CRASH: SRS2 crashed for TS encoder assert failed.

[winlinvip]

I found SRS2 crashed for some special audio/video packets:

Program terminated with signal 6, Aborted.
#0  0x00007f285cf82625 in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.149.el6_6.5.x86_64 libgcc-4.4.7-17.el6.x86_64 libstdc++-4.4.7-17.el6.x86_64
(gdb) bt
#0  0x00007f285cf82625 in raise () from /lib64/libc.so.6
#1  0x00007f285cf83e05 in abort () from /lib64/libc.so.6
#2  0x00007f285cf7b74e in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007f285cf7b810 in __assert_fail () from /lib64/libc.so.6
#4  0x000000000041bd38 in SrsTsContext::encode_pes (this=0x4b80090, writer=0x4bacbe0, msg=0x48a67a0, pid=257, sid=SrsTsStreamAudioAAC, pure_audio=false)
    at src/kernel/srs_kernel_ts.cpp:453
#5  0x000000000041b4c0 in SrsTsContext::encode (this=0x4b80090, writer=0x4bacbe0, msg=0x48a67a0, vc=SrsCodecVideoAVC, ac=SrsCodecAudioAAC)
    at src/kernel/srs_kernel_ts.cpp:367
#6  0x00000000004251b4 in SrsTSMuxer::write_audio (this=0x4babb40, audio=0x48a67a0) at src/kernel/srs_kernel_ts.cpp:2744
#7  0x0000000000497ba3 in SrsHlsMuxer::flush_audio (this=0x4d65c40, cache=0x4a55730) at src/app/srs_app_hls.cpp:678
#8  0x000000000049a49a in SrsHlsCache::on_unpublish (this=0x4d2adc0, muxer=0x4d65c40) at src/app/srs_app_hls.cpp:1033
#9  0x000000000049b74f in SrsHls::on_unpublish (this=0x4b7f500) at src/app/srs_app_hls.cpp:1315
#10 0x000000000048a8d0 in SrsSource::on_audio_imp (this=0x4d64e80, msg=0x7f28507e6b00) at src/app/srs_app_source.cpp:1688
#11 0x0000000000489ffd in SrsSource::on_audio (this=0x4d64e80, shared_audio=0x4e13af0) at src/app/srs_app_source.cpp:1592
#12 0x00000000004801d4 in SrsRtmpConn::process_publish_message (this=0x48a4e60, source=0x4d64e80, msg=0x4e13af0, vhost_is_edge=false)
    at src/app/srs_app_rtmp_conn.cpp:1036
#13 0x0000000000480051 in SrsRtmpConn::handle_publish_message (this=0x48a4e60, source=0x4d64e80, msg=0x4e13af0, is_fmle=true, vhost_is_edge=false)
    at src/app/srs_app_rtmp_conn.cpp:1013
#14 0x0000000000517461 in SrsPublishRecvThread::handle (this=0x7f285080a890, msg=0x4e13af0) at src/app/srs_app_recv_thread.cpp:386
#15 0x0000000000516002 in SrsRecvThread::cycle (this=0x7f285080a898) at src/app/srs_app_recv_thread.cpp:100
#16 0x00000000004b1e13 in SrsReusableThread2::cycle (this=0x4cf8f00) at src/app/srs_app_thread.cpp:540
#17 0x00000000004b0d49 in internal::SrsThread::thread_cycle (this=0x4e1af30) at src/app/srs_app_thread.cpp:207
#18 0x00000000004b0f5c in internal::SrsThread::thread_fun (arg=0x4e1af30) at src/app/srs_app_thread.cpp:245

TS encoder assert failed:

(gdb) f 4
#4  0x000000000041bd38 in SrsTsContext::encode_pes (this=0x4b80090, writer=0x4bacbe0, msg=0x48a67a0, pid=257, sid=SrsTsStreamAudioAAC, pure_audio=false)
    at src/kernel/srs_kernel_ts.cpp:453
453	    srs_assert(channel);
(gdb) p channel
$1 = (SrsTsChannel *) 0x0
(gdb) p *this
$2 = {_vptr.SrsTsContext = 0x88c650, pids = std::map with 2 elements = {[0] = 0x494b640, [4097] = 0x4d4a9f0}, pure_audio = false, vcodec = SrsCodecVideoAVC, 
  acodec = SrsCodecAudioAAC}

The caller stack:

(gdb) f 5
#5  0x000000000041b4c0 in SrsTsContext::encode (this=0x4b80090, writer=0x4bacbe0, msg=0x48a67a0, vc=SrsCodecVideoAVC, ac=SrsCodecAudioAAC)
    at src/kernel/srs_kernel_ts.cpp:367
367	        return encode_pes(writer, msg, audio_pid, as, vs == SrsTsStreamReserved);
(gdb) p *this
$3 = {_vptr.SrsTsContext = 0x88c650, pids = std::map with 2 elements = {[0] = 0x494b640, [4097] = 0x4d4a9f0}, pure_audio = false, vcodec = SrsCodecVideoAVC, 
  acodec = SrsCodecAudioAAC}

[winlinvip]

It is very strange that both PAT and PMT exist, but there is no Audio or Video. According to the code, it seems to be an impossible logic.

