG:     x8   0000007c72e67370  x9   0000000000000000  x10  0000000000000000  x11  0000000000000000
01-10 19:32:18.465 569-569/? A/DEBUG:     x12  0000000000000001  x13  0000007c726390e0  x14  0000000000000008  x15  0000000000000000
01-10 19:32:18.465 569-569/? A/DEBUG:     x16  0000007c72eaa258  x17  0000007c72e678f0  x18  0000007fd97d26d8  x19  0000007c8c27fc00
01-10 19:32:18.465 569-569/? A/DEBUG:     x20  0000007c72b35318  x21  0000000000001e02  x22  ffffffffffffffff  x23  000015e9289e0925
01-10 19:32:18.465 569-569/? A/DEBUG:     x24  000000000000f010  x25  0000007c8e853600  x26  0000000000989680  x27  000000000d000000
01-10 19:32:18.465 569-569/? A/DEBUG:     x28  0000000000003c04  x29  0000007c72b35260  x30  0000007c72e673b0
01-10 19:32:18.465 569-569/? A/DEBUG:     sp   0000007c72b35230  pc   0000007c72e67918  pstate 0000000080000000
01-10 19:32:18.476 671-10481/? D/msm8974_platform: platform_set_channel_map mixer_ctl_name:Playback Channel Map0
01-10 19:32:18.476 671-10481/? D/msm8974_platform: platform_set_channel_map: set mapping(1 2 0 0 0 0 0 0) for channel:2
01-10 19:32:18.477 671-10481/? D/audio_hw_extn: audio_extn_get_anc_enabled: anc_enabled:0
01-10 19:32:18.477 671-10481/? D/audio_hw_primary: start_output_stream: exit
01-10 19:32:18.478 671-10481/? D/ahc: ahc_enable: out_snd_device 0x2
01-10 19:32:18.479 569-569/? A/DEBUG: backtrace:
01-10 19:32:18.479 569-569/? A/DEBUG:     #00 pc 000000000001c918  /data/app/com.donturner.oboecrashtest-QpuMxSWiyoWEEVg3x-DEdQ==/lib/arm64/libnative-lib.so (_ZN4oboe17AudioStreamAAudio16callOnAudioReadyEP18AAudioStreamStructPvi+40)
01-10 19:32:18.479 569-569/? A/DEBUG:     #01 pc 000000000001c3ac  /data/app/com.donturner.oboecrashtest-QpuMxSWiyoWEEVg3x-DEdQ==/lib/arm64/libnative-lib.so
01-10 19:32:18.479 569-569/? A/DEBUG:     #02 pc 0000000000018a48  /system/lib64/libaaudio.so (_ZN6aaudio17AudioStreamLegacy21processCallbackCommonEiPv+228)
01-10 19:32:18.479 569-569/? A/DEBUG:     #03 pc 0000000000054a38  /system/lib64/libaudioclient.so (_ZN7android10AudioTrack18processAudioBufferEv+1800)
01-10 19:32:18.479 569-569/? A/DEBUG:     #04 pc 00000000000565e4  /system/lib64/libaudioclient.so (_ZN7android10AudioTrack16AudioTrackThread10threadLoopEv+196)
01-10 19:32:18.479 569-569/? A/DEBUG:     #05 pc 0000000000011674  /system/lib64/libutils.so (_ZN7android6Thread11_threadLoopEPv+280)
01-10 19:32:18.479 569-569/? A/DEBUG:     #06 pc 00000000000668a0  /system/lib64/libc.so (_ZL15__pthread_startPv+36)
01-10 19:32:18.479 569-569/? A/DEBUG:     #07 pc 000000000001f374  /system/lib64/libc.so (__start_thread+68)
01-10 19:32:18.542 1024-1234/? W/AudioFlinger: moveEffectChain_l() effect chain for session 0 not on source thread 0xf1c83580

[philburk]

Good catch. Probably due to uninitialized pointer at:

oboe/include/oboe/AudioStreamBase.h

Line 98 in 7283080

AudioStreamCallback *mStreamCallback;