diff --git a/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/audiorooms/room/AudioRoomFullScreen.kt b/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/audiorooms/room/AudioRoomFullScreen.kt index c3fa9378a..2fa567134 100644 --- a/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/audiorooms/room/AudioRoomFullScreen.kt +++ b/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/audiorooms/room/AudioRoomFullScreen.kt @@ -228,8 +228,22 @@ private fun TalkRow( var permissionDenied by rememberSaveable { mutableStateOf(false) } val permissionLauncher = rememberLauncherForActivityResult(ActivityResultContracts.RequestPermission()) { granted -> - if (granted) viewModel.startBroadcast(speakerPubkeyHex) else permissionDenied = true + if (granted) { + permissionDenied = false + viewModel.startBroadcast(speakerPubkeyHex) + } else { + permissionDenied = true + } } + // If the user grants RECORD_AUDIO via the system Settings deep-link + // and returns to the activity, the permissionLauncher callback never + // fires and `permissionDenied` would otherwise stay true. Recompute + // every time the permission state could have changed (audit round-2 + // Android #12). + val showDenialWarning = + permissionDenied && + ContextCompat.checkSelfPermission(context, Manifest.permission.RECORD_AUDIO) != + PackageManager.PERMISSION_GRANTED Row( modifier = Modifier.fillMaxWidth().padding(top = 8.dp), @@ -252,7 +266,7 @@ private fun TalkRow( }) { Text(stringRes(R.string.audio_room_talk)) } - if (permissionDenied) { + if (showDenialWarning) { Text( text = stringRes(R.string.audio_room_record_permission_required), style = MaterialTheme.typography.bodySmall, diff --git a/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/viewmodels/AudioRoomViewModel.kt b/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/viewmodels/AudioRoomViewModel.kt index d30614e3b..f8847ee8a 100644 --- a/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/viewmodels/AudioRoomViewModel.kt +++ b/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/viewmodels/AudioRoomViewModel.kt @@ -164,11 +164,16 @@ class AudioRoomViewModel( autoRetryJob = null autoRetryAttempts = 0 retryPending = false - // Cancel any previous state observer too — otherwise its delayed - // emissions can clobber the fresh Connecting UI we set below - // (audit VM #8). - stateObserverJob?.cancel() - stateObserverJob = null + // If a stale listener is still set (e.g. arrived in Failed and the + // user is manually retrying before the auto-retry fires, or + // entering from a server-Closed-but-not-yet-disconnected state), + // tear it down so the new connect doesn't leave the old MoQ + // session open and unowned (audit round-2 VM #3). teardown() + // also cancels stateObserverJob so its delayed emissions can't + // clobber the fresh Connecting UI. + if (listener != null || stateObserverJob != null) { + teardown(targetState = ConnectionUiState.Idle, finalCleanup = false) + } _uiState.update { it.copy(connection = ConnectionUiState.Connecting(ConnectionUiState.Step.ResolvingRoom)) } @@ -549,19 +554,39 @@ class AudioRoomViewModel( viewModelScope.launch { runCatching { handle.unsubscribe() } } return } + // Allocate native resources (MediaCodec decoder + AudioTrack + // player on Android). Both are heavy and leaky if dropped on + // the floor — wrap them in a nested try so any cancellation + // or throw between here and slot.attach releases them + // (audit round-2 VM #7). val decoder = decoderFactory() - val player = playerFactory() - val isMuted = _uiState.value.isMuted - val roomPlayer = AudioRoomPlayer(decoder, player, viewModelScope) - // Apply current mute state before play() opens the device so the - // first frame respects it. - player.setMutedSafe(isMuted) - // Tap the object flow to drive the speaking-now indicator before - // the decoder consumes it. - val instrumented = handle.objects.onEach { onSpeakerActivity(pubkey) } - roomPlayer.play(instrumented, onError = { /* swallow per-packet decoder errors */ }) - slot.attach(handle, roomPlayer, player) - publishActiveSpeakers() + val player = + try { + playerFactory() + } catch (t: Throwable) { + runCatching { decoder.release() } + throw t + } + try { + val isMuted = _uiState.value.isMuted + val roomPlayer = AudioRoomPlayer(decoder, player, viewModelScope) + // Apply current mute state before play() opens the device so the + // first frame respects it. + player.setMutedSafe(isMuted) + // Tap the object flow to drive the speaking-now indicator before + // the decoder consumes it. + val instrumented = handle.objects.onEach { onSpeakerActivity(pubkey) } + roomPlayer.play(instrumented, onError = { /* swallow per-packet decoder errors */ }) + slot.attach(handle, roomPlayer, player) + publishActiveSpeakers() + } catch (t: Throwable) { + // Either CancellationException (scope cancelled mid-construction) + // or an unexpected throw — release the half-built pipeline and + // re-throw so the outer catch handles slot rollback. + runCatching { player.stop() } + runCatching { decoder.release() } + throw t + } } catch (ce: CancellationException) { throw ce } catch (t: Throwable) { diff --git a/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/audio/AudioRoomBroadcaster.kt b/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/audio/AudioRoomBroadcaster.kt index