I have a functional implementation of native (C++) WebRTC in Windows, which I'm trying to get working on every other platform now. Currently, I'm attacking Android.
When I call webrtc::CreatePeerConnectionFactory, it cannot create the java class org.webrtc.voiceengine.WebRtcAudioManager. I get the following result (followed by a crash!):
I audio_processing_impl.cc: (line 292): Injected APM submodules:
I audio_processing_impl.cc: Echo control factory: 0
I audio_processing_impl.cc: Echo detector: 0
I audio_processing_impl.cc: Capture analyzer: 0
I audio_processing_impl.cc: Capture post processor: 0
I audio_processing_impl.cc: Render pre processor: 0
I audio_processing_impl.cc: (line 301): Denormal disabler: supported
I webrtc_voice_engine.cc: (line 312): WebRtcVoiceEngine::WebRtcVoiceEngine
I webrtc_video_engine.cc: (line 648): WebRtcVideoEngine::WebRtcVideoEngine()
I webrtc_voice_engine.cc: (line 334): WebRtcVoiceEngine::Init
I audio_device_impl.cc: (line 76): Create
I audio_device_impl.cc: (line 84): CreateForTest
I audio_device_buffer.cc: (line 65): AudioDeviceBuffer::ctor
I audio_device_impl.cc: (line 121): AudioDeviceModuleImpl
I audio_device_impl.cc: (line 125): CheckPlatform
I audio_device_impl.cc: (line 133): current platform is Android
I audio_device_impl.cc: (line 155): CreatePlatformSpecificObjects
I audio_device_impl.cc: (line 947): PlatformAudioLayer
I jvm_android.cc: (line 72): JvmThreadConnector::ctor
I jvm_android.cc: (line 77): Attaching thread to JVM
I jvm_android.cc: (line 262): JVM::environment
I jvm_android.cc: (line 184): JNIEnvironment::ctor
I audio_manager.cc: (line 71): ctor
I jvm_android.cc: (line 196): JNIEnvironment::RegisterNatives: org/webrtc/voiceengine/WebRtcAudioManager
I jvm_android.cc: (line 134): NativeRegistration::ctor
I jvm_android.cc: (line 146): NativeRegistration::NewObject
I org.webrtc.Logging: WebRtcAudioManager: ctor#[name=Thread-15, id=21131]
W System.err: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.Object android.content.Context.getSystemService(java.lang.String)' on a null object reference
W System.err: at org.webrtc.voiceengine.WebRtcAudioManager.<init>(WebRtcAudioManager.java:176)
E rtc : #
E rtc : # Fatal error in: ../../modules/utility/source/jvm_android.cc, line 151
E rtc : # last system error: 0
E rtc : # Check failed: !jni_->ExceptionCheck()
E rtc : # Error during NewObjectV
F libc : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 28384 (Thread-15), pid 27615 (.qgroundcontrol)
This what that failing Java line looks like:
audioManager =
(AudioManager) ContextUtils.getApplicationContext().getSystemService(Context.AUDIO_SERVICE);
I'm using WebRTC M103 (branch-heads/5060).
I've linked to libwebrtc.a, dynamically loaded libjingle_peerconnection_so.so, and bundled libwebrtc.jar. All of those seemed to be required dependencies, and advanced the ball for me one-by-one as I added them into the equation.
Fixed! This is what I was missing:
I was calling webrtc::JVM::Initialize prior to webrtc::CreatePeerConnectionFactory (which is one of many Droid specific requirements they don't bother mention in any docs...). But, I missed the fact there is an overload which takes the Droid app context (i.e. static void Initialize(JavaVM* jvm, jobject context);). That is to say, I was only passing the jvm pointer when initializing.
After a mini adventure (for which I'll omit the details) to get the context reference on C side, and not have it go "stale" (when the Java GC would delete it), I passed that along to the initialization. That, in turn, allowed that (original issue) of the Java invocation of ContextUtils.getApplicationContext() to work!