(gdb) p *this
$8 = {_vptr.SrsTsContext = 0x88c650, 

pids = std::map with 2 elements = {[0] = 0x494b640, [4097] = 0x4d4a9f0}, 
pure_audio = false, vcodec = SrsCodecVideoAVC, acodec = SrsCodecAudioAAC}

Moreover, vcodec and acodec are not Disabled.

There is only one possibility, which is that PAT was written (which sets PAT and PMT), but PMT was not written.

The last connected log:

2719364:[2017-04-01 15:26:49.147][trace][30912][501104] RTMP client ip=101.81.72.136
2719365:[2017-04-01 15:26:49.176][trace][30912][501104] simple handshake success.
2719366:[2017-04-01 15:26:49.205][trace][30912][501104] input chunk size to 4096
2719367:[2017-04-01 15:26:49.205][trace][30912][501104] connect app, tcUrl=http://www.ossrs.net/players/srs_player.html?app=live&stream=demo&server=www.ossrs.net&port=1935&autostart=true&vhost=www.ossrs.net, pageUrl=, swfUrl=http://www.ossrs.net/players/srs_player.html?app=live&stream=demo&server=www.ossrs.net&port=1935&autostart=true&vhost=www.ossrs.net, schema=http, vhost=__defaultVhost__, port=1935, app=players/srs_player.html, args=null
2719368:[2017-04-01 15:26:49.205][trace][30912][501104] out chunk size to 128
2719369:[2017-04-01 15:26:49.464][trace][30912][501104] client identified, type=fmle-publish, stream_name=, duration=-1.00
2719370:[2017-04-01 15:26:49.464][trace][30912][501104] source url=/players/srs_player.html/, ip=101.81.72.136, cache=1, is_edge=0, source_id=-1[-1]
2719371:[2017-04-01 15:26:49.752][warn][30912][501104][11] ignore the segment open, for segment is already open.
2719372:[2017-04-01 15:26:49.753][trace][30912][501104] hls: win=60.00, frag=10.00, prefix=, path=./objs/nginx/html, m3u8=[app]/[stream].m3u8, ts=[app]/[stream]-[seq].ts, aof=2.00, floor=0, clean=1, waitk=1, dispose=0
2719373:[2017-04-01 15:26:49.763][trace][30912][501104] http: mount flv stream for vhost=/players/srs_player.html/, mount=/players/srs_player.html/.flv
2719374:[2017-04-01 15:26:49.778][trace][30912][501104] start publish mr=0/350, p1stpt=20000, pnt=20000, tcp_nodelay=0, rtcid=501106
2719375:[2017-04-01 15:26:50.010][trace][30912][501104] got metadata, width=1920, height=1050
2719376:[2017-04-01 15:26:50.789][trace][30912][501104] 7B audio sh, codec(10, profile=LC, 2channels, 0kbps, 44100HZ), flv(16bits, 2channels, 44100HZ)
2719377:[2017-04-01 15:26:50.806][trace][30912][501104] 46B video sh,  codec(7, profile=High, level=4, 1920x1056, 0kbps, 0fps, 0s)
2719378:[2017-04-01 15:26:50.806][error][30912][501104][9] write to file  failed. ret=1045(Bad file descriptor)
2719379:[2017-04-01 15:26:50.806][error][30912][501104][9] ts write ts packet failed. ret=1045(Bad file descriptor)
2719380:[2017-04-01 15:26:50.823][error][30912][501104][9] hls encode audio failed. ret=1045(Bad file descriptor)
2719381:[2017-04-01 15:26:50.823][error][30912][501104][9] hls cache write audio failed. ret=1045(Bad file descriptor)
2719382:[2017-04-01 15:26:50.823][warn][30912][501104][9] hls process audio message failed, ignore and disable hls. ret=1045

Discovered that there is a streamName that is empty, causing the file writing to fail:

client identified, type=fmle-publish, stream_name=, duration=-1.00
write to file  failed. ret=1045(Bad file descriptor)
ts write ts packet failed.

It happened that the Program Association Table (PAT) failed to write, resulting in only PAT and Program Map Table (PMT) being present, without any Audio or Video.

TRANS_BY_GPT3

[winlinvip]

Therefore, there are two solutions:

1. Do not allow StreamName to be empty.
2. Check if the TS Context is initialized successfully. If PAT and PMT are not written successfully, consider it as initialization failure and return failure.

TRANS_BY_GPT3