[gstreamer-bugs] [Bug 619533] New: [avimux, matroskamux, flvmux] crash when receiving tags on multiple pads at the same time
GStreamer (bugzilla.gnome.org)
bugzilla at gnome.org
Mon May 24 09:22:57 PDT 2010
https://bugzilla.gnome.org/show_bug.cgi?id=619533
GStreamer | gst-plugins-good | git
Summary: [avimux, matroskamux, flvmux] crash when receiving
tags on multiple pads at the same time
Classification: Desktop
Product: GStreamer
Version: git
OS/Version: Linux
Status: UNCONFIRMED
Severity: blocker
Priority: Normal
Component: gst-plugins-good
AssignedTo: gstreamer-bugs at lists.sourceforge.net
ReportedBy: t.i.m at zen.co.uk
QAContact: gstreamer-bugs at lists.sourceforge.net
GNOME target: ---
GNOME version: ---
Not a regression, but would still be nice to fix. Surprised not more people
have run into this:
Starting program: /home/tpm/gst/releases/gstreamer/tools/.libs/gst-launch-0.10
webmmux name=mux \! fakesink filesrc
location=/home/tpm/samples/sintel-trailer.ogv \! decodebin2 name=d d. \!
ffmpegcolorspace \! videorate \! vp8enc \! queue \! mux.video_0 d. \!
audioconvert \! audiorate \! vorbisenc \! queue \! mux.audio_0
...
*** glibc detected ***
/home/tpm/gst/releases/gstreamer/tools/.libs/gst-launch-0.10: double free or
corruption (fasttop): 0x00000000008fb5f0 ***
...
Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffd2112910 (LWP 8804)]
0x00007ffff688ff05 in *__GI_raise (sig=<value optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0 0x00007ffff688ff05 in *__GI_raise (sig=<value optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff6892d10 in *__GI_abort () at abort.c:88
#2 0x00007ffff68c56a5 in __libc_message (do_abort=2,
fmt=0x7fffd21114c0 "fffd190f000-7fffd1912000 rw-p 0000f000 fd:00 1901874",
' ' <repeats 20 times>,
"/home/tpm/gst/releases/gst-plugins-base/gst/typefind/.libs/libgsttypefindfunctions.so\n7fffd1912000-7fffd1913000
---p 00000000 00"...) at ../sysdeps/unix/sysv/linux/libc_fatal.c:173
#3 0x00007ffff68cee96 in malloc_printerr (action=3, str=0x7ffff6979730 "double
free or corruption (fasttop)", ptr=<value optimized out>) at malloc.c:6239
#4 0x00007ffff68d4853 in _int_realloc (av=0x7ffff6bade60, oldp=0x8fb5e0,
oldsize=144, nb=272) at malloc.c:5297
#5 0x00007ffff68d4cf0 in *__GI___libc_realloc (oldmem=0x8fb5f0, bytes=256) at
malloc.c:3821
#6 0x00007ffff722133f in IA__g_realloc (mem=0x2262, n_bytes=256) at
/tmp/buildd/glib2.0-2.24.1/glib/gmem.c:171
#7 0x00007ffff71f2d1b in g_array_maybe_expand (array=0x889700, len=<value
optimized out>) at /tmp/buildd/glib2.0-2.24.1/glib/garray.c:687
#8 0x00007ffff71f31d7 in IA__g_array_append_vals (farray=0x2262,
data=0x7fffd2111d10, len=1) at /tmp/buildd/glib2.0-2.24.1/glib/garray.c:354
#9 0x00007ffff7b7ff8b in gst_structure_id_set_value (structure=0x88ea70,
field=361, value=0x8ed408) at gststructure.c:443
#10 0x00007ffff7b848c5 in gst_tag_list_add_value_internal (list=0x88ea70,
mode=GST_TAG_MERGE_KEEP, tag=361, value=0x8ed408, info=0x0) at gsttaglist.c:741
#11 0x00007ffff7b8498a in gst_tag_list_copy_foreach (tag=<value optimized out>,
value=0xffffffffffffffff, user_data=0x0) at gsttaglist.c:757
#12 0x00007ffff7b7dca3 in gst_structure_foreach (structure=0x8ee890,
func=0x7ffff7b84970 <gst_tag_list_copy_foreach>, user_data=0x7fffd2111df0) at
