Android TV应用ExoPlayer循环播放时libc SIGABRT崩溃求助

问题概述 #

使用ExoPlayer进行8-12小时无限循环播放视频的Android TV应用，触发libc: Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE)崩溃，崩溃线程为EventThread。

崩溃日志 #

8-13 17:18:49.337  2863  3829 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 3829 (EventThread), pid 2863 (om.wallview.app)
08-13 17:18:50.188  3849  3849 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-13 17:18:50.188  3849  3849 F DEBUG   : Build fingerprint: 'Sony/BRAVIA_VU2/BRAVIA_VU1_2K:11/RTT7.210426.001/73-60427:user/release-keys'
08-13 17:18:50.188  3849  3849 F DEBUG   : Revision: '0'
08-13 17:18:50.189  3849  3849 F DEBUG   : ABI: 'arm'
08-13 17:18:50.197  3849  3849 F DEBUG   : Timestamp: 2022-08-13 17:18:50+0530
08-13 17:18:50.197  3849  3849 F DEBUG   : pid: 2863, tid: 3829, name: EventThread  >>> com.wallview.app <<<
08-13 17:18:50.197  3849  3849 F DEBUG   : uid: 10091
08-13 17:18:50.197  3849  3849 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
08-13 17:18:50.197  3849  3849 F DEBUG   :     r0  00000000  r1  00000ef5  r2  00000006  r3  b7f9edd8
08-13 17:18:50.197  3849  3849 F DEBUG   :     r4  b7f9edec  r5  b7f9edd0  r6  00000b2f  r7  0000016b
08-13 17:18:50.197  3849  3849 F DEBUG   :     r8  b7f9edd8  r9  b7f9ede8  r10 b7f9ee08  r11 b7f9edf8
08-13 17:18:50.197  3849  3849 F DEBUG   :     ip  00000ef5  sp  b7f9eda8  lr  b3c95a41  pc  b3c95a54
08-13 17:18:50.252  3849  3849 F DEBUG   : backtrace:
08-13 17:18:50.252  3849  3849 F DEBUG   :       #00 pc 00038a54  /apex/com.android.runtime/lib/bionic/libc.so (abort+172) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.252  3849  3849 F DEBUG   :       #01 pc 0002e70f  /apex/com.android.runtime/lib/bionic/libc.so (scudo::die()+2) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.253  3849  3849 F DEBUG   :       #02 pc 0002e1bb  /apex/com.android.runtime/lib/bionic/libc.so (scudo::dieOnMapUnmapError(bool)+30) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.253  3849  3849 F DEBUG   :       #03 pc 0002e797  /apex/com.android.runtime/lib/bionic/libc.so (scudo::map(void*, unsigned long, char const*, unsigned long, scudo::MapPlatformData*)+132) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.253  3849  3849 F DEBUG   :       #04 pc 00031cc5  /apex/com.android.runtime/lib/bionic/libc.so (scudo::PackedCounterArray::PackedCounterArray(unsigned long, unsigned long, unsigned long)+184) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #05 pc 00031795  /apex/com.android.runtime/lib/bionic/libc.so (void scudo::releaseFreeMemoryToOS<scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000> >::TransferBatch, scudo::ReleaseRecorder, scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000>::releaseToOSMaybe(scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000>::SizeClassInfo*, unsigned long, bool)::'lambda'(unsigned long)>(scudo::IntrusiveList<scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000> >::TransferBatch> const&, unsigned long, unsigned long, unsigned long, unsigned long, scudo::ReleaseRecorder*, scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000>::releaseToOSMaybe(scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000>::SizeClassInfo*, unsigned long, bool)::'lambda'(unsigned long))+128) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #06 pc 000316ed  /apex/com.android.runtime/lib/bionic/libc.so (scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000>::releaseToOSMaybe(scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000>::SizeClassInfo*, unsigned long, bool)+304) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #07 pc 000315a7  /apex/com.android.runtime/lib/bionic/libc.so (scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000> >::drain(scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator32<scudo::TableSizeClassMap<scudo::AndroidSizeClassConfig>, 18ul, 1000, 1000> >::PerClass*, unsigned long)+202) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #08 pc 00031fd7  /apex/com.android.runtime/lib/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::quarantineOrDeallocateChunk(void*, scudo::Chunk::UnpackedHeader*, unsigned long)+422) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #09 pc 0002f931  /apex/com.android.runtime/lib/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::deallocate(void*, scudo::Chunk::Origin, unsigned long, unsigned long)+168) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #10 pc 0002f87b  /apex/com.android.runtime/lib/bionic/libc.so (scudo_free+18) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.255  3849  3849 F DEBUG   :       #11 pc 00463c85  /apex/com.android.art/lib/libart.so (art::ThreadList::Unregister(art::Thread*)+488) (BuildId: 2d4c898c2aaeb2cc489d7516236d9cc6)
08-13 17:18:50.256  3849  3849 F DEBUG   :       #12 pc 00445395  /apex/com.android.art/lib/libart.so (art::Thread::CreateCallback(void*)+1132) (BuildId: 2d4c898c2aaeb2cc489d7516236d9cc6)
08-13 17:18:50.256  3849  3849 F DEBUG   :       #13 pc 0008115f  /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+40) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:50.256  3849  3849 F DEBUG   :       #14 pc 00039f5d  /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30) (BuildId: 2d3223c28a2147a5dbd4b9b709eabc6b)
08-13 17:18:41.157   706   706 I chatty  : uid=1000 system_server identical 15 lines
08-13 17:18:51.165   706   706 V HotPlugDetectionAction: Poll_all_devices.
08-13 17:18:54.974   706   741 I BootReceiver: Copying /data/tombstones/tombstone_10 to DropBox (SYSTEM_TOMBSTONE)
08-13 17:18:54.978   706   741 I DropBoxManagerService: add tag=SYSTEM_TOMBSTONE isTagEnabled=true flags=0x2
08-13 17:18:54.979   706  3855 I DropBoxManagerService: add tag=data_app_native_crash isTagEnabled=true flags=0x2
08-13 17:18:54.998   706  3854 W ActivityTaskManager:   Force finishing activity com.wallview.app/.activities.MainActivity

