[gstreamer-bugs] [Bug 536521] New: Refcounting errors in playbin

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=536521

  GStreamer | gst-plugins-base | Ver: HEAD CVS
           Summary: Refcounting errors in playbin
           Product: GStreamer
           Version: HEAD CVS
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-base
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: msmith at xiph.org
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: Unspecified
   GNOME milestone: Unspecified


I'm getting occasional errors like:
  GLib-GObject-WARNING **: invalid unclassed pointer in cast to
`GstPlayBaseBin'

With G_DEBUG=fatal_warnings, I got this stack trace:

(gdb) bt
#0  0xb7f96410 in __kernel_vsyscall ()
#1  0xb7d1e085 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7d1fa01 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0xb6c0ee4a in g_logv () from /usr/lib/libglib-2.0.so.0
#4  0xb6c0ee89 in g_log () from /usr/lib/libglib-2.0.so.0
#5  0xb6ca69d3 in g_type_check_instance_cast ()
   from /usr/lib/libgobject-2.0.so.0
#6  0xada677be in decodebin_element_removed_cb (decodebin=0xa7cfc00, 
    element=0x8e9e160, data=0x8e900c0) at gstplaybasebin.c:1469
#7  0xb6c95f5a in g_cclosure_marshal_VOID__OBJECT ()
   from /usr/lib/libgobject-2.0.so.0
#8  0xb6c89759 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#9  0xb6c9dd1d in ?? () from /usr/lib/libgobject-2.0.so.0
#10 0xb6c9f916 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#11 0xb6c9fc59 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#12 0xadaa8154 in gst_bin_remove_func (bin=0xa7cfc00, element=0x8e9e160)
    at gstbin.c:1237
#13 0xadaa58ec in gst_bin_remove (bin=0xa7cfc00, element=0x8e9e160)
    at gstbin.c:1298
#14 0xadaac17f in gst_bin_dispose (object=0xa7cfc00) at gstbin.c:505
#15 0xabd08338 in gst_decode_bin_dispose (object=0xa7cfc00)
    at gstdecodebin.c:404
#16 0xb6c8b83c in g_object_unref () from /usr/lib/libgobject-2.0.so.0
#17 0xadaa1f6e in gst_object_unref (object=0xa7cfc00) at gstobject.c:355
#18 0xadacc1c2 in gst_message_finalize (message=0xa7c8990) at gstmessage.c:216
#19 0xadacc8d4 in gst_mini_object_unref (mini_object=0xa7c8990)
    at gstminiobject.c:320
#20 0xadaae9ec in gst_bus_source_dispatch (source=0xa229610, 
    callback=0xadaadc40 <gst_bus_async_signal_func>, user_data=0x0)
    at gstbus.c:784
#21 0xb6c05bf8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#22 0xb6c08e5e in ?? () from /usr/lib/libglib-2.0.so.0
#23 0xb6c093ac in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#24 0xb7638c44 in ?? ()


So, what seems to be happening is this:
 1. My code hangs on to some things it gets via a bus messagefor a while. In
this case, a message whose source is the decodebin inside playbin. That's fine;
it has a reference to it.
 2. We set playbin to NULL, then unref it. It gets freed.
 3. We're now done with our bus message, so we unref it. This unrefs its source
- the decodebin.
 4. In GstBin's dispose method, it removes all its children.
 5. And thus the element-removed signal is fired. Playbin connected to this
signal (and never disconnected). Our callback tries to cast to a playbin
instance... but it's been freed, so we explode.

Patch to be attached disconnects the signals that playbin attaches to decodebin
before unreffing decodebin.


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=536521.