gststructure.c:985
#13 0x00007ffff7b87555 in gst_tag_list_insert (into=0x88ea70, from=0x8ee890,
mode=GST_TAG_MERGE_KEEP) at gsttaglist.c:785
#14 0x00007ffff58d5364 in gst_matroska_mux_handle_sink_event (pad=0x8844a0,
event=0x8efc00) at matroska-mux.c:628
#15 0x00007ffff7b5eda6 in gst_pad_send_event (pad=0x8844a0, event=0x8efc00) at
gstpad.c:5052
#16 0x00007ffff7b5f273 in gst_pad_push_event (pad=0x884320, event=0x8efc00) at
gstpad.c:4908
#17 0x00007ffff49f7175 in gst_queue_push_one (pad=<value optimized out>) at
gstqueue.c:1129
#18 gst_queue_loop (pad=<value optimized out>) at gstqueue.c:1185
#19 0x00007ffff7b89e3b in gst_task_func (task=0x897190) at gsttask.c:271
#20 0x00007ffff724352f in g_thread_pool_thread_proxy (data=<value optimized
out>) at /tmp/buildd/glib2.0-2.24.1/glib/gthreadpool.c:315
#21 0x00007ffff72416e4 in g_thread_create_proxy (data=0x88a9c0) at
/tmp/buildd/glib2.0-2.24.1/glib/gthread.c:1893
#22 0x00007ffff6bb87aa in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#23 0x00007ffff692959d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#24 0x0000000000000000 in ?? ()
(gdb) thread apply all bt
Thread 6 (Thread 0x7fffcb5e5910 (LWP 8807)):
#0 __lll_lock_wait_private () at
../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:97
#1 0x00007ffff68d5748 in _L_lock_9464 () from /lib/libc.so.6
#2 0x00007ffff68d3b31 in *__GI___libc_free (mem=0x7ffff6bade60) at
malloc.c:3736
#3 0x00007ffff7b3a519 in gst_buffer_finalize (buffer=0x8b2ec0) at
gstbuffer.c:199
#4 0x00007ffff7b5c6a3 in gst_mini_object_free (mini_object=0x8b2ec0) at
gstminiobject.c:336
#5 gst_mini_object_unref (mini_object=0x8b2ec0) at gstminiobject.c:371
#6 0x00007fffd321b9f6 in gst_buffer_unref (pad=0x8e0660, buffer=0x8b2ec0) at
/home/tpm/gst/releases/gstreamer/gst/gstbuffer.h:363
#7 vorbis_dec_chain_forward (pad=0x8e0660, buffer=0x8b2ec0) at
gstvorbisdec.c:1150
#8 vorbis_dec_chain (pad=0x8e0660, buffer=0x8b2ec0) at gstvorbisdec.c:1177
#9 0x00007ffff7b616ed in gst_pad_chain_data_unchecked (pad=0x8e0660,
is_buffer=1, data=0x8b2ec0) at gstpad.c:4131
#10 0x00007ffff7b61fae in gst_pad_push_data (pad=0x8e04e0, is_buffer=1,
data=0x8b2ec0) at gstpad.c:4360
#11 0x00007ffff4a066c6 in gst_single_queue_push_one (pad=<value optimized out>)
at gstmultiqueue.c:919
#12 gst_multi_queue_loop (pad=<value optimized out>) at gstmultiqueue.c:1101
#13 0x00007ffff7b89e3b in gst_task_func (task=0x897790) at gsttask.c:271
#14 0x00007ffff724352f in g_thread_pool_thread_proxy (data=<value optimized
out>) at /tmp/buildd/glib2.0-2.24.1/glib/gthreadpool.c:315
#15 0x00007ffff72416e4 in g_thread_create_proxy (data=0x8e53f0) at
/tmp/buildd/glib2.0-2.24.1/glib/gthread.c:1893
#16 0x00007ffff6bb87aa in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#17 0x00007ffff692959d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#18 0x0000000000000000 in ?? ()
Thread 5 (Thread 0x7fffcbfff910 (LWP 8806)):
#0 __lll_lock_wait_private () at
../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:97
#1 0x00007ffff68d5748 in _L_lock_9464 () from /lib/libc.so.6
#2 0x00007ffff68d3b31 in *__GI___libc_free (mem=0x7ffff6bade60) at
malloc.c:3736
#3 0x00007ffff7b3a519 in gst_buffer_finalize (buffer=0x8d92b0) at
