Android: crashes on nativeClose on .stopStreaming
BlueBazze opened this issue · 21 comments
Describe the bug
When using react navigation.
Having a broadcaster page with the live stream view.
Navigating away from this page causes the entire app to crash.
When navigating away from the broadcaster page.
React navigation will unmount that page and destroy the components on that page.
Crashlog
https://gist.github.com/BlueBazze/b3dc08e342b732cd5b78af4c59c2d3b1
Reproduction
Reproduced with the example app
https://github.com/BlueBazze/api.video-reactnative-live-stream
To cause the crash
- Open app
- Press "Go to broadcaster"
- Press the back button in the app bar
Video
https://drive.google.com/file/d/1uOoys-dEo5siEGvJx3yvyahj195arbM7/view?usp=sharing
Smartphone (please complete the following information):
- Device: ["Samsung A22", "Huawei p20 lite"]
- OS: ["Android 12", "Android 9"]
Additional context
You can hook into the lifecycle of react with the following
https://gist.github.com/BlueBazze/f371f26f21fefdbf1a9251038d727fe1
Wouldnt know how to reproduce this with a native app.
Hi,
Could you share the code of the Android example app so we can reproduced? You shared this : https://github.com/BlueBazze/api.video-android-live-stream but it is the same as api.video android live stream.
Forgot to run git push.
Updated the url
Hum... I don't reproduced it with my 2 phones...
About your crashlog, could you get all the trace? I guess in the current crashlog the crash and rtmpdroid have been filtered.
Additional context:
On Android, when SurfaceView is hidden, the android live stream stops the stream (incl. disconnection) and stops the preview. See stopStreaming
Maybe calling disconnect multiple times make the application crash?
Have you tried to reproduce this on the native part in the last tag (instead of the main branch)?
About your crashlog, could you get all the trace?
How would i get a trace for the crash? Normally it just prints it in the console.
Somehow i found i setting to set a breakpoint on exceptions.
Got two exceptions involving streampack.
The first exception
Stack trace: https://gist.github.com/BlueBazze/4092f57988973c1f400833f1fed016ac
Also the variables from the second step
Step at: https://gist.github.com/BlueBazze/4092f57988973c1f400833f1fed016ac#file-stack-trace-L4
Variables: https://gist.github.com/BlueBazze/14100bcb029b39181d343f54c5454d6e
All this is thrown a second time. With the only variable chaning being the bitrate.
The second exception
Stack trace: https://gist.github.com/BlueBazze/58fd994da1efe68606a0761ce1f624f7
This is thrown 10 times. After the 10th time the app crashes.
I am guessing the "not supported type" has something to do with the crash.
It is the exact same exceptions thrown on both (Samsung A22 android 12 & Huawei p20 lite android 9)
Hi,
About the first exception: IllegalStateException
There is indeed an IllegalStateException thrown by video encoder stopStream when encoder is not running, this is the normal behaviour of MediaCodec API but StreamPack catches this exception. (see https://github.com/ThibaultBee/StreamPack/blob/dc2680207dade2ea27c22e77beffb7d9450e00de/core/src/main/java/io/github/thibaultbee/streampack/internal/encoders/MediaCodecEncoder.kt#L218)
You are going to a wrong way, I can guarantee it is not an issue.
About the second exception
I notice that in your RN demo that StreamPack streamer is not released when leaving the broadcaster view. And when we are back on this view, we create another Streamer. As we don't explicitely call streamer.release, encoder sessions remain active till the system destroy them. When there are no more available encoder sessions the MediaCodec API throws this kind of exception.
In the native part, is there a way to detect when the broadcaster view has been dismiss?
On the end of your first crashlog there is a libc crash:
--------- beginning of crash
2022-08-30 11:29:51.000 16594-16594/video.api.reactnative.livestream.example A/libc: Pointer tag for 0x9201080c52012004 was truncated, see 'https://source.android.com/devices/tech/debug/tagged-pointers'.
2022-08-30 11:29:51.000 16594-16594/video.api.reactnative.livestream.example A/libc: Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 16594 (estream.example), pid 16594 (estream.example)
But the end of the crash trace is missing because you are filtering logcat with only your application logs.
Could you get the full logcat?
Hope these are what you want.
Samsung A22
https://gist.github.com/BlueBazze/6bdcea4492dfceac098b8f7671fe41be
Huawei p20 lite
https://gist.github.com/BlueBazze/d7c62d1133745672d73c655c75957423
Keep in mind that Huawei has some problems. It havent been updated since 2019 because of the ban.
In the native part, is there a way to detect when the broadcaster view has been dismiss?
Ive tried adding a lifecycle listener on the native component. Which does not seem to be called
One solution could be to have the component on the js side be a class component. Which would allow access to the lifecycle of react. And then exposing the release method to react for internal use. Meaning the end user wouldnt have access to this method.
