macOS 10.14 Ubuntu 18.04 开始播放时 AudioQueue thread 崩溃

[pzhlkj6612]

版本： 9c51e31

环境：

• macOS 10.14 (18A391)
• FFmpeg 4.2.2
• VMware Workstation 15.5.1 build-15018445
• Unlocker 3.0.3 * from paolo-projects

报告（部分）：

...

Crashed Thread:        8  AudioQueue thread

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Application Specific Information:
abort() called
Beslyric-for-X(838,0x700002cc5000) malloc: *** error for object 0xb00007f9209e675c: pointer being freed was not allocated


Thread 6:: PlayThread
0   libsystem_kernel.dylib        	0x00007fff5ca06876 __semwait_signal + 10
1   libsystem_c.dylib             	0x00007fff5c991830 nanosleep + 199
2   libSDL2-2.0.0.dylib           	0x0000000110abb861 SDL_Delay_REAL + 83
3   com.yourcompany.Beslyric-for-X	0x000000010e807078 PlayThread::generateAudioDataLoop() + 168 (musicPlayer.cpp:529)
4   com.yourcompany.Beslyric-for-X	0x000000010e805e54 PlayThread::run() + 196 (musicPlayer.cpp:255)
5   org.qt-project.QtCore         	0x0000000111797fd3 0x111776000 + 139219
6   libsystem_pthread.dylib       	0x00007fff5cabc33d _pthread_body + 126
7   libsystem_pthread.dylib       	0x00007fff5cabf2a7 _pthread_start + 70
8   libsystem_pthread.dylib       	0x00007fff5cabb425 thread_start + 13

Thread 8 Crashed:: AudioQueue thread
0   libsystem_kernel.dylib        	0x00007fff5ca08b86 __pthread_kill + 10
1   libsystem_pthread.dylib       	0x00007fff5cabec50 pthread_kill + 285
2   libsystem_c.dylib             	0x00007fff5c9721c9 abort + 127
3   libsystem_malloc.dylib        	0x00007fff5ca806e2 malloc_vreport + 545
4   libsystem_malloc.dylib        	0x00007fff5ca804a3 malloc_report + 152
5   libavutil.56.dylib            	0x0000000110887189 av_freep + 21
6   com.yourcompany.Beslyric-for-X	0x000000010e807a7f PlayThread::fillAudio(void*, unsigned char*, int) + 143 (musicPlayer.cpp:684)
7   libSDL2-2.0.0.dylib           	0x0000000110ab6c3b outputCallback + 188
8   com.apple.audio.toolbox.AudioToolbox	0x00007fff2e152870 ClientAudioQueue::CallOutputCallback(AudioQueueBuffer*) + 260
9   com.apple.audio.toolbox.AudioToolbox	0x00007fff2e150ccb AQClientCallbackMessageReader::DispatchCallbacks(void const*, unsigned long) + 179
10  com.apple.audio.toolbox.AudioToolbox	0x00007fff2e13c04f ClientAudioQueue::FetchAndDeliverPendingCallbacks(unsigned int) + 291
11  com.apple.audio.toolbox.AudioToolbox	0x00007fff2e13bebd AQCallbackReceiver_CallbackNotificationsAvailable + 121
12  com.apple.audio.toolbox.AudioToolbox	0x00007fff2e13bc3e _XCallbackNotificationsAvailable + 33
13  com.apple.audio.toolbox.AudioToolbox	0x00007fff2e13ba4c mshMIGPerform + 230
14  com.apple.CoreFoundation      	0x00007fff2f848959 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41
15  com.apple.CoreFoundation      	0x00007fff2f8488b7 __CFRunLoopDoSource1 + 527
16  com.apple.CoreFoundation      	0x00007fff2f830945 __CFRunLoopRun + 2574
17  com.apple.CoreFoundation      	0x00007fff2f82fce4 CFRunLoopRunSpecific + 463
18  libSDL2-2.0.0.dylib           	0x0000000110ab69f3 audioqueue_thread + 931
19  libSDL2-2.0.0.dylib           	0x0000000110a50a2b SDL_RunThread + 60
20  libSDL2-2.0.0.dylib           	0x0000000110ab2d1a RunThread + 9
21  libsystem_pthread.dylib       	0x00007fff5cabc33d _pthread_body + 126
22  libsystem_pthread.dylib       	0x00007fff5cabf2a7 _pthread_start + 70
23  libsystem_pthread.dylib       	0x00007fff5cabb425 thread_start + 13
  
...

截至目前，这个问题在 Windows 7 / 10 、 Ubuntu 18.04 上都未曾出现过。

另外我想知道的是， Windows 和 Ubuntu 上关于程序崩溃的报告，像 macOS 这样比较详细的，能在哪里找到呢？ Beslyric-for-X 有时会在切歌后直接崩溃，我没能找到日志，难以分析。

[pzhlkj6612]

在 Ubuntu 和 macOS 上复现本问题的简便方法：

AVPacket avpkt;
av_packet_unref(&avpkt);

[pzhlkj6612]

找源码：

0. 源头：void av_packet_unref(AVPacket *pkt)：

https://github.com/FFmpeg/FFmpeg/blob/n4.2.2/libavcodec/avpacket.c#L599-L606

1. 调用void av_packet_free_side_data(AVPacket *pkt)：

https://github.com/FFmpeg/FFmpeg/blob/n4.2.2/libavcodec/avpacket.c#L270-L277

2. 调用void av_buffer_unref(AVBufferRef **buf) 和 static void buffer_replace(AVBufferRef **dst, AVBufferRef **src)：

https://github.com/FFmpeg/FFmpeg/blob/n4.2.2/libavutil/buffer.c#L107-L131

3. 调用av_freep：

https://github.com/FFmpeg/FFmpeg/blob/n4.2.2/libavutil/mem.c#L218-L234

暂时没有去找出究竟是哪一个av_freep调用引发了异常。