gstbuffer.c:199
#4 0x00007ffff7b5c6a3 in gst_mini_object_free (mini_object=0x8d92b0) at
gstminiobject.c:336
#5 gst_mini_object_unref (mini_object=0x8d92b0) at gstminiobject.c:371
#6 0x00007fffd03efe26 in gst_buffer_unref (pad=0x8e0060, buf=0x8d92b0) at
/home/tpm/gst/releases/gstreamer/gst/gstbuffer.h:363
#7 theora_dec_chain_forward (pad=0x8e0060, buf=0x8d92b0) at
gsttheoradec.c:1385
#8 theora_dec_chain (pad=0x8e0060, buf=0x8d92b0) at gsttheoradec.c:1411
#9 0x00007ffff7b616ed in gst_pad_chain_data_unchecked (pad=0x8e0060,
is_buffer=1, data=0x8d92b0) at gstpad.c:4131
#10 0x00007ffff7b61fae in gst_pad_push_data (pad=0x884da0, is_buffer=1,
data=0x8d92b0) at gstpad.c:4360
#11 0x00007ffff4a066c6 in gst_single_queue_push_one (pad=<value optimized out>)
at gstmultiqueue.c:919
#12 gst_multi_queue_loop (pad=<value optimized out>) at gstmultiqueue.c:1101
#13 0x00007ffff7b89e3b in gst_task_func (task=0x897690) at gsttask.c:271
#14 0x00007ffff724352f in g_thread_pool_thread_proxy (data=<value optimized
out>) at /tmp/buildd/glib2.0-2.24.1/glib/gthreadpool.c:315
#15 0x00007ffff72416e4 in g_thread_create_proxy (data=0x888490) at
/tmp/buildd/glib2.0-2.24.1/glib/gthread.c:1893
#16 0x00007ffff6bb87aa in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#17 0x00007ffff692959d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#18 0x0000000000000000 in ?? ()
Thread 4 (Thread 0x7fffd0df6910 (LWP 8805)):
#0 pthread_cond_wait@@GLIBC_2.3.2 () at
../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
#1 0x00007ffff5062f59 in gst_data_queue_push (queue=0x8d90b0, item=0x8ec460)
at gstdataqueue.c:419
#2 0x00007ffff4a0587b in gst_multi_queue_chain (pad=<value optimized out>,
buffer=<value optimized out>) at gstmultiqueue.c:1169
#3 0x00007ffff7b616ed in gst_pad_chain_data_unchecked (pad=0x884c20,
is_buffer=1, data=0x8ed820) at gstpad.c:4131
#4 0x00007ffff7b61fae in gst_pad_push_data (pad=0x7fffcc008870, is_buffer=1,
data=0x8ed820) at gstpad.c:4360
#5 0x00007fffd0dffbf8 in gst_ogg_demux_chain_peer (pad=0x7fffcc008870,
packet=0x7fffd0df5db0, push_headers=<value optimized out>) at gstoggdemux.c:644
#6 0x00007fffd0e01c8b in gst_ogg_pad_submit_packet (pad=0x7fffcc008870,
npackets=0) at gstoggdemux.c:855
#7 gst_ogg_pad_stream_out (pad=0x7fffcc008870, npackets=0) at
gstoggdemux.c:888
#8 0x00007fffd0e02a8a in gst_ogg_pad_submit_page (pad=0x7fffcc008870,
page=0x7fffd0df5ee0) at gstoggdemux.c:960
#9 0x00007fffd0e05203 in gst_ogg_demux_chain (pad=<value optimized out>,
buffer=<value optimized out>) at gstoggdemux.c:2876
#10 0x00007fffd0e059da in gst_ogg_demux_loop_forward (pad=<value optimized
out>) at gstoggdemux.c:2966
#11 gst_ogg_demux_loop (pad=<value optimized out>) at gstoggdemux.c:3110
#12 0x00007ffff7b89e3b in gst_task_func (task=0x897290) at gsttask.c:271
---Type <return> to continue, or q <return> to quit---
#13 0x00007ffff724352f in g_thread_pool_thread_proxy (data=<value optimized
out>) at /tmp/buildd/glib2.0-2.24.1/glib/gthreadpool.c:315
#14 0x00007ffff72416e4 in g_thread_create_proxy (data=0x8d2800) at
/tmp/buildd/glib2.0-2.24.1/glib/gthread.c:1893
#15 0x00007ffff6bb87aa in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#16 0x00007ffff692959d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#17 0x0000000000000000 in ?? ()