Related
I'm trying to analyse a crash in my android app which calls a function in a shared object outlined as android java->jni->ndk->shared object. I went through the page:
https://source.android.com/devices/tech/debug/native-crash
However, I don't get such nice dumps as in the examples. I only have a stack trace and some lines in the logcat:
stack:
art_sigsegv_fault 0x0000006f2a44b58c
art::FaultManager::HandleFault(int, siginfo*, void*) 0x0000006f2a44b3f8
art::SignalChain::Handler(int, siginfo*, void*) 0x00000071c40cc328
<unknown> 0x00000071ec845668
__cxxabiv1::set_registers(_Unwind_Exception*, _Unwind_Context*, __cxxabiv1::(anonymous namespace)::scan_results const&) 0x0000006e893c8c90
::__gxx_personality_v0(int, _Unwind_Action, uint64_t, _Unwind_Exception *, _Unwind_Context *) 0x0000006e893c8c78
__cxxabiv1::set_registers(_Unwind_Exception*, _Unwind_Context*, __cxxabiv1::(anonymous namespace)::scan_results const&) 0x0000006e893c8c90
::__gxx_personality_v0(int, _Unwind_Action, uint64_t, _Unwind_Exception *, _Unwind_Context *) 0x0000006e893c8c78
unwind_phase2 0x0000006e8c8f8d40
_Unwind_Resume 0x0000006e8c8f8e10
interpreter::combine_nodes(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const&, node_info const&, node_info const&) 0x0000006e8c8737c0
yy::parser::parse() 0x0000006e8c81dc98
hi(char const*, char const*, unsigned char, char const*, char const*, _JavaVM*, _jobject*, char const*, unsigned char) 0x0000006e8c822988
::Java_com_bitroller_hi_MainActivity_jhi(JNIEnv *, jclass, jstring, jstring, jstring, int, int) jhi.cpp:20
art_quick_generic_jni_trampoline 0x0000006f2a2d4048
<unknown> 0x0000006f2a2d4390
logcat:
2022-08-03 10:46:56.600 2770-2770/com.bitroller.hi A/libc: Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x6e8c909e60 in tid 2770 (om.bitroller.hi), pid 2770 (om.bitroller.hi)
2022-08-03 10:46:56.647 3108-3108/? A/libc: failed to exec crash_dump helper: Operation not permitted
2022-08-03 10:46:56.648 927-927/? E/audit: type=1400 audit(1659516416.643:128328): avc: denied { ptrace } for pid=3108 comm="om.bitroller.hi" scontext=u:r:runas_app:s0:c57,c257,c512,c768 tcontext=u:r:crash_dump:s0:c57,c257,c512,c768 tclass=process permissive=0 SEPF_SM-A725F_12_0001 audit_filtered
2022-08-03 10:46:56.664 2770-2770/com.bitroller.hi A/libc: crash_dump helper failed to exec, or was killed
2022-08-03 10:46:56.665 2770-2770/com.bitroller.hi A/libc: failed to wait for crash_dump helper: No child processes
So I thought about:
taking the address of the function I know i.e. interpreter::combine_nodes() from the stack trace
checking the address of that function by readelf in the shared library
subtracting the address in 2) from the address in 1) i.e 1)addr - 2)addr
subtracting the address I get in 3) from the failure address in the stack trace i.e. 0x0000006f2a44b58c - 3)addr
check the address I get in 4) by addr2line and identify the line in the source of the shared library where the program failed
Does this make sense? Currently, I just tested what I get if I use addr2line on an address of the function mentioned read by readelf but it returns ??:0. Does anyone have any hint what am I doing wrong?
It turns out after two months of investigation (one before reporting this and one after that) that this unwinding problem only occurs if the native code is cross-compiled by a standalone toolchain. I had the chance to import the cpp source code of the library that crashes in android studio, compile it there and there's no more crash during unwind.
I have just started using MockK to mock all the Repositories / Services logic in an MVP-based app for UI tests.
I have some UI tests running a login activity where the Espresso inputs logins and passwords and using MockK I can fake various situation where the login fails or not.
All services & repositories are standard Kotlin object, so I am using mockkobject and every/coEvery to override and handle login requests & tasks.
On my physical devices, there are no issues with the tests at all, but as soon as I tried to run them on a emulator running Android P+ with recommended image, they constantly crash at random time. And on rare occasion they can survive long enough to work.
Looking at the logs, I got various SIGSEGV:
A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 10425 (e.android.debug), pid 10425 (e.android.debug)
A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc in tid 10968 (HeapTaskDaemon), pid 10957 (e.android.debug)
A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 15050 (firebase-instal), pid 14972 (e.android.debug)
A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xd in tid 8902 (Measurement Wor), pid 8858 (e.android.debug)
A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 22004 (Binder:21832_5), pid 21832 (e.android.debug)
But looking deeper into the logs I believe I found the culprit:
InputDispatcher: channel '9fa7335 my.company.com.android.debug/my.company.com.ui.login.LoginActivity(server)' ~ Channel is unrecoverably broken and will be disposed!
Looking for solutions, it seems this could happen due to memory leaks ?
