记一次AudioFlinger崩溃的问题解决思路，导致视频无法播放

03-29 19:59:10.743 E/cutils-trace(17021): Error opening trace file: No such file or directory (2)
03-29 19:59:10.748 W/hwservicemanager( 2323): getTransport: Cannot find entry android[email protected]::IDevicesFactory/msd in either framework or device manifest.
03-29 19:59:10.748 D/MTK_KL  ( 2875): 4,22148,756150248,-;[SAR_Demo] get adc value E_MI_SAR_CHANNEL_3= 8f
03-29 19:59:10.752 I/AudioFlinger(17021): Using default 3000 mSec as standby time.
03-29 19:59:10.753 E/APM::Serializer(17021): deserialize: Could not parse /odm/etc/audio_policy_configuration.xml document.
03-29 19:59:10.757 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.757 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.774 E/APM::HwModule(17021): refreshSupportedDevices: invalid source devices for primary input
03-29 19:59:10.775 E/APM::HwModule(17021): refreshSupportedDevices: invalid source devices for hdmi input
03-29 19:59:10.775 E/APM::HwModule(17021): refreshSupportedDevices: invalid source devices for line input
03-29 19:59:10.790 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.790 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.792 D/APM::AudioPolicyEngine/PFWWrapper(17021): loadAudioPolicyCriteriaConfig
03-29 19:59:10.792 D/APM::AudioPolicyEngine/PFWWrapper(17021): loadConfig: Loading conf for pfw
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType OutputDevicesMaskType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType InputDevicesMaskType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType AndroidModeType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForCommunicationType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForMediaType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForRecordType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForDockType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForSystemType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForHdmiSystemAudioType
03-29 19:59:10.793 D/APM::AudioPolicyEngine/PFWWrapper(17021): addCriterionType: Adding new criterionType ForceUseForEncodedSurroundType
03-29 19:59:10.794 D/APM::AudioPolicyEngine/PFWWrapper(17021): loadAudioPolicyCriteriaConfig: loaded
03-29 19:59:10.794 D/APM::AudioPolicyEngine/PFWWrapper(17021): start: in
03-29 19:59:10.794 E/APM::AudioPolicyEngine/PFWWrapper(17021): start: Policy PFW start error: (user input):0:0: failed to load external entity "/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml"
03-29 19:59:10.794 E/APM::AudioPolicyEngine/PFWWrapper(17021): 
03-29 19:59:10.794 E/APM::AudioPolicyEngine/PFWWrapper(17021): libxml failed to read "/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml"
03-29 19:59:10.794 E/APM::AudioPolicyEngine(17021): initCheck: could not start Policy PFW
03-29 19:59:10.798 W/hwservicemanager( 2323): getTransport: Cannot find entry [email protected]::ISoundTriggerHw/default in either framework or device manifest.
03-29 19:59:10.798 E/SoundTriggerHwService(17021): could not read implementation properties
03-29 19:59:10.809 D/PermissionCache(17021): checking android.permission.MODIFY_AUDIO_SETTINGS for uid=1000 => granted (449 us)
03-29 19:59:10.809 W/system_server( 3136): Long monitor contention with owner AudioService (3604) at void com.android.server.audio.AudioService$VolumeStreamState.applyAllVolumes()(AudioService.java:5038) waiters=0 in int com.android.server.audio.AudioService.getDevicesForStream(int, boolean) for 3.967s
03-29 19:59:10.810 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.811 I/chatty  (17021): uid=1041(audioserver) identical 12 lines
03-29 19:59:10.811 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.816 D/PermissionCache(17021): checking android.permission.MODIFY_AUDIO_ROUTING for uid=1000 => granted (143 us)
03-29 19:59:10.816 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.823 I/chatty  (17021): uid=1041(audioserver) identical 442 lines
03-29 19:59:10.823 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.823 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.823 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.823 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.826 I/chatty  (17021): uid=1041(audioserver) identical 42 lines
03-29 19:59:10.826 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.827 I/AudioFlinger(17021): systemReady
03-29 19:59:10.827 E/AudioService( 3136): Audioserver started.
03-29 19:59:10.828 D/AudioFlinger(17021): isLowRamDevice:true totalMemory:863543296 mClientSharedHeapSize:1048576