So the crashtrace is:
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: Abort message: 'Pointer tag for 0x656c69666f7270 was truncated, see 'https://source.android.com/devices/tech/debug/tagged-pointers'.'
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x0 0000000000000000 x1 0000000000003d5a x2 0000000000000006 x3 0000007fff70e2b0
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x4 0000000080808080 x5 0000000080808080 x6 0000000080808080 x7 8080808000000000
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x8 00000000000000f0 x9 0000007f5e8a70d8 x10 0000000000000000 x11 ffffff80fffffbdf
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x12 0000000000000001 x13 00000000630f15db x14 0001ef91acca405b x15 0000000000000068
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x16 0000007f5e97ad20 x17 0000007f5e9559b0 x18 0000007f7c7bc000 x19 0000000000003d5a
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x20 0000000000003d5a x21 00000000ffffffff x22 0000007e4213c7f8 x23 0000000000001070
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x24 0000007ecbc00880 x25 0000007fff70e4b0 x26 0000007fff70e4b4 x27 0000007fff70e4b0
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: x28 0000007fff70e3b0 x29 0000007fff70e330
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: lr 0000007f5e9082f0 sp 0000007fff70e290 pc 0000007f5e908320 pst 0000000000001000
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: backtrace:
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #00 pc 0000000000089320 /apex/com.android.runtime/lib64/bionic/libc.so (abort+168) (BuildId: 340bbc2973157166cb11b540a6ac7a16)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #01 pc 0000000000047b58 /apex/com.android.runtime/lib64/bionic/**libc.so (free+96) **(BuildId: 340bbc2973157166cb11b540a6ac7a16)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #02 pc 0000000000003858 /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/lib/arm64/**librtmpdroid.so (nativeClose(_JNIEnv*, _jobject*)+252)** (BuildId: 36f4247b50f59e1b2af75b3fe0a31a71f5ca4a2f)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #03 pc 0000000000440554 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+148) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #04 pc 000000000020a2b0 /apex/com.android.art/lib64/libart.so (nterp_helper+4016) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #05 pc 00000000001d07f8 [anon:dalvik-classes11.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk!classes11.dex] (video.api.rtmpdroid.Rtmp.close+0)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #06 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #07 pc 000000000046b254 [anon:dalvik-classes.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk] (io.github.thibaultbee.streampack.ext.rtmp.internal.endpoints.RtmpProducer.disconnect+4)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #08 pc 000000000020b074 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #09 pc 000000000047f648 [anon:dalvik-classes.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk] (io.github.thibaultbee.streampack.streamers.live.BaseCameraLiveStreamer.disconnect+4)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #10 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #11 pc 00000000001cf352 [anon:dalvik-classes11.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk!classes11.dex] (video.api.livestream.ApiVideoLiveStream.stopStreaming+14)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #12 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #13 pc 00000000001ceaba [anon:dalvik-classes11.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk!classes11.dex] (video.api.livestream.ApiVideoLiveStream$surfaceCallback$1.surfaceDestroyed+14)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #14 pc 000000000020b120 /apex/com.android.art/lib64/libart.so (nterp_helper+7712) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #15 pc 000000000041abce /system/framework/framework.jar (android.view.SurfaceView.notifySurfaceDestroyed+158)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #16 pc 000000000020a958 /apex/com.android.art/lib64/libart.so (nterp_helper+5720) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #17 pc 000000000041bfce /system/framework/framework.jar (android.view.SurfaceView.updateSurface+1506)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #18 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #19 pc 000000000041afd2 /system/framework/framework.jar (android.view.SurfaceView.onWindowVisibilityChanged+150)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #20 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #21 pc 000000000045c5f2 /system/framework/framework.jar (android.view.View.dispatchDetachedFromWindow+22)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #22 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #23 pc 000000000043053a /system/framework/framework.jar (android.view.ViewGroup.dispatchDetachedFromWindow+70)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #24 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #25 pc 000000000043053a /system/framework/framework.jar (android.view.ViewGroup.dispatchDetachedFromWindow+70)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #26 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #27 pc 000000000042fc96 /system/framework/framework.jar (android.view.ViewGroup.clearDisappearingChildren+42)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #28 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #29 pc 0000000000430546 /system/framework/framework.jar (android.view.ViewGroup.dispatchDetachedFromWindow+82)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #30 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #31 pc 000000000042fc96 /system/framework/framework.jar (android.view.ViewGroup.clearDisappearingChildren+42)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #32 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #33 pc 0000000000430546 /system/framework/framework.jar (android.view.ViewGroup.dispatchDetachedFromWindow+82)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #34 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #35 pc 000000000043053a /system/framework/framework.jar (android.view.ViewGroup.dispatchDetachedFromWindow+70)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #36 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #37 pc 0000000000431718 /system/framework/framework.jar (android.view.ViewGroup.endViewTransition+80)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #38 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #39 pc 000000000000b71a [anon:dalvik-classes7.