Thread 3 (Thread 0x7fffd2112910 (LWP 8804)):
#0 0x00007ffff688ff05 in *__GI_raise (sig=<value optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff6892d10 in *__GI_abort () at abort.c:88
#2 0x00007ffff68c56a5 in __libc_message (do_abort=2,
fmt=0x7fffd21114c0 "fffd190f000-7fffd1912000 rw-p 0000f000 fd:00 1901874",
' ' <repeats 20 times>,
"/home/tpm/gst/releases/gst-plugins-base/gst/typefind/.libs/libgsttypefindfunctions.so\n7fffd1912000-7fffd1913000
---p 00000000 00"...) at ../sysdeps/unix/sysv/linux/libc_fatal.c:173
#3 0x00007ffff68cee96 in malloc_printerr (action=3, str=0x7ffff6979730 "double
free or corruption (fasttop)", ptr=<value optimized out>) at malloc.c:6239
#4 0x00007ffff68d4853 in _int_realloc (av=0x7ffff6bade60, oldp=0x8fb5e0,
oldsize=144, nb=272) at malloc.c:5297
#5 0x00007ffff68d4cf0 in *__GI___libc_realloc (oldmem=0x8fb5f0, bytes=256) at
malloc.c:3821
#6 0x00007ffff722133f in IA__g_realloc (mem=0x2262, n_bytes=256) at
/tmp/buildd/glib2.0-2.24.1/glib/gmem.c:171
#7 0x00007ffff71f2d1b in g_array_maybe_expand (array=0x889700, len=<value
optimized out>) at /tmp/buildd/glib2.0-2.24.1/glib/garray.c:687
#8 0x00007ffff71f31d7 in IA__g_array_append_vals (farray=0x2262,
data=0x7fffd2111d10, len=1) at /tmp/buildd/glib2.0-2.24.1/glib/garray.c:354
#9 0x00007ffff7b7ff8b in gst_structure_id_set_value (structure=0x88ea70,
field=361, value=0x8ed408) at gststructure.c:443
#10 0x00007ffff7b848c5 in gst_tag_list_add_value_internal (list=0x88ea70,
mode=GST_TAG_MERGE_KEEP, tag=361, value=0x8ed408, info=0x0) at gsttaglist.c:741
#11 0x00007ffff7b8498a in gst_tag_list_copy_foreach (tag=<value optimized out>,
value=0xffffffffffffffff, user_data=0x0) at gsttaglist.c:757
#12 0x00007ffff7b7dca3 in gst_structure_foreach (structure=0x8ee890,
func=0x7ffff7b84970 <gst_tag_list_copy_foreach>, user_data=0x7fffd2111df0) at
gststructure.c:985
#13 0x00007ffff7b87555 in gst_tag_list_insert (into=0x88ea70, from=0x8ee890,
mode=GST_TAG_MERGE_KEEP) at gsttaglist.c:785
#14 0x00007ffff58d5364 in gst_matroska_mux_handle_sink_event (pad=0x8844a0,
event=0x8efc00) at matroska-mux.c:628
#15 0x00007ffff7b5eda6 in gst_pad_send_event (pad=0x8844a0, event=0x8efc00) at
gstpad.c:5052
#16 0x00007ffff7b5f273 in gst_pad_push_event (pad=0x884320, event=0x8efc00) at
gstpad.c:4908
#17 0x00007ffff49f7175 in gst_queue_push_one (pad=<value optimized out>) at
gstqueue.c:1129
#18 gst_queue_loop (pad=<value optimized out>) at gstqueue.c:1185
#19 0x00007ffff7b89e3b in gst_task_func (task=0x897190) at gsttask.c:271
#20 0x00007ffff724352f in g_thread_pool_thread_proxy (data=<value optimized
out>) at /tmp/buildd/glib2.0-2.24.1/glib/gthreadpool.c:315
#21 0x00007ffff72416e4 in g_thread_create_proxy (data=0x88a9c0) at
/tmp/buildd/glib2.0-2.24.1/glib/gthread.c:1893
#22 0x00007ffff6bb87aa in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#23 0x00007ffff692959d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#24 0x0000000000000000 in ?? ()
Thread 2 (Thread 0x7fffd2913910 (LWP 8803)):
#0 __lll_lock_wait_private () at
../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:97
#1 0x00007ffff68d5992 in _L_lock_11277 () from /lib/libc.so.6
#2 0x00007ffff68d4cd4 in *__GI___libc_realloc (oldmem=0x7ffff6bade60,