03-29 19:59:10.829 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.841 I/chatty  (17021): uid=1041(audioserver) identical 194 lines
03-29 19:59:10.841 E/APM::AudioPolicyEngine(17021): getPropertyForKey: Element not found within collection
03-29 19:59:10.841 I/AudioFlinger(17021): systemReady
03-29 19:59:10.841 W/AudioFlinger(17021): systemReady called twice
03-29 19:59:10.841 E/APM::AudioPolicyEngine/PFWWrapper(17021): getForceUse: no criterion found for ForceUseForVibrateRinging
03-29 19:59:10.842 E/APM::AudioPolicyEngine/PFWWrapper(17021): getForceUse: no criterion found for ForceUseForVibrateRinging
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--111
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--222
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--333
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--444
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--555
--------- beginning of crash
03-29 19:59:10.845 F/libc    (17021): Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc in tid 17043 (Binder:17021_3), pid 17021 (audioserver)
03-29 19:59:10.857 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.857 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.868 E/cutils-trace(17046): Error opening trace file: No such file or directory (2)
03-29 19:59:10.874 I/crash_dump32(17049): obtaining output fd from tombstoned, type: kDebuggerdTombstone
03-29 19:59:10.875 I//system/bin/tombstoned( 2881): received crash request for pid 17043
03-29 19:59:10.876 I/crash_dump32(17049): performing dump of process 17021 (target tid = 17043)
03-29 19:59:10.885 F/DEBUG   (17049): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-29 19:59:10.885 F/DEBUG   (17049): Build fingerprint: 'MediaTek/mt5862_bga_1g/mt5862_bga_1g:9/PPR2.180905.006.A1/huangxiaoxing03291647:userdebug/dev-keys'
03-29 19:59:10.885 F/DEBUG   (17049): Revision: '1234'
03-29 19:59:10.885 F/DEBUG   (17049): ABI: 'arm'
03-29 19:59:10.885 F/DEBUG   (17049): pid: 17021, tid: 17043, name: Binder:17021_3  >>> /system/bin/audioserver <<<
03-29 19:59:10.885 F/DEBUG   (17049): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc
03-29 19:59:10.885 F/DEBUG   (17049): Cause: null pointer dereference
03-29 19:59:10.885 F/DEBUG   (17049):     r0  00000000  r1  b28cc3ff  r2  00013e22  r3  00000003
03-29 19:59:10.886 F/DEBUG   (17049):     r4  b1ece000  r5  b1ec2000  r6  b28cc3ff  r7  b1ee4e94
03-29 19:59:10.886 F/DEBUG   (17049):     r8  00000000  r9  00000000  r10 00000007  r11 00000000
03-29 19:59:10.886 F/DEBUG   (17049):     ip  b13036b8  sp  b1303b98  lr  b28b874b  pc  b28b8750
03-29 19:59:10.890 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.890 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.911 I/trapezoidTest( 5135): type=1400 audit(0.0:3821): avc: denied { ioctl } for path="/dev/binder" dev="tmpfs" ino=3275 ioctlcmd=0x6201 scontext=u:r:mt_trapezoid:s0 tcontext=u:object_r:binder_device:s0 tclass=chr_file permissive=1
03-29 19:59:10.916 D/MTK_KL  ( 2875): 38,22149,756319898,-;type=1400 audit(1648555149.747:3820): avc: denied { getattr } for pid=16136 comm="HCDN_GLOBAL" path="/proc/stat" dev="proc" ino=4026533009 scontext=u:r:untrusted_app_25:s0:c512,c768 tcontext=u:object_r:proc_stat:s0 tclass=file permissive=1
03-29 19:59:10.916 D/MTK_KL  ( 2875): 38,22150,756319947,-;type=1400 audit(1648555150.911:3821): avc: denied { ioctl } for pid=5135 comm="trapezoidTest" path="/dev/binder" dev="tmpfs" ino=3275 ioctlcmd=0x6201 scontext=u:r:mt_trapezoid:s0 tcontext=u:object_r:binder_device:s0 tclass=chr_file permissive=1
03-29 19:59:10.918 F/DEBUG   (17049): 
03-29 19:59:10.918 F/DEBUG   (17049): backtrace:
03-29 19:59:10.918 F/DEBUG   (17049):     #00 pc 0002d750  /system/lib/libaudiopolicymanagerdefault.so (android::DeviceDescriptor::toAudioPort(audio_port*) const+112)
03-29 19:59:10.918 F/DEBUG   (17049):     #01 pc 00024255  /system/lib/libaudiopolicymanagerdefault.so (android::AudioPolicyManager::listAudioPorts(audio_port_role_t, audio_port_type_t, unsigned int*, audio_port*, unsigned int*)+156)
03-29 19:59:10.918 F/DEBUG   (17049):     #02 pc 0000d89f  /system/lib/libaudiopolicyservice.so (android::AudioPolicyService::listAudioPorts(audio_port_role_t, audio_port_type_t, unsigned int*, audio_port*, unsigned int*)+66)
03-29 19:59:10.918 F/DEBUG   (17049):     #03 pc 0003ee4b  /system/lib/libaudioclient.so (android::BnAudioPolicyService::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+2322)
03-29 19:59:10.918 F/DEBUG   (17049):     #04 pc 000360f9  /system/lib/libbinder.so (android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+72)