崩溃原因分析 #

从调用栈可以看出，崩溃发生在Scudo内存分配器尝试将空闲内存释放回系统时的内存映射操作失败，进而触发abort()终止进程。整个调用链的核心逻辑是：
线程注销（art::ThreadList::Unregister）触发内存释放（scudo_free）→ Scudo尝试释放内存块到系统（releaseFreeMemoryToOS）→ 内存映射操作失败（scudo::map）→ 触发致命错误。

结合长期循环播放的场景，核心诱因大概率是：

1. 内存泄漏/碎片累积：循环播放过程中，ExoPlayer的EventThread或关联组件未正确释放资源，导致内存碎片持续增加，Scudo无法找到连续内存块完成释放操作。
2. ExoPlayer资源未彻底回收：复用播放器实例时，媒体源、缓存、渲染器等资源未完全清理，内存占用持续攀升，触发内存分配器异常。
3. Android 11 Scudo分配器兼容性问题：设备为Sony BRAVIA Android 11，Scudo作为Android 10+默认内存分配器，在长期运行进程中存在内存释放的兼容性bug。

解决方案及排查步骤 #

• 优化ExoPlayer资源回收逻辑：
  • 每次播放循环结束后，调用player.release()完全销毁播放器实例，再重新初始化，避免复用导致的资源残留；
  • 确保媒体源（MediaSource）、轨道选择器（TrackSelector）等组件在循环间隙同步销毁；
  • 定期调用CacheEvictor清理ExoPlayer缓存，避免缓存文件占用过多内存。
• 缓解内存压力：
  • 在AndroidManifest.xml的<application>标签中添加android:largeHeap="true"，为应用申请更大的堆内存；
  • 临时禁用Scudo自动释放内存到系统（仅作测试）：在应用启动时执行System.setProperty("libc.debug.malloc.release_to_os", "0")，但需注意这会增加内存占用。
• 升级ExoPlayer版本：
  • 检查当前使用的ExoPlayer版本，升级到最新稳定版，修复官方已知的内存泄漏和线程管理问题。
• 检测内存泄漏：
  • 集成LeakCanary工具，监控长期运行中的内存泄漏点，针对性修复泄漏的对象。
• 兼容性测试：
  • 在其他Android TV设备或更高