▲

[blacey]

Hi,

We've had a stubborn intermittent crash on iOS (and maybe Android) that I've been trying to find a fix for, and I was wondering if you had any insights on what may be the cause.  From logs I've been able to piece together what might be causing this:

* Start playback of a remote stream via HTTPS (BASS_StreamCreateURL with BASS_STREAM_AUTOFREE)
* Before the download is complete, skip to the next track (which calls BASS_ChannelStop() for the active stream at the time of the skip)
* Sometimes this call to BASS_ChannelStop will cause a crash

The stack trace of the crash is:

Code SelectExpand

Crashed: Thread #1
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000000000000
0 CoreFoundation CF_IS_OBJC + 24
1 CoreFoundation CFReadStreamRead + 64
2 bass (Missing UUID deb682f5abbe39d5a0f88c01c14e178a)
3 bass BASS_ChannelLock + 952
4 bass BASS_ChannelLock + 4220
5 bass BASS_ChannelLock + 5068
6 bass BASS_ChannelLock + 5684
7 libsystem_pthread.dylib _pthread_start + 136
8 libsystem_pthread.dylib thread_start + 8

My interpretation of the crash is that something inside BASS has been freed but then later an iOS callback relating to the HTTP request is coming in, and BASS is trying to reference an already deallocated object.

I've experimented with not using BASS_STREAM_AUTOFREE and freeing ourselves (after a timer) but that could still lead to crashes when the HTTP connection is slow.

https://1drv.ms/u/c/657c27e0f0b5d20f/ERiIZMCXYOZBnVSHM2PmXosBl2Y578K4aSJ5emP2kaVXMA?e=9z185Ux

The iOS project linked above is an unrealistic torture test but does seem to recreate the same crash, sometimes quite quickly but it can take quite a few cycles after tapping 'Play'.  The BassStreamer code is a cut-down version of our production code, so please excuse any dead code you might find.

We do also see potentially similar crashes referencing BASS_ChannelStop on Android also, but I've not been able to reproduce the issue as I have on iOS, so it may be something that affects both platforms.  I can provide an example Android stack trace if desired.

Hopefully there's some insight you can give, either into something we're doing that's causing it or something you can tweak inside BASS, as it's currently our number 1 crash and I'd love to solve it!

[Ian @ un4seen]

That looks like a bug in the stream freeing code that may set a CFReadStreamRef handle (used in CFReadStreamRead calls on iOS/macOS) to 0 while the stream's download thread is still using it. That's fixed in the latest builds, available here:

   www.un4seen.com/stuff/bass-ios.zip
   www.un4seen.com/stuff/bass-osx.zip

Android isn't affected by that, but the latest Android build does have some other fixes:

   www.un4seen.com/stuff/bass-android.zip

If you still get crashing with that, please do post some details (eg. call stack) to investigate.

[blacey]

Fantastic, thanks Ian - that updated version has passed my torture test with flying colours!  Are those binaries suitable for production release?  I've got a release going out soon so it'd be great to be able to get this fix in.

On the Android crash, I'll pull the updated version in and see if crash reports reduce, but the stack trace I've been able to pull from the Play Store (it escapes Crashlytics) is as follows just in case you can see something:

Code SelectExpand

Scudo ERROR: invalid chunk state when deallocating address 0x<sanitized>

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 21079 >>> com.xxxxxxxxxxxxxxxxx <<<

