[gstreamer-bugs] [Bug 100931] [PATCH] subtitles

[bugzilla-daemon at bugzilla.gnome.org]

Please DO NOT reply to this by email. All additional comments should be made in
the comments box of this bug report.

 http://bugzilla.gnome.org/show_bug.cgi?id=100931
 GStreamer | gst-plugins | Ver: 0.8.0





------- Additional Comments From rbultje at ronald.bitfreak.net  2005-01-08 09:56 -------
As for the problem on EOS, it seems to be related to yet another race in core
w.r.t. probes. Here's some logs from valgrind and gdb (you can get it to crash
if you try hard enough):

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -157287504 (LWP 26719)]
0x07c0a610 in g_slist_find () from /usr/lib/libglib-2.0.so.0
(gdb) bt
#0  0x07c0a610 in g_slist_find () from /usr/lib/libglib-2.0.so.0
#1  0x00d08906 in gst_probe_dispatcher_dispatch (disp=0x9184934,
    data=0xf69ff4a4) at gstprobe.c:222
#2  0x00d03960 in gst_pad_push (pad=0x9184890, data=0x8f54b40) at gstpad.c:3202
#3  0x00114582 in get_group_schedule_function (argc=0, argv=0x91bb898)
    at gstoptimalscheduler.c:1305
(gdb) frame 2
#2  0x00d03960 in gst_pad_push (pad=0x9184890, data=0x8f54b40) at gstpad.c:3202
3202      if (!gst_probe_dispatcher_dispatch (&(GST_REAL_PAD (pad)->probedisp),
&data))
(gdb) print *pad
$1 = {object = {object = {g_type_instance = {g_class = 0x68737570},
      ref_count = 1702257952, qdata = 0x3020746e},
    name = 0x35663878 <Address 0x35663878 out of bounds>, lock = 0x38333634,
    parent = 0x79742820, flags = 824206704, _gst_reserved = {0x6572202c,
      0x756f6366, 0x3120746e, 0x41440029}}, element_private = 0x49,
  padtemplate = 0x91bde90, _gst_reserved = {0x91875e0, 0x73672029, 0x64617074,
    0x3428632e}}
(gdb) frame 1
#1  0x00d08906 in gst_probe_dispatcher_dispatch (disp=0x9184934,
    data=0xf69ff4a4) at gstprobe.c:222
222         if (g_slist_find (disp->probes, probe) && probe->single_shot) {
(gdb) print disp
$3 = (GstProbeDispatcher *) 0x9184934
(gdb) print *disp
$4 = {active = 65, probes = 0x91bdfa8}
(gdb) print *probe->probes
There is no member named probes.
(gdb) print *disp->probes
$5 = {data = 0x65732064, next = 0x7463656c}
(gdb) print *disp->probes->next
Cannot access memory at address 0x7463656c

==26745== Thread 3:
==26745== Invalid read of size 4
==26745==    at 0x1B9418FE: gst_probe_dispatcher_dispatch (gstprobe.c:222)
==26745==    by 0x1B93C95F: gst_pad_push (gstpad.c:3202)
==26745==    by 0x1C27A581: get_group_schedule_function (gstoptimalscheduler.c:1305)
==26745==    by 0x1C27A037: schedule_group (gstoptimalscheduler.c:1154)
==26745==  Address 0x1C0DD498 is 168 bytes inside a block of size 196 free'd
==26745==    at 0x1B904FA1: free (vg_replace_malloc.c:153)
==26745==    by 0x7BFB023: g_free (in /usr/lib/libglib-2.0.so.0.600.0)
==26745==    by 0x69125A: g_type_free_instance (in
/usr/lib/libgobject-2.0.so.0.600.0)
==26745==    by 0x67CC80: (within /usr/lib/libgobject-2.0.so.0.600.0)

It seems like the realpad itself is dereferenced (and free'ed) in the probe
callback (perhaps the part where we destroy the GstPlayBaseGroup and unref the
GstStreamInfo list?). That makes this very hard to get right...


------- You are receiving this mail because: -------
You are the assignee for the bug.
You are the QA contact for the bug.