d4cf38de7..45cddbd77 100644 --- a/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/audio/AudioRoomBroadcaster.kt +++ b/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/audio/AudioRoomBroadcaster.kt @@ -53,19 +53,33 @@ class AudioRoomBroadcaster( private val scope: CoroutineScope, ) { private var job: Job? = null - private var stopped = false + + @Volatile private var stopped: Boolean = false @Volatile private var muted: Boolean = false /** * Start capturing + encoding + publishing in the background. Returns - * immediately. Calling twice is an error. + * immediately. Calling twice is an error. If [AudioCapture.start] + * throws (mic device unavailable, etc.), the broadcaster is left in + * a stopped state and the exception propagates so the caller can + * surface it to the user. */ fun start(onError: (AudioException) -> Unit = { /* swallow */ }) { check(!stopped) { "AudioRoomBroadcaster already stopped" } check(job == null) { "AudioRoomBroadcaster.start already called" } - capture.start() + // Audit round-2 MoQ #7: capture.start() can throw before we have + // a job. Mark stopped + propagate so a half-started capture isn't + // left holding the mic and the broadcaster instance can't be + // accidentally re-started. + try { + capture.start() + } catch (t: Throwable) { + stopped = true + runCatching { capture.stop() } + throw t + } job = scope.launch { try { diff --git a/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/moq/MoqSession.kt b/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/moq/MoqSession.kt index 104e20add..9273cf7e8 100644 --- a/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/moq/MoqSession.kt +++ b/nestsClient/src/commonMain/kotlin/com/vitorpamplona/nestsclient/moq/MoqSession.kt @@ -30,6 +30,7 @@ import kotlinx.coroutines.CoroutineScope import kotlinx.coroutines.Job import kotlinx.coroutines.channels.BufferOverflow import kotlinx.coroutines.channels.Channel +import kotlinx.coroutines.currentCoroutineContext import kotlinx.coroutines.flow.Flow import kotlinx.coroutines.flow.first import kotlinx.coroutines.flow.receiveAsFlow @@ -472,9 +473,23 @@ class MoqSession private constructor( } } handle?.let { existing -> - stateMutex.withLock { existing.markSessionClosedLocked() } - runCatching { - writeMutex.withLock { controlStream.write(MoqCodec.encode(Unannounce(msg.namespace))) } + val shouldWrite = + stateMutex.withLock { + existing.markSessionClosedLocked() + // Same compare-and-set as unannounce() to avoid + // a duplicate UNANNOUNCE on the wire when a + // concurrent unannounce() is mid-flight. + if (existing.unannounceWritten) { + false + } else { + existing.unannounceWritten = true + true + } + } + if (shouldWrite) { + runCatching { + writeMutex.withLock { controlStream.write(MoqCodec.encode(Unannounce(msg.namespace))) } + } } stateMutex.withLock { announces.remove(msg.namespace) } } @@ -621,14 +636,21 @@ class MoqSession private constructor( // (handleInboundSubscribe writing SUBSCRIBE_OK / SUBSCRIBE_ERROR, // handleInboundUnsubscribe writing SUBSCRIBE_DONE) finishes its // writeMutex.withLock { ... } critical section before we send FIN - // on the control stream. Joining a cancelled coroutine waits for - // its `finally`s to run, including the lock release. + // on the control stream. + // + // Self-join guard: when close() is called from a pump's own + // exception handler (the try/catch in startPumps), `coroutineContext[Job]` + // is the very Job we're trying to join. Joining ourselves + // suspends forever — the lambda can't finish until close() returns, + // and close() can't return until the lambda finishes. Skip the + // join in that case (round-2 audit MoQ #1). val ctrlPump = controlPumpJob val datagramPump = datagramPumpJob ctrlPump?.cancel() datagramPump?.cancel() - runCatching { ctrlPump?.join() } - runCatching { datagramPump?.join() } + val self = currentCoroutineContext()[Job] + runCatching { if (ctrlPump != null && ctrlPump !== self) ctrlPump.join() } + runCatching { if (datagramPump != null && datagramPump !== self) datagramPump.join() } runCatching { writeMutex.withLock { controlStream.finish() } } runCatching { transport.close(code, reason) } } @@ -704,6 +726,11 @@ class MoqSession private constructor( internal val tracks = HashMap() internal var sessionClosed = false + // True once UNANNOUNCE has been written on the wire, so a + // concurrent unannounce() + post-OK AnnounceError handler don't + // both emit it (audit round-2 MoQ #2). Read/written under stateMutex. + internal var unannounceWritten = false + override suspend fun openTrack(name: ByteArray): TrackPublisher { val key = TrackKey(name) val publisher = TrackPublisherImpl(name) @@ -736,7 +763,20 @@ class MoqSession private constructor( // thinks the namespace exists but our state has dropped it. } toClose.forEach { runCatching { it.close() } } - if (!closed) { + // Race guard: a post-OK AnnounceError handler may have already + // written UNANNOUNCE for this namespace (audit round-2 MoQ #2). + // Compare-and-set under stateMutex so only one writer fires + // the wire frame. + val shouldWrite = + stateMutex.withLock { + if (unannounceWritten) { + false + } else { + unannounceWritten = true + true + } + } + if (shouldWrite && !closed) { runCatching { writeMutex.withLock { controlStream.write(MoqCodec.encode(Unannounce(namespace))) } }