backtrace:
  #00  pc 0x000000000005b730  /apex/com.android.runtime/lib64/bionic/libc.so (abort+168)
  #01  pc 0x0000000000048f20  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::die()+12)
  #02  pc 0x00000000000498a8  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::ScopedErrorReport::~ScopedErrorReport()+36)
  #03  pc 0x0000000000049da4  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::reportInvalidChunkState(scudo::AllocatorAction, void*)+120)
  #04  pc 0x000000000004b838  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::deallocate(void*, scudo::Chunk::Origin, unsigned long, unsigned long)+316)
  #05  pc 0x000000000001c1e0  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #06  pc 0x0000000000028e6c  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #07  pc 0x0000000000022814  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BASS_ChannelStop+96) (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #08  pc 0x00000000000227a8  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (Java_com_un4seen_bass_BASS_BASS_1ChannelStop+8) (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #09  pc 0x000000000033b02c  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+108)
  #10  pc 0x000000000077e908  /apex/com.android.art/lib64/libart.so (nterp_helper+152)
  #11  pc 0x0000000000262412  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Gn.n+270)
  #12  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #13  pc 0x0000000000262128  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Gn.k+12)
  #14  pc 0x00000000007805e4  /apex/com.android.art/lib64/libart.so (nterp_helper+7540)
  #15  pc 0x0000000000254172  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Ul.U+234)
  #16  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #17  pc 0x0000000000252b2a  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Ul.u+202)
  #18  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #19  pc 0x0000000000253178  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Ul.H+164)
  #20  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #21  pc 0x000000000025ffca  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (xn.SYNCPROC+122)
  #22  pc 0x0000000000362774  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612)
  #23  pc 0x00000000003610a0  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+812)
  #24  pc 0x0000000000726eb0  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallVoidMethodV(_JNIEnv*, _jobject*, _jmethodID*, std::__va_list)+192)
  #25  pc 0x000000000001ac30  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #26  pc 0x000000000002c6e8  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #27  pc 0x0000000000017658  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #28  pc 0x00000000000c3914  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)
  #29  pc 0x000000000005d084  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68)


[Ian @ un4seen]

Fantastic, thanks Ian - that updated version has passed my torture test with flying colours!  Are those binaries suitable for production release?  I've got a release going out soon so it'd be great to be able to get this fix in.

Good to hear the update does indeed fix your issue. It is a "release" build and basically a BASS 2.4.18 pre-release, so should be fine to use in production.

On the Android crash, I'll pull the updated version in and see if crash reports reduce, but the stack trace I've been able to pull from the Play Store (it escapes Crashlytics) is as follows just in case you can see something:

Code SelectExpand

Scudo ERROR: invalid chunk state when deallocating address 0x<sanitized>

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 21079 >>> com.xxxxxxxxxxxxxxxxx <<<

backtrace:
  #00  pc 0x000000000005b730  /apex/com.android.runtime/lib64/bionic/libc.so (abort+168)
  #01  pc 0x0000000000048f20  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::die()+12)
  #02  pc 0x00000000000498a8  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::ScopedErrorReport::~ScopedErrorReport()+36)
  #03  pc 0x0000000000049da4  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::reportInvalidChunkState(scudo::AllocatorAction, void*)+120)
  #04  pc 0x000000000004b838  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::deallocate(void*, scudo::Chunk::Origin, unsigned long, unsigned long)+316)
  #05  pc 0x000000000001c1e0  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #06  pc 0x0000000000028e6c  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #07  pc 0x0000000000022814  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BASS_ChannelStop+96) (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #08  pc 0x00000000000227a8  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (Java_com_un4seen_bass_BASS_BASS_1ChannelStop+8) (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #09  pc 0x000000000033b02c  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+108)
  #10  pc 0x000000000077e908  /apex/com.android.art/lib64/libart.so (nterp_helper+152)
  #11  pc 0x0000000000262412  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Gn.n+270)
  #12  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #13  pc 0x0000000000262128  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Gn.k+12)
  #14  pc 0x00000000007805e4  /apex/com.android.art/lib64/libart.so (nterp_helper+7540)
  #15  pc 0x0000000000254172  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Ul.U+234)
  #16  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #17  pc 0x0000000000252b2a  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Ul.u+202)
  #18  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #19  pc 0x0000000000253178  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (Ul.H+164)
  #20  pc 0x000000000077f7c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924)
  #21  pc 0x000000000025ffca  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/base.apk (xn.SYNCPROC+122)
  #22  pc 0x0000000000362774  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612)
  #23  pc 0x00000000003610a0  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+812)
  #24  pc 0x0000000000726eb0  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallVoidMethodV(_JNIEnv*, _jobject*, _jmethodID*, std::__va_list)+192)
  #25  pc 0x000000000001ac30  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #26  pc 0x000000000002c6e8  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #27  pc 0x0000000000017658  /data/app/~~0ujtx4zsOs_nWRzHn6ofxg==/com.xxxxxxxxxxxxxxxxx-26yGsdMYU_e-yxB_eztgeA==/split_config.arm64_v8a.apk!libbass.so (BuildId: f8a85e0d7037a2b8555dbea9e6433da886cf09e2)
  #28  pc 0x00000000000c3914  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)
  #29  pc 0x000000000005d084  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68)


