[Bug 725298] dashdemux: fails after MPD refresh

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=725298
  GStreamer | gst-plugins-bad | git

--- Comment #4 from Chris Bass <floobleflam at gmail.com> 2014-02-28 16:22:15 UTC ---
(In reply to comment #1)
> Review of attachment 270451 [details]:
> 
> This is because gst_dash_demux_refresh_mpd is called with the MPD_CLIENT_LOCK
> already. So this patch will cause a deadlock.

Yes, you're quite right.

After some further digging, I think I've got a better idea of the problem now.

As I read it, demux->streams is a list of GstDashDemuxStreams, each of which
has an active_stream ptr, which points to one of the GstActiveStream structs in
demux->client->active_streams.

When demux->client is freed (by gst_dash_demux_refresh_mpd, line 1323 of
gstdashdemux.c), all the GstActiveStreams in demux->client->active_streams are
also freed (since gst_mpd_client_free calls gst_active_streams_free); however,
the active_stream ptrs in demux->streams are left pointing to GstActiveStreams
in the active_streams list of the client that has just been freed.

Thus, when anything then comes to access data via the active_stream ptr of any
of demux's GstDashDemuxStreams, they're accessing freed data - hence the
segfault. The place where I'm typically getting segfaults is in
gst_mpdparser_get_rep_idx_with_max_bandwidth, and it's because it's trying to
access representation data from within the freed active stream; here's a
backtrace:

#0  0xb7d3de42 in g_list_first () from /usr/lib/libglib-2.0.so.0
#1  0xb6823ef1 in gst_mpdparser_get_rep_idx_with_max_bandwidth
(Representations=Representations at entry=0xb67a1040, max_bandwidth=2881858) at
gstmpdparser.c:2080
#2  0xb682bd07 in gst_dash_demux_stream_select_representation_unlocked
(stream=0xb67a42b0) at gstdashdemux.c:1633
#3  gst_dash_demux_stream_download_loop (stream=0xb67a42b0) at
gstdashdemux.c:1432
#4  0xb7f6b460 in gst_task_func (task=task at entry=0xb6715010) at gsttask.c:319
#5  0xb7f6c6a8 in default_func (tdata=0xb6707920, pool=0x8060c10) at
gsttaskpool.c:70
#6  0xb7d67ce8 in g_thread_pool_thread_proxy () from /usr/lib/libglib-2.0.so.0
#7  0xb7d672d3 in g_thread_proxy () from /usr/lib/libglib-2.0.so.0
#8  0xb7cd5db5 in start_thread () from /lib/libpthread.so.0
#9  0xb7c15d6e in clone () from /lib/libc.so.6

[...]

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.