03-29 19:59:10.918 F/DEBUG   (17049):     #05 pc 0003d80d  /system/lib/libbinder.so (android::IPCThreadState::executeCommand(int)+404)
03-29 19:59:10.918 F/DEBUG   (17049):     #06 pc 0003d59f  /system/lib/libbinder.so (android::IPCThreadState::getAndExecuteCommand()+106)
03-29 19:59:10.918 F/DEBUG   (17049):     #07 pc 0003dabf  /system/lib/libbinder.so (android::IPCThreadState::joinThreadPool(bool)+38)
03-29 19:59:10.918 F/DEBUG   (17049):     #08 pc 000543bd  /system/lib/libbinder.so (android::PoolThread::threadLoop()+12)
03-29 19:59:10.918 F/DEBUG   (17049):     #09 pc 0000c0df  /system/lib/libutils.so (android::Thread::_threadLoop(void*)+166)
03-29 19:59:10.918 F/DEBUG   (17049):     #10 pc 000632f5  /system/lib/libc.so (__pthread_start(void*)+22)
03-29 19:59:10.918 F/DEBUG   (17049):     #11 pc 0001de59  /system/lib/libc.so (__start_thread+24)
03-29 19:59:10.924 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.924 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.940 D/MTK_KL  ( 2875): 4,22151,756342177,-;[SAR_Demo] get adc value E_MI_SAR_CHANNEL_3= 91
03-29 19:59:10.957 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.958 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:10.972 D/MTK_KL  ( 2875): 31,22152,756374207,-;logd: logdr: UID=1041 GID=1005 PID=17049 n tail=50 logMask=8 pid=17021 start=0ns timeout=0ns
03-29 19:59:10.972 D/MTK_KL  ( 2875): 31,22153,756376352,-;logd: logdr: UID=1041 GID=1005 PID=17049 n tail=50 logMask=1 pid=17021 start=0ns timeout=0ns
03-29 19:59:10.990 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:10.991 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:11.023 E/sky_prop(    1): uid[1000] gid[1003] pid[5134] PROPERTY SET [vendor.mstar.trapezoid.write_not_read_buf_cnt]: [0]
03-29 19:59:11.023 E/mali_winsys( 5134): invalidate private_data!
03-29 19:59:11.027 D/MTK_KL  ( 2875): 31,22154,756430376,-;logd: logdr: UID=1041 GID=1005 PID=17049 n tail=0 logMask=8 pid=17021 start=0ns timeout=0ns
03-29 19:59:11.028 D/MTK_KL  ( 2875): 31,22155,756432846,-;logd: logdr: UID=1041 GID=1005 PID=17049 n tail=0 logMask=1 pid=17021 start=0ns timeout=0ns
03-29 19:59:11.032 W/NativeCrashListener( 3136): Couldn't find ProcessRecord for pid 17021
03-29 19:59:11.033 E//system/bin/tombstoned( 2881): Tombstone written to: /data/tombstones/tombstone_27
03-29 19:59:11.037 D/MTK_KL  ( 2875): 4,22156,756441655,-;!!!!!!!!!!!!!!!!!!!!!! from bootargs CORE_DUMP_PATH is:/data/core_dump.%%p.gz
03-29 19:59:11.037 D/MTK_KL  ( 2875): 4,22157,756441662,-; you want a compress coredump file 
03-29 19:59:11.037 D/MTK_KL  ( 2875): 4,22158,756441664,-;!!!!!!!!!!!!!!!!!!!!!! from bootargs CORE_DUMP_PATH is:/var/coredump.%p.gz
03-29 19:59:11.037 D/MTK_KL  ( 2875): 14,22159,756442992,-;init: Untracked pid 17049 exited with status 0
03-29 19:59:11.040 D/MTK_KL  ( 2875): 14,22160,756444944,-;init: Untracked pid 17051 exited with status 0
03-29 19:59:11.044 D/MTK_KL  ( 2875): 14,22161,756447547,-;init: Service 'audioserver' (pid 17021) received signal 11
03-29 19:59:11.044 D/MTK_KL  ( 2875): 14,22162,756447580,-;init: Sending signal 9 to service 'audioserver' (pid 17021) process group...
03-29 19:59:11.044 D/MTK_KL  ( 2875): 14,22163,756447791,-;libprocessgroup: Successfully killed process cgroup uid 1041 pid 17021 in 0ms
03-29 19:59:11.044 D/MTK_KL  ( 2875): 14,22164,756447935,-;init: Sending signal 9 to service 'vendor.audio-hal-2-0' (pid 17022) process group...
03-29 19:59:11.048 D/MTK_KL  ( 2875): 14,22165,756453448,-;libprocessgroup: Successfully killed process cgroup uid 1041 pid 17022 in 5ms
03-29 19:59:11.048 D/MTK_KL  ( 2875): 14,22166,756453722,-;init: Command 'restart audio-hal-2-0' action=onrestart (:2) took 0ms and failed: service audio-hal-2-0 not found
03-29 19:59:11.049 W/AudioManager(16982): updateAudioPortCache: listAudioPorts failed
03-29 19:59:11.049 W/AudioSystem( 3136): AudioPolicyService server died!
03-29 19:59:11.049 W/AudioSystem( 3136): AudioFlinger server died!
03-29 19:59:11.049 D/BluetoothAdapterService(16982): setAdapterService() - trying to set service to com.android.bluetooth.btservice.AdapterService@de81139
03-29 19:59:11.049 I/ServiceManager( 2322): service 'media.audio_flinger' died
03-29 19:59:11.049 I/ServiceManager( 2322): service 'media.audio_policy' died
03-29 19:59:11.049 I/ServiceManager( 2322): service 'media.sound_trigger_hw' died
03-29 19:59:11.049 E/AudioSystem-JNI(16982): AudioSystem::listAudioPorts error -32
03-29 19:59:11.049 W/AudioManager(16982): updateAudioPortCache: listAudioPorts failed
03-29 19:59:11.050 W/AudioSystem(16982): AudioPolicyService server died!
03-29 19:59:11.051 E/AudioService( 3136): Audioserver died.