It appears that BASS tried to free a stream's HTTP headers twice there, and it does look like that could happen if a stream's connection to a server died and BASS auto-reconnected to download the rest. Here's an update for that:

    www.un4seen.com/stuff/bass-android.zip

Let me know if you still see the crash happening. This issue wouldn't affect the iOS version, so no additional update needed there.

[blacey]

Thanks for the update, I'll push out the new binaries in our upcoming release and see what gets reported in the various systems - if I get any more stack traces I'll bump the thread and see if you can make sense of them!

[blacey]

So the updated binaries have been out for nearly a week, and the two issues mentioned do seem to have been solved - no more crashes with those stack traces.

However we've got two others that have come in with this release, one on iOS and one on Android - do you see anything in the following stack traces that could be causing problems?

iOS

Code SelectExpand

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x000000021551c61c
Termination Reason: SIGNAL 5 Trace/BPT trap: 5
Terminating Process: exc handler [86680]

Thread 21 Crashed:
0   caulk                          0x000000021551c61c caulk::thread::join() + 104 (thread.cpp:104)
1   libEmbeddedSystemAUs.dylib    0x00000002203aaca0 std::__1::__shared_ptr_emplace<AURemoteIO::IOThread, std::__1::allocator<AURemoteIO::IOThread>>::__on_zero_shared() + 28 (shared_ptr.h:288)
2   libEmbeddedSystemAUs.dylib    0x00000002203aabb8 std::__1::__shared_weak_count::__release_shared[abi:ne190102]() + 76 (shared_ptr.h:187)
3   libEmbeddedSystemAUs.dylib    0x00000002203aa874 AURemoteIO::Stop() + 1560 (AURemoteIO.cpp:1714)
4   libEmbeddedSystemAUs.dylib    0x00000002203b1e0c ausdk::AUMethodStop(void*) + 120 (AUPlugInDispatch.cpp:482)
5   bass                          0x0000000105ea7450 0x105ea0000 + 29776
6   libEmbeddedSystemAUs.dylib    0x00000002203a51c8 ausdk::AUInputElement::PullInput(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 180 (AUInputElement.cpp:81)
7   libEmbeddedSystemAUs.dylib    0x00000002203a4fb4 AUInputFormatConverter2::InputProc(OpaqueAudioConverter*, unsigned int*, AudioBufferList*, AudioStreamPacketDescription**, void*) + 160 (AUInputFormatConverter2.h:283)
8   AudioToolboxCore              0x000000019536d7f0 caulk::expected<unsigned int, int> caulk::function_ref<caulk::expected<unsigned int, int> (ACAudioSpan&)>::functor_invoker<acv2::AudioConverterV2::fillComplexBuffer(int (*)(OpaqueAudioConverter*, u... + 152 (function_ref.h:126)
9   AudioToolboxCore              0x000000019536bdec acv2::AudioConverterChain::ObtainInput(acv2::AudioConverterBase&, unsigned int) + 792 (CompositeAudioConverter.cpp:1261)
10  AudioToolboxCore              0x000000019536b8e0 acv2::CBRConverter::ProduceOutput(ACAudioSpan&) + 52 (CBRConverter.cpp:88)
11  AudioToolboxCore              0x000000019536b130 acv2::AudioConverterChain::ProduceOutput(caulk::function_ref<caulk::expected<unsigned int, int> (ACAudioSpan&)>, ACBaseAudioSpan&) + 168 (CompositeAudioConverter.cpp:1146)
