How to avoid the android opensl es crash when destroy the engine object?

Question

I got a opensl es crash in android 8.1.0.

The related code:

TEResult SLESAudioEngine::release(TEMsg *pMsg) {
    TEResult ret;

    SLuint32 playState = 0;
    (*bqPlayerPlay)->GetPlayState(bqPlayerPlay, &playState);
    LOGE(LOG_TAG, "%s, %d, %d", __FUNCTION__, __LINE__, playState);

    if (bqPlayerPlay != nullptr) {
        SLresult slRet = (*bqPlayerPlay)->SetPlayState(bqPlayerPlay, SL_PLAYSTATE_STOPPED);
        if (slRet != SL_RESULT_SUCCESS) {
            LOGE(LOG_TAG, "%s,%d SetPlayState failed %d", __FUNCTION__, __LINE__, ret);
            return slRet;
        }
        bqPlayerPlay = nullptr;
    }

    if (bqPlayerBufferQueue != nullptr) {
        SLresult slRet = (*bqPlayerBufferQueue)->Clear(bqPlayerBufferQueue);
        if (slRet != SL_RESULT_SUCCESS) {
            LOGE(LOG_TAG, "GetInterface BufferQueueItf failed %d", ret);
            return slRet;
        }
        bqPlayerBufferQueue = nullptr;
    }

    if (bqPlayerObject != nullptr) {
        (*bqPlayerObject)->Destroy(bqPlayerObject);
        bqPlayerObject = nullptr;
    }

    if (outputMixObject != NULL) {
        (*outputMixObject)->Destroy(outputMixObject);
        outputMixObject = NULL;
    }

    LOGE(LOG_TAG, "%s %d Destroy", __FUNCTION__, __LINE__);
    // destroy engine object, and invalidate all associated interfaces
    if (engineObject != NULL) {
        (*engineObject)->Destroy(engineObject);
        engineObject = NULL;
    }

    return ret;
}

The related logs:

11-05 15:17:58.270 F/DEBUG   ( 5887): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
11-05 15:17:58.270 F/DEBUG   ( 5887): Build fingerprint: 'vivo/PD1806/PD1806:8.1.0/OPM1.171019.019/compil08312141:user/release-keys'
11-05 15:17:58.270 F/DEBUG   ( 5887): Revision: '0'
11-05 15:17:58.270 F/DEBUG   ( 5887): ABI: 'arm'
11-05 15:17:58.270 F/DEBUG   ( 5887): pid: 5609, tid: 5835, name: jerikc.demo.app  >>> com.jerikc.demo.app <<<
11-05 15:17:58.270 F/DEBUG   ( 5887): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
11-05 15:17:58.270 F/DEBUG   ( 5887): Cause: null pointer dereference
11-05 15:17:58.270 F/DEBUG   ( 5887):     r0 fffffffe  r1 00000000  r2 c164d407  r3 f18e1e30
11-05 15:17:58.270 F/DEBUG   ( 5887):     r4 00002282  r5 f18e1da9  r6 f3e66dfc  r7 00000000
11-05 15:17:58.270 F/DEBUG   ( 5887):     r8 f3a66704  r9 000015e9  sl d148808d  fp ced2aa80
11-05 15:17:58.270 F/DEBUG   ( 5887):     ip 00000001  sp c9b95550  lr f18e1e07  pc f3dd0482  cpsr 880f0030
11-05 15:17:58.310 F/DEBUG   ( 5887): 
11-05 15:17:58.310 F/DEBUG   ( 5887): backtrace:
11-05 15:17:58.310 F/DEBUG   ( 5887):     #00 pc 000bc482  /system/lib/libandroid_runtime.so (android::proxy_cleanup(void const*, void*, void*)+65)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #01 pc 00040787  /system/lib/libbinder.so (android::BpBinder::ObjectManager::kill()+30)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #02 pc 00040745  /system/lib/libbinder.so (android::BpBinder::ObjectManager::~ObjectManager()+4)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #03 pc 000410b9  /system/lib/libbinder.so (android::BpBinder::~BpBinder()+124)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #04 pc 00041125  /system/lib/libbinder.so (android::BpBinder::~BpBinder()+12)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #05 pc 00040547  /system/lib/libbinder.so (android::BpRefBase::~BpRefBase()+46)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #06 pc 00004633  /system/lib/libaudiomanager.so (_ZTv0_n12_N7android14BpAudioManagerD0Ev+22)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #07 pc 0000dc5f  /system/lib/libwilhelm.so (android::sp<android::TrackPlayerBase>::clear()+18)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #08 pc 00016a2f  /system/lib/libwilhelm.so (CEngine_Destroy(void*)+198)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #09 pc 0001b975  /system/lib/libwilhelm.so (IObject_Destroy(SLObjectItf_ const* const*)+204)
11-05 15:17:58.310 F/DEBUG   ( 5887):     #10 pc 001c197f  /data/app/com.jerikc.demo.app-4ZSXR9PUHNOeJT-UudwsOQ==/lib/arm/libaudioenginedemo.so (SLESAudioEngine::release(TEMsg*)+486)
11-05 15:17:59.130 V/AudioFlinger( 1002): 5609 died, releasing its sessions

Answer 1

Just got the same problem after moving OpenSL code to a separate thread. Luckily, Android OS sources gave a quick answer:

static void proxy_cleanup(const void* id, void* obj, void* cleanupCookie)
{
    android_atomic_dec(&gNumProxyRefs);
    JNIEnv* env = javavm_to_jnienv((JavaVM*)cleanupCookie);
    env->DeleteGlobalRef((jobject)obj);
}

Long story short, OpenSLES engine is backed by a Java object now, so it requires a valid JavaVM reference to operate. Which basically means, it should be created from a JVM-attached thread (not sure about destruction, but cleanupCookie is passed for a reason, I guess).