In any case, I made sure to launch the activity under test in a #Before method where all the mocks occur while I am clearing such mocks and verifies in the #After method.
Clearly I believe the tests do work just fine but something must be wrong with Espresso or all the mocking that occurs...
[EDIT 1]
Further looking at prior logs, this could be the reason why there are memory leaks:
ActivityThread: Service com.google.android.gms.autofill.service.AutofillService has leaked IntentReceiver com.google.android.gms.autofill.smsretriever.TracingSmsBroadcastReceiver#ce00658 that was originally registered here. Are you missing a call to unregisterReceiver()?
android.app.IntentReceiverLeaked: Service com.google.android.gms.autofill.service.AutofillService has leaked IntentReceiver com.google.android.gms.autofill.smsretriever.TracingSmsBroadcastReceiver#ce00658 that was originally registered here. Are you missing a call to unregisterReceiver()?
I disabled the AutoFillService (set to none in the relevant settings section) on my emulator. This seemed to improve my tests success rate at the beginning, but they keep crashing after several runs.
Now the logs are not showing this leak anymore, though.
[EDIT 2]
Apparently this issue could be related to MockK as I was able to retrieve more logs:
2020-07-24 11:57:15.955 15767-15780/com.my.company.android.debug A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 15780 (HeapTaskDaemon), pid 15767 (e.android.debug)
2020-07-24 11:57:15.997 15962-15962/? E/crash_dump32: failed to detach from thread 15773: No such process
2020-07-24 11:57:15.997 15962-15962/? E/crash_dump32: failed to detach from thread 15778: No such process
2020-07-24 11:57:15.997 15962-15962/? E/crash_dump32: failed to detach from thread 15779: No such process
2020-07-24 11:57:15.997 15962-15962/? E/crash_dump32: failed to detach from thread 15780: No such process
// 20 more times of exact same line //
2020-07-24 11:57:16.007 15962-15962/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2020-07-24 11:57:16.007 15962-15962/? A/DEBUG: Build fingerprint: 'google/sdk_gphone_x86/generic_x86:10/QSR1.190920.001/5891938:user/release-keys'
2020-07-24 11:57:16.007 15962-15962/? A/DEBUG: Revision: '0'
2020-07-24 11:57:16.007 15962-15962/? A/DEBUG: ABI: 'x86'
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: Timestamp: 2020-07-24 09:57:16+0000
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: pid: 15767, tid: 15780, name: HeapTaskDaemon >>> com.my.company.android.debug <<<
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: uid: 10136
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: Cause: null pointer dereference
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: eax 00000000 ebx ef8a6c34 ecx 00000000 edx f310b604
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: edi f3200380 esi 00000000
2020-07-24 11:57:16.008 15962-15962/? A/DEBUG: ebp e659d9a8 esp e659d940 eip ef7d89f4
2020-07-24 11:57:16.027 2044-2135/? E/InputDispatcher: channel '342ebda com.my.company.android.debug/com.my.compan.android.ui.error.LoginActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
After further investigation, there is a 1-year-old issue on the Android Test Github repo showing the same problem (but issue is now closed): https://github.com/android/android-test/issues/352
A relevant issue at Mockk was opened here: https://github.com/mockk/mockk/issues/466
[EDIT 3]
I was exploring the alternative to go back to Mockito which has more history and more active development. It took a bit of time but I had no major issue migrating my UI tests to Mockito.
The results: well, at first the crash were completely gone. I could fire my tests run, 10, 20, 30 times without a hinch. At least on mobile.
However, on Android TV (still with a simulator), the crash reappeared rather quickly. And then on mobile as well, but way less often with the dreadful message from the InputDispatcher.
While setting up the migration to Mockito, I have noticed that Mockk shares the same restrictions & dependencies with Mockito when mocking on Android Test Instrumentation. I faced the same issues and the same difficulties.
So it led me to believe that neither of them are the culprit, but it could very well be the Android Instrumentation APIs.
I also noticed that manually rebooting the emulators greatly improved the situation.
This was in my stacktrace:
W Unexpected CPU variant for X86 using defaults: x86
ActivityThread W Package uses different ABI(s) than its instrumentation:
Switching to a 64 bit emulator fixed the problem.
I too have been running into this issue with my instrumentation test suite and also suspect MockK to be (at least partially) at fault.
This is far from a true solution, but I've noticed that running MY tests with Android Test Orchestrator greatly reduces the chance of random failure due to test process crash (caused by the above segfault). (If you are running tests with Firebase Test Lab emulators, this could be particularly helpful.)