12  AudioToolboxCore              0x0000000195369d48 acv2::AudioConverterV2::fillComplexBuffer(int (*)(OpaqueAudioConverter*, unsigned int*, AudioBufferList*, AudioStreamPacketDescription**, void*), void*, unsigned int*, AudioBufferList*, AudioStream... + 688 (AudioConverter.cpp:474)
13  AudioToolboxCore              0x0000000195369968 int caulk::function_ref<int (AudioConverterAPI*)>::functor_invoker<AudioConverterFillComplexBuffer::$_0>(caulk::details::erased_callable<int (AudioConverterAPI*)> const&, AudioConverterAPI*) + 108 (function_ref.h:126)
14  AudioToolboxCore              0x000000019536501c with_resolved(OpaqueAudioConverter*, caulk::function_ref<int (AudioConverterAPI*)>) + 60 (AudioConverter.cpp:1155)
15  AudioToolboxCore              0x0000000195373608 AudioConverterFillComplexBuffer + 88 (AudioConverter.cpp:1268)
16  libEmbeddedSystemAUs.dylib    0x00000002203a59ac AUConverterBase::RenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 932 (AUConverterBase.cpp:816)
17  libEmbeddedSystemAUs.dylib    0x00000002203a4afc AURemoteIO::RenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 196 (AURemoteIO.cpp:1942)
18  libEmbeddedSystemAUs.dylib    0x00000002203a4708 ausdk::AUBase::DoRender(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int, AudioBufferList&) + 1976 (AUBase.cpp:1259)
19  libEmbeddedSystemAUs.dylib    0x00000002203a6a10 AURemoteIO::PerformIO(unsigned int, unsigned int, unsigned int, AudioTimeStamp const&, AudioTimeStamp const&, AudioBufferList const*, AudioBufferList*, int&) + 1256 (AURemoteIO.cpp:1903)
20  libEmbeddedSystemAUs.dylib    0x00000002203a6004 _XPerformIO + 348 (AURemoteIOCallbacksServer.c:178)
21  libAudioToolboxUtility.dylib  0x00000001b13895d4 mshMIGPerform + 284 (MachServerHelper.c:453)
22  libAudioToolboxUtility.dylib  0x00000001b13894ac MSHMIGDispatchMessage + 36 (MachServerHelper.c:524)
23  libEmbeddedSystemAUs.dylib    0x00000002203b27a4 void* caulk::thread_proxy<std::__1::tuple<caulk::thread::attributes, AURemoteIO::IOThread::IOThread(AURemoteIO&, caulk::thread::attributes const&, caulk::mach::os_workgroup_managed const&)::'lambda... + 580 (thread.h:197)
24  libsystem_pthread.dylib        0x00000002123c2afc _pthread_start + 136 (pthread.c:931)
25  libsystem_pthread.dylib        0x00000002123c2a04 thread_start + 8 (:-1)

Thread 21 crashed with ARM Thread State (64-bit):
    x0: 0x000000013ca9cd80   x1: 0x0000000000000000   x2: 0xfffffffffffffff3   x3: 0x000000013ca9cd93
    x4: 0x0000000030065308   x5: 0x0000000000000020   x6: 0x00000000005660a2   x7: 0xd9ccb9df98023aa5
    x8: 0x00000001f16e7000   x9: 0xf846e9ff113b004f  x10: 0x0000000000000000  x11: 0x00000000005660a2
   x12: 0x0000000000000ace  x13: 0x000000013ca9c000  x14: 0x0000000000000001  x15: 0xffffffffb00007ff
   x16: 0x000000018fe0353c  x17: 0x00000001f62d82d0  x18: 0x0000000000000000  x19: 0x000000013d4aeaf0
   x20: 0x00000001f396c040  x21: 0x000000013d4aea98  x22: 0x000000026ecb2000  x23: 0x000000013d4aea80
   x24: 0x0000000000000000  x25: 0x000000013cbe48c0  x26: 0x00000001224a02f8  x27: 0x000000016cb02568
   x28: 0x000000013ce39380   fp: 0x000000016cb02290   lr: 0x000000021551c61c
    sp: 0x000000016cb02280   pc: 0x000000021551c61c cpsr: 0x60000000
   esr: 0xf2000001 (Breakpoint) brk 1