1.根据native的错误得知，代码最后发生一个空指针异常

Cause: null pointer dereference

#00 pc 0002d750  /system/lib/libaudiopolicymanagerdefault.so (android::DeviceDescriptor::toAudioPort(audio_port*) const+112)

同时，该空指针出现在去libaudiopolicymanagerdefault.so库中。现在去源码中搜索libaudiopolicymanagerdefault.so ，发现它是源码中c++编译而成。最后锁定空指针发生在DeviceDescriptor.cpp的toAudioPort方法中。

源码中的C++不知道咋调试，使用了最简单粗暴的方式锁定异常代码行。每一行代码后面都加一句log.............

03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--111
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--222
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--333
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--444
03-29 19:59:10.845 E/APM::Devices(17021): miles----DeviceDescriptor---toAudioPort--555

虽然锁定了报空指针异常的代码行，但是然并卵。

以上都是废话。

转而去看这一行报错

03-29 19:59:10.794 E/APM::AudioPolicyEngine/PFWWrapper(17021): start: Policy PFW start error: (user input):0:0: failed to load external entity "/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml"

显然，AudioPolicyEngine异常，源码中搜索/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml，锁定了ParameterManagerWrapper.cpp 初始化默认配置为该路径的文件

const char *const ParameterManagerWrapper::mPolicyPfwDefaultConfFileName =
    "/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml";

通过串口（或者adb shell），去查看/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml，并不存在！！！

这个文件在设备中存在于/vendor/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml.

修改.frameworks/av/services/audiopolicy/engineconfigurable/wrapper/ParameterManagerWrapper.cpp中的默认配置的路径为/vendor/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml。

重新打包测试，AudioFlinger成功初始化，视频播放成功。

这个问题按理说谷歌已经做好vendor对system的覆盖，然而这里的代码并没有看出来，所以直接写死默认为vendor的这个路径/vendor/etc/parameter-framework/ParameterFrameworkConfigurationPolicy.xml