bytes=512) at malloc.c:3813
#3 0x00007ffff722133f in IA__g_realloc (mem=0x7ffff6bade60, n_bytes=512) at
/tmp/buildd/glib2.0-2.24.1/glib/gmem.c:171
#4 0x00007ffff71f2d1b in g_array_maybe_expand (array=0x889700, len=<value
optimized out>) at /tmp/buildd/glib2.0-2.24.1/glib/garray.c:687
#5 0x00007ffff71f31d7 in IA__g_array_append_vals (farray=0x7ffff6bade60,
data=0x7fffd2912d10, len=1) at /tmp/buildd/glib2.0-2.24.1/glib/garray.c:354
#6 0x00007ffff7b7ff8b in gst_structure_id_set_value (structure=0x88ea70,
field=380, value=0x7fffcc0d72e8) at gststructure.c:443
#7 0x00007ffff7b848c5 in gst_tag_list_add_value_internal (list=0x88ea70,
mode=GST_TAG_MERGE_KEEP, tag=380, value=0x7fffcc0d72e8, info=0x61) at
gsttaglist.c:741
#8 0x00007ffff7b8498a in gst_tag_list_copy_foreach (tag=<value optimized out>,
value=0xffffffffffffffff, user_data=0xfffffffffffffe00) at gsttaglist.c:757
#9 0x00007ffff7b7dca3 in gst_structure_foreach (structure=0x7fffcc0d2180,
func=0x7ffff7b84970 <gst_tag_list_copy_foreach>, user_data=0x7fffd2912df0) at
gststructure.c:985
#10 0x00007ffff7b87555 in gst_tag_list_insert (into=0x88ea70,
from=0x7fffcc0d2180, mode=GST_TAG_MERGE_KEEP) at gsttaglist.c:785
#11 0x00007ffff58d5364 in gst_matroska_mux_handle_sink_event (pad=0x884620,
event=0x7fffcc0ce6c0) at matroska-mux.c:628
#12 0x00007ffff7b5eda6 in gst_pad_send_event (pad=0x884620,
event=0x7fffcc0ce6c0) at gstpad.c:5052
#13 0x00007ffff7b5f273 in gst_pad_push_event (pad=0x868690,
event=0x7fffcc0ce6c0) at gstpad.c:4908
#14 0x00007ffff49f7175 in gst_queue_push_one (pad=<value optimized out>) at
gstqueue.c:1129
#15 gst_queue_loop (pad=<value optimized out>) at gstqueue.c:1185
#16 0x00007ffff7b89e3b in gst_task_func (task=0x897090) at gsttask.c:271
#17 0x00007ffff724352f in g_thread_pool_thread_proxy (data=<value optimized
out>) at /tmp/buildd/glib2.0-2.24.1/glib/gthreadpool.c:315
#18 0x00007ffff72416e4 in g_thread_create_proxy (data=0x881fc0) at
/tmp/buildd/glib2.0-2.24.1/glib/gthread.c:1893
#19 0x00007ffff6bb87aa in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#20 0x00007ffff692959d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
---Type <return> to continue, or q <return> to quit---
#21 0x0000000000000000 in ?? ()
Thread 1 (Thread 0x7ffff7fd66f0 (LWP 8802)):
#0 __lll_lock_wait_private () at
../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:97
#1 0x00007ffff68d5748 in _L_lock_9464 () from /lib/libc.so.6
#2 0x00007ffff68d3b31 in *__GI___libc_free (mem=0x7ffff6bade60) at
malloc.c:3736
#3 0x00007ffff72182b5 in g_source_destroy_internal (source=0x8ec6b0,
context=0x88e5c0, have_lock=0) at /tmp/buildd/glib2.0-2.24.1/glib/gmain.c:856
#4 0x00007ffff721abee in IA__g_source_remove (tag=<value optimized out>) at
/tmp/buildd/glib2.0-2.24.1/glib/gmain.c:1527
#5 0x00007ffff7b3ca9a in gst_bus_poll (bus=0x62f480, events=GST_MESSAGE_ANY,
timeout=<value optimized out>) at gstbus.c:1060
#6 0x0000000000402ddf in event_loop (pipeline=0x8a9260, blocking=1,
target_state=<value optimized out>) at gst-launch.c:405
#7 0x00000000004042e3 in main (argc=35, argv=0x7fffffffcb98) at
gst-launch.c:827
(gdb)
--
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.
More information about the Gstreamer-bugs
mailing list