Android

Affects Android 13, 14, 15 - seems deep down in the Android code, but could something have changed here?  It doesn't seem to affect the previous version, at least according to my best Google Play console digging.

Code SelectExpand

Binder thread started or Java binder used, but env null. Attach JVM?

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 5234 >>> com.bowerswilkins.splice <<<

backtrace:
  #00  pc 0x0000000000059bb8  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164)
  #01  pc 0x000000000076fa40  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort(char const*)+120)
  #02  pc 0x00000000000357d0  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter(std::__1::function<void (char const*)>&&)::$_0::__invoke(char const*)+80)
  #03  pc 0x0000000000006ec8  /system/lib64/liblog.so (__android_log_assert+308)
  #04  pc 0x0000000000199abc  /system/lib64/libandroid_runtime.so (JavaBBinder::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+592)
  #05  pc 0x000000000007476c  /system/lib64/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+304)
  #06  pc 0x0000000000051308  /system/lib64/libmedia.so (android::BpMediaHTTPConnection::disconnect()+284)
  #07  pc 0x000000000001d080  /system/lib64/libdatasource.so (android::MediaHTTP::disconnect()+120)
  #08  pc 0x00000000001ae434  /system/lib64/libstagefright.so (android::NuMediaExtractor::~NuMediaExtractor()+636)
  #09  pc 0x00000000001ae1a4  /system/lib64/libstagefright.so (android::NuMediaExtractor::~NuMediaExtractor()+16)
  #10  pc 0x000000000001003c  /system/lib64/libutils.so (android::RefBase::decStrong(void const*) const+108)
  #11  pc 0x00000000000221b4  /system/lib64/libmediandk.so (AMediaExtractor_delete.cfi+140)
  #12  pc 0x0000000000028828  /data/app/~~ckFUpzH1wRuz6AWLtYExDA==/com.xxxxxxxxxxxxxxxxx-5WdMfoNpwJeCCM0yMy0gsw==/split_config.arm64_v8a.apk!libbass.so (BuildId: 4d4ef2f9395cac80582f8ecd31a5f5a35262111a)
  #13  pc 0x000000000001c6c4  /data/app/~~ckFUpzH1wRuz6AWLtYExDA==/com.xxxxxxxxxxxxxxxxx-5WdMfoNpwJeCCM0yMy0gsw==/split_config.arm64_v8a.apk!libbass.so (BuildId: 4d4ef2f9395cac80582f8ecd31a5f5a35262111a)
  #14  pc 0x00000000000259fc  /data/app/~~ckFUpzH1wRuz6AWLtYExDA==/com.xxxxxxxxxxxxxxxxx-5WdMfoNpwJeCCM0yMy0gsw==/split_config.arm64_v8a.apk!libbass.so (BuildId: 4d4ef2f9395cac80582f8ecd31a5f5a35262111a)
  #15  pc 0x00000000000be908  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)
  #16  pc 0x000000000005b3f0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)


[Ian @ un4seen]

Code SelectExpand

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x000000021551c61c
Termination Reason: SIGNAL 5 Trace/BPT trap: 5
Terminating Process: exc handler [86680]

