Topic: SIGSEGV crash with AudioRecord

[skullptr]

We've got many reports recently with crashes on Redmi Note 11 Pro/Lite 5G devices, Android 13. I have the same device and reproduced it multiple times. Occurs randomly (immediately or after few minutes). Any ideas why this could happen? Could it be related to BASS library (version 2.4.17.21)?

Code: [Select]

--------- beginning of crash
12-28 12:45:34.399   656   656 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 656 (init), pid 656 (init)
12-28 12:45:34.411   656   656 F libc    : crash_dump helper failed to exec, or was killed
04-23 19:38:05.234  2013  2013 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 2013 (init), pid 2013 (init)
04-23 19:38:05.345  2013  2013 F libc    : crash_dump helper failed to exec, or was killed
04-23 19:40:08.653 11425 11816 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x70d3ec9000 in tid 11816 (AudioRecord), pid 11425 (om.alfaview.app)
04-23 19:40:09.895 11827 11827 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-23 19:40:09.895 11827 11827 F DEBUG   : Build fingerprint: 'Xiaomi/courbet_eea/courbet:13/TKQ1.221013.002/V14.0.2.0.TKQEUXM:user/release-keys'
04-23 19:40:09.895 11827 11827 F DEBUG   : Revision: '0'
04-23 19:40:09.895 11827 11827 F DEBUG   : ABI: 'arm64'
04-23 19:40:09.896 11827 11827 F DEBUG   : Timestamp: 2024-04-23 19:40:08.893149384+0300
04-23 19:40:09.896 11827 11827 F DEBUG   : Process uptime: 36s
04-23 19:40:09.896 11827 11827 F DEBUG   : Cmdline: com.alfaview.app
04-23 19:40:09.896 11827 11827 F DEBUG   : pid: 11425, tid: 11816, name: AudioRecord  >>> com.alfaview.app <<<
04-23 19:40:09.896 11827 11827 F DEBUG   : uid: 10465
04-23 19:40:09.896 11827 11827 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00000070d3ec9000
04-23 19:40:09.896 11827 11827 F DEBUG   :     x0  0000006f88ad9400  x1  00000070d3ec8ec0  x2  0000000000000240  x3  0000006f8949bac0
04-23 19:40:09.896 11827 11827 F DEBUG   :     x4  0000006f88ff8640  x5  0000006f8949bb40  x6  3a08000039e00000  x7  3a2800003a080000
04-23 19:40:09.896 11827 11827 F DEBUG   :     x8  0000000000000120  x9  0000000000000120  x10 00000070d3ec9010  x11 0000000000000080
04-23 19:40:09.896 11827 11827 F DEBUG   :     x12 39a000003a080000  x13 3a08000039e00000  x14 0000000000000000  x15 00000070d3ec8ec0
04-23 19:40:09.897 11827 11827 F DEBUG   :     x16 00000070def449f0  x17 00000070deeb93b8  x18 0000006f70d1c000  x19 0000006f88ad9400
04-23 19:40:09.897 11827 11827 F DEBUG   :     x20 0000006f71467000  x21 ffffffffffffffff  x22 0000000000000000  x23 0000006f71466a88
04-23 19:40:09.897 11827 11827 F DEBUG   :     x24 00000070def41bf0  x25 0000000000000240  x26 0000000000000240  x27 0000006f88ad96a8
04-23 19:40:09.897 11827 11827 F DEBUG   :     x28 0000006f71467000  x29 0000006f71466a10
04-23 19:40:09.897 11827 11827 F DEBUG   :     lr  00000070deeb88ac  sp  0000006f714669a0  pc  00000070deeb9430  pst 0000000020000000
04-23 19:40:09.897 11827 11827 F DEBUG   : backtrace:
04-23 19:40:09.897 11827 11827 F DEBUG   :       #00 pc 000000000006a430  /system/lib64/libaudioclient.so (android::AudioRecord::isLongTimeZeroData(void const*, int)+120) (BuildId: fe361001217545e64f3e8ff0b385ef80)
04-23 19:40:09.897 11827 11827 F DEBUG   :       #01 pc 00000000000698a8  /system/lib64/libaudioclient.so (android::AudioRecord::processAudioBuffer()+1752) (BuildId: fe361001217545e64f3e8ff0b385ef80)
04-23 19:40:09.897 11827 11827 F DEBUG   :       #02 pc 0000000000068ed8  /system/lib64/libaudioclient.so (android::AudioRecord::AudioRecordThread::threadLoop()+288) (BuildId: fe361001217545e64f3e8ff0b385ef80)
04-23 19:40:09.897 11827 11827 F DEBUG   :       #03 pc 0000000000013454  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+424) (BuildId: 6cc789a5db76fed354200c8693268976)
04-23 19:40:09.897 11827 11827 F DEBUG   :       #04 pc 00000000000ceb84  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+144) (BuildId: 978c8d30489ae13b147af6006796c8ce)
04-23 19:40:09.897 11827 11827 F DEBUG   :       #05 pc 00000000000f55c8  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 449f781894033dce6346794a1ee593e0)
04-23 19:40:09.897 11827 11827 F DEBUG   :       #06 pc 000000000008efbc  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 449f781894033dce6346794a1ee593e0)

[Ian @ un4seen]

From the call stack, it looks like the crash is in Android's AudioRecord class. Are you using that class anywhere in your code? BASS doesn't use it directly, but I believe it is used internally for recording by OpenSLES (which BASS does use). If you aren't using the AudioRecord class, can you confirm that the crash is happening while BASS is recording, ie. after BASS_RecordStart is called? And if so, does it still happen if your RECORDPROC callback function does nothing except "return true"?

[skullptr]

Thanks for the quick reply! For audio capture/playback we rely only on BASS, we don't use Android audio APIs. The crash is still reprodiciable with empty RECORDPROC (but with "return TRUE") used in BASS_RecordStart.

[Ian @ un4seen]

OK. I will send you a debug BASS version to get more info on what's happening.