[Linphone-developers] android crash with liblinphone-android-sdk during cleanup

[Yenson Tam]

Hi all,

I implemented liblinphone-android-sdk into my android sip app. And I've been getting crashes when I shut down the linphone core (happens roughly ~8% of the time).

From the stack trace, it happens on LinphoneEventImpl.finalize() and there's a SIGSEGV when trying to remove a belle_sip object. The stack trace is below: 

02-23 11:29:23.956: A/google-breakpad(26591): -----END BREAKPAD MICRODUMP-----

02-23 11:29:23.982: W/google-breakpad(25969): ### ### ### ### ### ### ### ### ### ### ### ### ###

02-23 11:29:23.982: W/google-breakpad(25969): Chrome build fingerprint:

02-23 11:29:23.982: W/google-breakpad(25969): 0.4.23

02-23 11:29:23.982: W/google-breakpad(25969): 423

02-23 11:29:23.982: W/google-breakpad(25969): 6d6f4589-33a4-4709-9279-1a8b5e855d5c

02-23 11:29:23.982: W/google-breakpad(25969): ### ### ### ### ### ### ### ### ### ### ### ### ###

02-23 11:29:23.982: A/libc(25969): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x1c in tid 25977 (FinalizerDaemon)

02-23 11:29:24.045: A/DEBUG(12312): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

02-23 11:29:24.045: A/DEBUG(12312): Build fingerprint: 'google/shamu/shamu:6.0.1/MMB29Q/2480792:user/release-keys'

02-23 11:29:24.046: A/DEBUG(12312): Revision: '0'

02-23 11:29:24.046: A/DEBUG(12312): ABI: 'arm'

02-23 11:29:24.046: A/DEBUG(12312): pid: 25969, tid: 25977, name: FinalizerDaemon  >>> ytam <<<

02-23 11:29:24.046: A/DEBUG(12312): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x1c

02-23 11:29:24.067: A/DEBUG(12312):     r0 00000000  r1 9aed15a0  r2 9aed15bc  r3 00000000

02-23 11:29:24.067: A/DEBUG(12312):     r4 91245cdc  r5 6ff9bb0c  r6 704c8e28  r7 704c8e28

02-23 11:29:24.067: A/DEBUG(12312):     r8 704c97f8  r9 acc39500  sl 13034700  fp b4169464

02-23 11:29:24.068: A/DEBUG(12312):     ip 00000000  sp b4169458  lr 90eb5174  pc 90dc8d64  cpsr 600f0010

02-23 11:29:24.089: A/DEBUG(12312): backtrace:

02-23 11:29:24.089: A/DEBUG(12312):     #00 pc 00190d64  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (belle_sip_main_loop_remove_source+64)

02-23 11:29:24.089: A/DEBUG(12312):     #01 pc 0027d170  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so

02-23 11:29:24.089: A/DEBUG(12312):     #02 pc 002720e0  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (belle_sip_object_delete+120)

02-23 11:29:24.090: A/DEBUG(12312):     #03 pc 00271c54  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (belle_sip_object_unref+376)

02-23 11:29:24.090: A/DEBUG(12312):     #04 pc 002ab408  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so

02-23 11:29:24.090: A/DEBUG(12312):     #05 pc 002720e0  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (belle_sip_object_delete+120)

02-23 11:29:24.090: A/DEBUG(12312):     #06 pc 00271c54  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (belle_sip_object_unref+376)

02-23 11:29:24.090: A/DEBUG(12312):     #07 pc 0009af94  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (sal_op_release_impl+376)

02-23 11:29:24.090: A/DEBUG(12312):     #08 pc 0009d11c  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (sal_op_unref+56)

02-23 11:29:24.090: A/DEBUG(12312):     #09 pc 0009ae10  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (sal_op_release+104)

02-23 11:29:24.090: A/DEBUG(12312):     #10 pc 000b5148  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so

02-23 11:29:24.090: A/DEBUG(12312):     #11 pc 000b51a4  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (linphone_event_unref+56)

02-23 11:29:24.091: A/DEBUG(12312):     #12 pc 000ecdcc  /data/app/ytam-2/lib/arm/liblinphone-armeabi-v7a.so (Java_org_linphone_core_LinphoneEventImpl_unref+36)

02-23 11:29:24.091: A/DEBUG(12312):     #13 pc 004bac4f  /data/app/ytam-2/oat/arm/base.odex (offset 0x21f000) (void org.linphone.core.LinphoneEventImpl.unref(long)+82)

02-23 11:29:24.091: A/DEBUG(12312):     #14 pc 004bb1b7  /data/app/ytam-2/oat/arm/base.odex (offset 0x21f000) (void org.linphone.core.LinphoneEventImpl.finalize()+74)

02-23 11:29:24.091: A/DEBUG(12312):     #15 pc 72a89819  /data/dalvik-cache/arm/address@hidden@boot.oat (offset 0x1ec9000)

My theory is that when the linphone core shuts down, it sends an event back to the jvm and later on as the jvm garbage collects the LinphoneEventImpl object it then tries to delete the native pointer and attempt to remove objects that have already be deleted and thus the seg fault.

This is how I'm destroying the linphone core:

(in my linphone object, similar to LinphoneManager.java)

protected void finalize() throws Throwable {

    destroy();

    super.finalize();

}

private void destroy() {

  if (lpCore != null) {

    try {

      lpCore.removeListener(this);

      lpCore.destroy();

    } catch (Throwable e) {Log.e(LOG_TAG, "error destroying linphone: " + e.getMessage());}

    finally {lpCore = null;}

  }

}

This happens on multiple devices and on lollipop and marshmallow.

Also happens on the linphone android build 2.5. 

I noticed in the android linphone build there's a LinphoneManager getLcIfManagerNotDestroyedOrNull(). I wonder if this is somehow a workaround to this bug? Preventing the core from being accessed while the native layer cleans up. 

Anyone have any ideas on how to fix this?

Thanks,

Yenson