Thread 21 Crashed:
0  caulk                            0x000000021551c61c caulk::thread::join() + 104 (thread.cpp:104)
1  libEmbeddedSystemAUs.dylib        0x00000002203aaca0 std::__1::__shared_ptr_emplace<AURemoteIO::IOThread, std::__1::allocator<AURemoteIO::IOThread>>::__on_zero_shared() + 28 (shared_ptr.h:288)
2  libEmbeddedSystemAUs.dylib        0x00000002203aabb8 std::__1::__shared_weak_count::__release_shared[abi:ne190102]() + 76 (shared_ptr.h:187)
3  libEmbeddedSystemAUs.dylib        0x00000002203aa874 AURemoteIO::Stop() + 1560 (AURemoteIO.cpp:1714)
4  libEmbeddedSystemAUs.dylib        0x00000002203b1e0c ausdk::AUMethodStop(void*) + 120 (AUPlugInDispatch.cpp:482)
5  bass                              0x0000000105ea7450 0x105ea0000 + 29776
6  libEmbeddedSystemAUs.dylib        0x00000002203a51c8 ausdk::AUInputElement::PullInput(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 180 (AUInputElement.cpp:81)
7  libEmbeddedSystemAUs.dylib        0x00000002203a4fb4 AUInputFormatConverter2::InputProc(OpaqueAudioConverter*, unsigned int*, AudioBufferList*, AudioStreamPacketDescription**, void*) + 160 (AUInputFormatConverter2.h:283)
8  AudioToolboxCore                  0x000000019536d7f0 caulk::expected<unsigned int, int> caulk::function_ref<caulk::expected<unsigned int, int> (ACAudioSpan&)>::functor_invoker<acv2::AudioConverterV2::fillComplexBuffer(int (*)(OpaqueAudioConverter*, u... + 152 (function_ref.h:126)
9  AudioToolboxCore                  0x000000019536bdec acv2::AudioConverterChain::ObtainInput(acv2::AudioConverterBase&, unsigned int) + 792 (CompositeAudioConverter.cpp:1261)
10  AudioToolboxCore                  0x000000019536b8e0 acv2::CBRConverter::ProduceOutput(ACAudioSpan&) + 52 (CBRConverter.cpp:88)
11  AudioToolboxCore                  0x000000019536b130 acv2::AudioConverterChain::ProduceOutput(caulk::function_ref<caulk::expected<unsigned int, int> (ACAudioSpan&)>, ACBaseAudioSpan&) + 168 (CompositeAudioConverter.cpp:1146)
12  AudioToolboxCore                  0x0000000195369d48 acv2::AudioConverterV2::fillComplexBuffer(int (*)(OpaqueAudioConverter*, unsigned int*, AudioBufferList*, AudioStreamPacketDescription**, void*), void*, unsigned int*, AudioBufferList*, AudioStream... + 688 (AudioConverter.cpp:474)
13  AudioToolboxCore                  0x0000000195369968 int caulk::function_ref<int (AudioConverterAPI*)>::functor_invoker<AudioConverterFillComplexBuffer::$_0>(caulk::details::erased_callable<int (AudioConverterAPI*)> const&, AudioConverterAPI*) + 108 (function_ref.h:126)
14  AudioToolboxCore                  0x000000019536501c with_resolved(OpaqueAudioConverter*, caulk::function_ref<int (AudioConverterAPI*)>) + 60 (AudioConverter.cpp:1155)
15  AudioToolboxCore                  0x0000000195373608 AudioConverterFillComplexBuffer + 88 (AudioConverter.cpp:1268)
16  libEmbeddedSystemAUs.dylib        0x00000002203a59ac AUConverterBase::RenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 932 (AUConverterBase.cpp:816)
17  libEmbeddedSystemAUs.dylib        0x00000002203a4afc AURemoteIO::RenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 196 (AURemoteIO.cpp:1942)
18  libEmbeddedSystemAUs.dylib        0x00000002203a4708 ausdk::AUBase::DoRender(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int, AudioBufferList&) + 1976 (AUBase.cpp:1259)
19  libEmbeddedSystemAUs.dylib        0x00000002203a6a10 AURemoteIO::PerformIO(unsigned int, unsigned int, unsigned int, AudioTimeStamp const&, AudioTimeStamp const&, AudioBufferList const*, AudioBufferList*, int&) + 1256 (AURemoteIO.cpp:1903)
20  libEmbeddedSystemAUs.dylib        0x00000002203a6004 _XPerformIO + 348 (AURemoteIOCallbacksServer.c:178)
21  libAudioToolboxUtility.dylib      0x00000001b13895d4 mshMIGPerform + 284 (MachServerHelper.c:453)
22  libAudioToolboxUtility.dylib      0x00000001b13894ac MSHMIGDispatchMessage + 36 (MachServerHelper.c:524)
23  libEmbeddedSystemAUs.dylib        0x00000002203b27a4 void* caulk::thread_proxy<std::__1::tuple<caulk::thread::attributes, AURemoteIO::IOThread::IOThread(AURemoteIO&, caulk::thread::attributes const&, caulk::mach::os_workgroup_managed const&)::'lambda... + 580 (thread.h:197)
24  libsystem_pthread.dylib          0x00000002123c2afc _pthread_start + 136 (pthread.c:931)
25  libsystem_pthread.dylib          0x00000002123c2a04 thread_start + 8 (:-1)