Another bonus of using Orchestrator, it does a really good job of digging through the logs (in Firebase Test Lab) to find the root error if your test does fail in an Orchestrator process.
I'm not certain this will work well for everyone, but if it does, it likely indicates that MockK (if it truly is the source of this issue) isn't cleaning up fully and is leaking into other tests.
I had exactly the same case where my tests were crashing randomly on the Emulator with Process crashed error saying check the Logcat. There was SIGSEGV error on the Logcat but not always.
In my case it was com.linkedin.dexmaker:dexmaker-mockito-inline causing the random crashes. I had to add it to mock a Kotlin data class in Instrumentation tests which I didn't need after all. So removing this dependency solved my issue.
I recommend to investigate after which point your tests started crashing, then it will be easier to get to bottom of it.
My intended task is:
create checkpoint files for my custom classes (one class) using inception V3 arch.: Inception in TensorFlow
freeze them to the protobuf (.pb) using freeze_graph
optimize the frozen graph using optimize_for_inference
Use pb file in android TF camera demo for classification: TensorFlow Android Camera Demo
In step 1, while training, batch size is set to 1.
Also added, images = tf.identity(images, name='Inputs_layer') to name the tensor network as suggested in the question
No Operation named [input] in the Graph" error while fine tuning/retraining inceptionV1 slim model.
Before step 3,
>> bazel-bin/tensorflow/tools/graph_transforms/summarize_graph --
in_graph=frozen_graph.pb
No inputs spotted.
No variables spotted.
Found 1 possible outputs: (name=tower_0/logits/predictions, op=Softmax)
Found 21781804 (21.78M) const parameters, 0 (0) variable parameters, and 188
control_edges
Op types used: 777 Const, 378 Mul, 284 Add, 283 Sub, 190 Identity, 188 Sum,
96 Reshape, 94
Conv2D, 94 StopGradient, 94 SquaredDifference, 94 Square, 94 Mean, 94 Rsqrt,
94 Relu, 94
Reciprocal, 15 ConcatV2, 10 AvgPool, 4 MaxPool, 1 RealDiv, 1 RandomUniform, 1
QueueDequeueManyV2, 1 Softmax, 1 Split, 1 MatMul, 1 Floor, 1 FIFOQueueV2, 1
BiasAdd
In step 3,
bazel-bin/tensorflow/python/tools/optimize_for_inference \
--input=tensorflow/examples/android/assets/frozen_graph.pb \
--output=tensorflow/examples/android/assets/stripped_graph.pb \
--input_names=inputs_layer \
--output_names=tower_0/logits/predictions
After step 3,
>>> bazel-bin/tensorflow/tools/graph_transforms/summarize_graph --
in_graph=stripped_graph.pb
No inputs spotted.
No variables spotted.
Found 1 possible outputs: (name=tower_0/logits/predictions, op=Softmax)
Found 21781804 (21.78M) const parameters, 0 (0) variable parameters, and 188
control_edges
Op types used: 777 Const, 378 Mul, 284 Add, 283 Sub, 188 Sum, 96 Reshape, 94
Conv2D, 94 StopGradient, 94 SquaredDifference, 94 Square, 94 Mean, 94 Rsqrt,
94 Relu, 94 Reciprocal, 15 ConcatV2, 10 AvgPool, 4 MaxPool, 1 RealDiv, 1
RandomUniform, 1 QueueDequeueManyV2, 1 Softmax, 1 Split, 1 MatMul, 1 Floor, 1
FIFOQueueV2, 1 BiasAdd
To use with tensorflow/tools/benchmark:benchmark_model try these arguments:
run tensorflow/tools/benchmark:benchmark_model -- --
graph=stripped_graph.pb --show_flops --logtostderr --input_layer= --
input_layer_type= --input_layer_shape= --
output_layer=tower_0/logits/predictions
In ClassifierActivity.java,
private static final int INPUT_SIZE = 224;//299; //224;
private static final int IMAGE_MEAN = 117;
private static final float IMAGE_STD = 1;
private static final String INPUT_NAME = "inputs_layer";
private static final String OUTPUT_NAME = "tower_0/logits/predictions";
private static final String MODEL_FILE =
"file:///android_asset/stripped_graph.pb";
private static final String LABEL_FILE =
"file:///android_asset/custom_label.txt";
After following above 4 steps, APK crash log on an Android device:
E/AndroidRuntime( 8558): FATAL EXCEPTION: inference
E/AndroidRuntime( 8558): Process: org.tensorflow.demo, PID: 8558
E/AndroidRun time( 8558): java.lang.IllegalArgumentException: No Operation
named [inputs_layer] in the Graph
How to fix this?
