Android8.0平台Camera monkey拷机卡死异常
Android8.0平台Camera monkey拷机卡死异常
最近在处理一个camera monkey拷机卡死的问题，卡死在停止录像的画面。
monkey测试命令
monkey -p com.android.camera2 --throttle 300 --ignore-crashes --ignore-timeouts --ignore-security-exceptions -v -v -v 50000000 &camera卡住的时候，把mediaserver进程的backtrace打印可发现卡在AudioSource::waitOutstandingEncodingFrames_l函数中，异常LOG:
debugger -b [pid]
...
[04-28 16:35:43]"Binder:237_4" sysTid=2571
[04-28 16:35:43] #00 pc 00018cd8 /system/lib/libc.so (syscall+28)
[04-28 16:35:43] #01 pc 00047529 /system/lib/libc.so (__pthread_cond_timedwait(pthread_cond_internal_t*, pthread_mutex_t*, bool, timespec const*)+102)
[04-28 16:35:43] #02 pc 000a7adb /system/lib/libstagefright.so (android::AudioSource::waitOutstandingEncodingFrames_l()+54)
[04-28 16:35:43] #03 pc 000a787b /system/lib/libstagefright.so (android::AudioSource::reset()+82)
[04-28 16:35:43] #04 pc 000a77e9 /system/lib/libstagefright.so (android::AudioSource::~AudioSource()+44)
[04-28 16:35:43] #05 pc 000a794d /system/lib/libstagefright.so (android::AudioSource::~AudioSource()+12)
[04-28 16:35:43] #06 pc 0000ac5b /system/lib/libutils.so (android::RefBase::decStrong(void const*) const+70)
[04-28 16:35:43] #07 pc 00049c4f /system/lib/libmediaplayerservice.so (android::StagefrightRecorder::~StagefrightRecorder()+206)
[04-28 16:35:43] #08 pc 00049e7b /system/lib/libmediaplayerservice.so (android::StagefrightRecorder::~StagefrightRecorder()+2)
[04-28 16:35:43] #09 pc 00047eef /system/lib/libmediaplayerservice.so (android::MediaRecorderClient::release()+34)
...把调试LOG打开，并跟踪其代码流程如下
- 238 1538 V AudioSource: Set stoptime: 80223601 us
代码：
StagefrightRecorder.cpp
status_t StagefrightRecorder::stop() {
int64_t stopTimeUs = systemTime() / 1000;
for (const auto &source : { mAudioEncoderSource, mVideoEncoderSource }) {
if (source != nullptr && OK != source->setStopTimeUs(stopTimeUs)) {
ALOGW("Failed to set stopTime %lld us for %s",
(long long)stopTimeUs, source->isVideo() ? "Video" : "Audio");
}
}AudioSource.cpp
status_t AudioSource::setStopTimeUs(int64_t stopTimeUs) {
mStopSystemTimeUs = stopTimeUs;
return OK;
}- 238 1523 V AudioSource: dataCallbackTimestamp: 80264993 us
238 1523 V AudioSource: Drop Audio frame at 80264993 stop time: 80223601 us
代码：
AudioSource.cpp
if (mStopSystemTimeUs != -1 && timeUs >= mStopSystemTimeUs) {
ALOGV("Drop Audio frame at %lld stop time: %lld us",
(long long)timeUs, (long long)mStopSystemTimeUs);
mNoMoreFramesToRead = true;
mFrameAvailableCondition.signal();
return OK;
}- 238 1538 I AudioSource: read: mBuffersReceived is empty and mNoMoreFramesToRead
代码
AudioSource.cpp
status_t AudioSource::read(
MediaBuffer **out, const ReadOptions * /* options */) {
Mutex::Autolock autoLock(mLock);
*out = NULL;
if (mInitCheck != OK) {
ALOGI("read: mInitCheck not OK");
return NO_INIT;
}
while (mStarted && mBuffersReceived.empty()) {
mFrameAvailableCondition.wait(mLock);
if (mNoMoreFramesToRead) {
ALOGI("read: mBuffersReceived is empty and mNoMoreFramesToRead");
return OK;
}
}此处当mBuffersReceived为空且mNoMoreFramesToRead被设置时候，直接返回.
- 04-30 07:57:53.687 238 1538 V MediaCodecSource: puller (audio) posting EOS
04-30 07:57:53.730 238 1513 V MediaCodecSource: puller (audio) reached EOS
04-30 07:57:53.730 238 1513 V MediaCodecSource: encoder (audio) reached EOS
代码
MediaCodecSource.cpp
case kWhatPull:
status_t err = mSource->read(&mbuf);
if (mbuf != NULL) {
mNotify->post();
msg->post();
} else {
handleEOS();
}MediaCodecSource.cpp
void MediaCodecSource::Puller::handleEOS() {
ALOGV("puller (%s) posting EOS", mIsAudio ? "audio" : "video");
// android::CallStack cs("Puller::handleEOS");
sp<AMessage> msg = mNotify->dup();
msg->setInt32("eos", 1);
msg->post();
}因为从source获取到的buffer为空，于是判定为EOS，并进行EOS处理。
- 04-30 07:57:54.126 238 1513 I MediaCodecSource: encoder (audio) stopping
04-30 07:57:54.126 238 1513 I MediaCodecSource: encoder (audio) already stopped
代码
MediaCodecSource.cpp
case kWhatStop:
{
ALOGI("encoder (%s) stopping", mIsVideo ? "video" : "audio");
if (mOutput.lock()->mEncoderReachedEOS) {
// if we already reached EOS, reply and return now
ALOGI("encoder (%s) already stopped",
mIsVideo ? "video" : "audio");
(new AMessage)->postReply(replyID);
break;
}
mPuller->stop();由于先前已经接收到EOS信息，因此MediaCodecSource在处理kWhatStop时候直接返回。
此次问题发生的流程大致如下
- 应用层发出停止录像的请求
- AudioSource把该停止录像的请求之后的音频数据丢弃，并设置mNoMoreFramesToRead
- MediaCodecSource从AudioSource读取到buffer为NULL，于是判定为EOS，并进行相关处理，但并不清除MediaCodecSource::Puller::Queue.mReadBuffers
- MediaCodecSource接收到kWhatStop消息，发现已经进行了EOS处理，于是放弃执行Puller.stop(它会对Puller::Queue.mReadBuffers执行flush操作)，直接返回。
- AudioSource最后进行reset时候，调用waitOutstandingEncodingFrames_l去等待直到所有buffer被释放，但有些buffer在Audio Puller::Queue.mReadBuffers没有释放，于是在进程被hold在此处。
暂时的修改方案是
在第4步处理kWhatStop消息时候，即使已经进行过EOS处理，仍然执行Puller.stop，以确保Puller::Queue.mReadBuffers为空。