Thread 21 crashed with ARM Thread State (64-bit):
    x0: 0x000000013ca9cd80  x1: 0x0000000000000000  x2: 0xfffffffffffffff3  x3: 0x000000013ca9cd93
    x4: 0x0000000030065308  x5: 0x0000000000000020  x6: 0x00000000005660a2  x7: 0xd9ccb9df98023aa5
    x8: 0x00000001f16e7000  x9: 0xf846e9ff113b004f  x10: 0x0000000000000000  x11: 0x00000000005660a2
  x12: 0x0000000000000ace  x13: 0x000000013ca9c000  x14: 0x0000000000000001  x15: 0xffffffffb00007ff
  x16: 0x000000018fe0353c  x17: 0x00000001f62d82d0  x18: 0x0000000000000000  x19: 0x000000013d4aeaf0
  x20: 0x00000001f396c040  x21: 0x000000013d4aea98  x22: 0x000000026ecb2000  x23: 0x000000013d4aea80
  x24: 0x0000000000000000  x25: 0x000000013cbe48c0  x26: 0x00000001224a02f8  x27: 0x000000016cb02568
  x28: 0x000000013ce39380  fp: 0x000000016cb02290  lr: 0x000000021551c61c
    sp: 0x000000016cb02280  pc: 0x000000021551c61c cpsr: 0x60000000
  esr: 0xf2000001 (Breakpoint) brk 1


That looks like it crashed in an AudioOutputUnitStop call to stop/suspend the output, but strangely the Apple docs suggest this exception type is a "Swift runtime error" even though BASS doesn't include any Swift code.

    https://developer.apple.com/documentation/xcode/addressing-crashes-from-swift-runtime-errors

Have you seen the same exception with different call stacks? Also, is there an iOS version pattern to it?

Affects Android 13, 14, 15 - seems deep down in the Android code, but could something have changed here?  It doesn't seem to affect the previous version, at least according to my best Google Play console digging.

Code SelectExpand

Binder thread started or Java binder used, but env null. Attach JVM?

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 5234 >>> com.bowerswilkins.splice <<<