When you are optimizing for inference it doesn't have the input node name right. You have just given inputs_layer, hence the optimized.pb file is not being correctly recognized in Android.
It said nowhere that your input node is inputs_layer. Give the right input node name and it should work.
android application random crash in Galaxy S4 and Nexus 5. On other device is working file.
The crash happen mostly when I back pressed or finish the activity.
And I got the error in log
E/ViewRootImpl( 7168): sendUserActionEvent() mView == null
W/ApplicationPackageManager( 7168): getCSCPackageItemText()
W/Resources( 7168): Converting to int: TypedValue{t=0x3/d=0xcd6 "60" a=3 r=0x7f090170}
W/Resources( 7168): Converting to int: TypedValue{t=0x3/d=0xcd5 "500" a=3 r=0x7f09016f}
W/Resources( 7168): Converting to int: TypedValue{t=0x3/d=0xcd7 "30" a=3 r=0x7f090171}
F/libc ( 7168): invalid address or address of corrupt block 0x73880968 passed to dlfree
D/dalvikvm( 7168): [SWE] ### S.LSI JIT optimization list BEGIN ###
D/dalvikvm( 7168): [SWE] ### S.LSI JIT optimization list END ###
F/libc ( 7168): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1), thread 7183 (AsyncTask #1)
D/dalvikvm( 7770): Late-enabling CheckJNI
I/dalvikvm( 7770): Enabling JNI app bug workarounds for target SDK version 9...
can any one help me on this issue , how to resolve or any workaround ...
I am using android-kernel 2.6.29. I am trying to hook open system call on android-kernel. I followed the link http://syprog.blogspot.com.au/2011/10/hijack-linux-system-calls-part-iii.html to hook on ubuntu 12.04LTS and was successful but when i cross-compile my module for android then i get gives following error
error: implicit lookup_address function
can anyone help ? why i am getting this error ? is there any alternative of lookup_address ?
Judging by the Linux Cross-reference with the appropriate criteria for ARM architecture, referring to the first referenced kernel version 2.6.32 (there's no 2.6.29 Unfortunately)
The cross-references will yield hits mostly referring to the x86 architecture despite the criteria being set. To quote:
lookup_address
Defined as a function in:
arch/x86/mm/pageattr.c, line 295
arch/sh/kernel/io_trapped.c, line 162
Defined as a function prototype in:
arch/x86/include/asm/pgtable_types.h, line 330
Referenced (in 11 files total) in:
arch/x86/include/asm/pgtable_types.h, line 330
arch/x86/mm/kmemcheck/pte.c, line 12
arch/x86/mm/kmemcheck/kmemcheck.c:
line 269
line 295
arch/x86/mm/pageattr-test.c:
line 60
line 150
line 183
line 203
line 215
arch/x86/mm/mmio-mod.c, line 96
arch/x86/mm/fault.c, line 577
arch/x86/mm/kmmio.c, line 136
arch/x86/mm/pageattr.c:
line 200
line 238
line 295
line 326
line 371
line 487
line 606
line 1288
arch/x86/xen/mmu.c:
line 335
line 347
line 362
arch/x86/xen/enlighten.c:
line 281
line 364
arch/sh/kernel/io_trapped.c:
line 162
line 228
line 251
Looking at the actual source function found within x86/mm/pageattr.c here, just to show what the function looks like:
295 pte_t *lookup_address(unsigned long address, unsigned int *level)
296 {
297 pgd_t *pgd = pgd_offset_k(address);
298 pud_t *pud;
299 pmd_t *pmd;
300
301 *level = PG_LEVEL_NONE;
302
303 if (pgd_none(*pgd))
304 return NULL;
305
306 pud = pud_offset(pgd, address);
307 if (pud_none(*pud))
308 return NULL;
309
310 *level = PG_LEVEL_1G;
311 if (pud_large(*pud) || !pud_present(*pud))
312 return (pte_t *)pud;
313
314 pmd = pmd_offset(pud, address);
315 if (pmd_none(*pmd))
316 return NULL;
317
318 *level = PG_LEVEL_2M;
319 if (pmd_large(*pmd) || !pmd_present(*pmd))
320 return (pte_t *)pmd;
321
322 *level = PG_LEVEL_4K;
323
324 return pte_offset_kernel(pmd, address);
325 }
326 EXPORT_SYMBOL_GPL(lookup_address);