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk!classes7.dex] (com.swmansion.rnscreens.ScreenStack.endViewTransition+10)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #40 pc 000000000020a254 /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 1038-15867/? I/aaa_common_custom.cpp: [cust_shotConditionForSEC][param in], idx(0), facing(0), BV(0), gain(6.000000), zoomRto(0.000000), hdrState(0), isFlash(0), shootingmode(0), gyro(0)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #41 pc 0000000000294f2c [anon:dalvik-classes.dex extracted in memory from /data/app/~~qfknTFFsiZKI9Y9MQTp7lg==/video.api.reactnative.livestream.example-7vfl6IPnuXTN4W6B8Z8rIQ==/base.apk] (androidx.fragment.app.DefaultSpecialEffectsController$4$1.run+16)
2022-08-31 10:03:39.552 1038-15867/? I/aaa_common_custom.cpp: [cust_shotConditionForSEC] jpegW/H(0/0), bIsSECApplication(0)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #42 pc 000000000020b074 /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.552 15941-15941/? A/DEBUG: #43 pc 000000000048ce2c /system/framework/framework.jar (android.os.Handler.handleCallback+4)
2022-08-31 10:03:39.552 1038-15867/? I/aaa_common_custom.cpp: [cust_refineHdrStateByLLSFlag][param in] idx(0), i4LiveHdrState(0)
2022-08-31 10:03:39.553 15941-15941/? A/DEBUG: #44 pc 0000000000209334 /apex/com.android.art/lib64/libart.so (nterp_helper+52) (BuildId: 56e704c544e6c624201be2ab4933e853)
2022-08-31 10:03:39.553 1038-15867/? I/aaa_common_custom.cpp: [cust_refineHdrStateByLLSFlag][param out] idx(0), ret(0), i4LiveHdrState(0), curLlsFlag(0), c0(0), c1(0)
2022-08-31 10:03:39.553 15941-15941/? A/DEBUG: #45 pc 000000000048cca0 /system/framework/framework.jar (android.os.Handler.dispatchMessage+8)
2022-08-31 10:03:39.553 15941-15941/? A/DEBUG: #46 pc 000000000200fffc /memfd:jit-cache (deleted)
2022-08-31 10:03:39.554 1038-15845/? I/Hal3Av3: [setNormal] SEC_vtmode(0)
Which is here:
https://github.com/apivideo/api.video-rtmpdroid/blob/46ba78ceac89e7c97bd6460727ca749bc05a6c79/lib/src/main/cpp/glue.cpp#L182
But I don't understand why...
Could you add this in your AndroidManifest.xml?
<application android:allowNativeHeapPointerTagging="false">
...
</application>
Android documentation specified:
If your app crashed and you were prompted with this link, it could mean one of the following:
- The application tried to free a pointer that wasn't allocated by the system's heap allocator.
- Something in your app modified the top byte of a pointer. The top byte of the pointer can't be modified and your code needs to be changed to fix this issue.
Found this function in the viewManager
override fun onDropViewInstance(view: ReactNativeLiveStreamView) {
Log.d("RTMPDEBUG", "DropView")
view.release()
super.onDropViewInstance(view)
}
Which is being called before the crash. But it is still crashing
Could you add this in your AndroidManifest.xml?
That does "fix" it.
The documentation also mentions
This will disable the Pointer Tagging feature for your application.
Please note that this does not address the underlying code
health problem. This escape hatch will disappear in future versions of Android,
because issues of this nature will be incompatible
with [MTE](https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html).
Could you add this in your AndroidManifest.xml?
That does "fix" it. The documentation also mentions
This will disable the Pointer Tagging feature for your application. Please note that this does not address the underlying code health problem. This escape hatch will disappear in future versions of Android, because issues of this nature will be incompatible with [MTE](https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html).
Yes. It is just a workaround.
Yeah, sort of.
I just dont have any way of editing the manifest with expo.
But, i can put off a conversion to this package on android.
I don't understand why I don't fell into this crash with my Pixel 4... Why does it only happen with RN?
Are you doing something specific?
I showed the video when I originally posted. What I am doing to cause the crash. Navigate to the camera page, then navigate back.
Can test on pixel 6. But not until weekend next week.
This morning I tried with a clean clone of the repro. The only changes I had locally. Was .yarn folder and .yarnrc.yml.
Using the command 'yarn set version classic'.
Because I am using yarn berry globally.
But it really should have anything to do with it.
Can try to build from Windows later. Reading another problem earlier one had had a problem on Linux where another couldn't reproduce on windows.
There is probably a corrupt pointer that randomly crash when it is freed (already freed?) in rtmpdroid.
However, I can't reproduced it... so I can't fix it.
Waiting for way to reproduce it.
Gonna take a look at a new repro tomorrow. And still missing the Google 5 or 6 i promised
This should be fixed in v1.2.1
Please reopen it if it is not fixed.