backtrace:
  #00  pc 0x0000000000059bb8  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164)
  #01  pc 0x000000000076fa40  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort(char const*)+120)
  #02  pc 0x00000000000357d0  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter(std::__1::function<void (char const*)>&&)::$_0::__invoke(char const*)+80)
  #03  pc 0x0000000000006ec8  /system/lib64/liblog.so (__android_log_assert+308)
  #04  pc 0x0000000000199abc  /system/lib64/libandroid_runtime.so (JavaBBinder::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+592)
  #05  pc 0x000000000007476c  /system/lib64/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+304)
  #06  pc 0x0000000000051308  /system/lib64/libmedia.so (android::BpMediaHTTPConnection::disconnect()+284)
  #07  pc 0x000000000001d080  /system/lib64/libdatasource.so (android::MediaHTTP::disconnect()+120)
  #08  pc 0x00000000001ae434  /system/lib64/libstagefright.so (android::NuMediaExtractor::~NuMediaExtractor()+636)
  #09  pc 0x00000000001ae1a4  /system/lib64/libstagefright.so (android::NuMediaExtractor::~NuMediaExtractor()+16)
  #10  pc 0x000000000001003c  /system/lib64/libutils.so (android::RefBase::decStrong(void const*) const+108)
  #11  pc 0x00000000000221b4  /system/lib64/libmediandk.so (AMediaExtractor_delete.cfi+140)
  #12  pc 0x0000000000028828  /data/app/~~ckFUpzH1wRuz6AWLtYExDA==/com.xxxxxxxxxxxxxxxxx-5WdMfoNpwJeCCM0yMy0gsw==/split_config.arm64_v8a.apk!libbass.so (BuildId: 4d4ef2f9395cac80582f8ecd31a5f5a35262111a)
  #13  pc 0x000000000001c6c4  /data/app/~~ckFUpzH1wRuz6AWLtYExDA==/com.xxxxxxxxxxxxxxxxx-5WdMfoNpwJeCCM0yMy0gsw==/split_config.arm64_v8a.apk!libbass.so (BuildId: 4d4ef2f9395cac80582f8ecd31a5f5a35262111a)
  #14  pc 0x00000000000259fc  /data/app/~~ckFUpzH1wRuz6AWLtYExDA==/com.xxxxxxxxxxxxxxxxx-5WdMfoNpwJeCCM0yMy0gsw==/split_config.arm64_v8a.apk!libbass.so (BuildId: 4d4ef2f9395cac80582f8ecd31a5f5a35262111a)
  #15  pc 0x00000000000be908  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208)
  #16  pc 0x000000000005b3f0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)


This crash happened when auto-freeing (BASS_STREAM_AUTOFREE) an Android codec stream. From the error message and stack, it looks like the codec's source (HTTP reader) in this case needs it to be a Java-attached thread. Auto-freeing does have its own thread now, while it used to share the sync thread, so that'll probably be why you didn't have the problem before. Here's an update for you to try:

    www.un4seen.com/stuff/bass-android.zip

[blacey]

Brilliant, thanks for the swift response as always!  I've brought the new Android version into the next release, so will keep an eye on that one.

The iOS issue seems to have affected iOS 16.3 and 18.3/4 so far and the only commonality is the stream either being paused or stalled, which would make sense with you mentioning suspending the output.  I'll attach a zip of the various crash reports from Apple and unique stack traces from Crashlytics, in case it's helpful.  Feels like this is a tough one to solve without repro steps, though, so understand if you'll need more info as/if we get it!

[Ian @ un4seen]

The iOS issue seems to have affected iOS 16.3 and 18.3/4 so far and the only commonality is the stream either being paused or stalled, which would make sense with you mentioning suspending the output.

Are you able to reproduce it yourself, and does it happen every time a stream is paused/stalled or only sometimes? If you are able to reproduce it then that would help with testing potential solutions.

[blacey]

Unfortunately it seems quite rare, it's never shown up in our internal test release metrics, only in the public release, so getting a repro case is probably going to be hard!

However I'll try adapting my previous torture test to see if I can get it to happen there and see if there's something specific that causes it.

[Ian @ un4seen]

I suspect it's related to the thread in which the mentioned AudioOutputUnitStop call is being made, as that was changed in the update above. Here's another update that goes back to how it was before:

    www.un4seen.com/stuff/bass-ios.zip

Please try that and let me know if you still get any reports of the problem happening.

[blacey]

Excellent, thanks Ian - there's a release coming up shortly so I'll include this update and let you know the outcome!