[Bug 726835] New: totem segfault in in gst_mini_object_replace()

Fri Mar 21 09:56:27 PDT 2014

https://bugzilla.gnome.org/show_bug.cgi?id=726835
  GStreamer | don't know | 1.2.3

           Summary: totem segfault in in gst_mini_object_replace()
    Classification: Platform
           Product: GStreamer
           Version: 1.2.3
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: don't know
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: seb128 at ubuntu.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---


The issue has been reported on
https://bugs.launchpad.net/ubuntu/+source/gstreamer1.0/+bug/1288758

It seems the reports started with the 1.2.2 -> 1.2.3 updates

The description states

"I recently experienced an issue with both Totem and VLC crashing (both either
when queuing up multiple videos in their respective interfaces or disabling
subtitles),"


Stracktace:
"#0  0x00007f5059b5c1c6 in gst_mini_object_replace (olddata=olddata at entry=0x40,
newdata=0x0) at gstminiobject.c:497
        olddata_val = <optimized out>
        __func__ = "gst_mini_object_replace"
        __PRETTY_FUNCTION__ = "gst_mini_object_replace"
#1  0x00007f5041911ba0 in gst_buffer_replace (nbuf=<optimized out>, obuf=0x40)
at /usr/include/gstreamer-1.0/gst/gstbuffer.h:475
No locals.
#2  gst_ffmpegviddec_video_frame (ffmpegdec=ffmpegdec at entry=0x7f5030067710,
data=<optimized out>, data at entry=0x7f50301b2730 "", size=<optimized out>,
frame=frame at entry=0x7f5038094030, ret=ret at entry=0x7f504319631c) at
gstavviddec.c:1229
        len = 11080
        have_data = 1
        mode_switch = 0
        skip_frame = 0
        out_frame = 0x0
        out_dframe = 0x7f503012a570
        packet = {pts = 0, dts = 0, data = 0x7f50301b2730 "", size = 11080,
stream_index = 0, flags = 0, side_data = 0x0, side_data_elems = 0, duration =
0, destruct = 0x0, priv = 0x0, pos = 0, convergence_duration = 0}
        __FUNCTION__ = "gst_ffmpegviddec_video_frame"
#3  0x00007f5041912818 in gst_ffmpegviddec_frame
(ffmpegdec=ffmpegdec at entry=0x7f5030067710, data=data at entry=0x7f50301b2730 "",
size=size at entry=11080, got_data=got_data at entry=0x7f5043196318,
frame=frame at entry=0x7f5038094030, ret=ret at entry=0x7f504319631c) at
gstavviddec.c:1371
        oclass = 0x7f50300658d0
        have_data = 0
        len = 0
        __FUNCTION__ = "gst_ffmpegviddec_frame"
#4  0x00007f5041912eac in gst_ffmpegviddec_handle_frame
(decoder=0x7f5030067710, frame=0x7f5038094030) at gstavviddec.c:1491
        tmp_padding = <optimized out>
        ffmpegdec = 0x7f5030067710
        data = 0x7f50301b2730 ""
        bdata = 0x7f50301b2730 ""
        size = 11080
        len = <optimized out>
        have_data = 1
        bsize = 11080
        minfo = {memory = 0x7f5038073120, flags = GST_MAP_READ, data =
0x7f503800aca4 "", size = 11080, maxsize = 28147, user_data = {0x7f505960a20d
<g_slice_alloc+29>, 0x7f50300008c0, 0x7f503039b000, 0x7f5030067590},
_gst_reserved = {0x108, 0x7f5030067710, 0x7f5038094030, 0x7f505d2c24c0}}
        ret = GST_FLOW_OK
        do_padding = <optimized out>
        __FUNCTION__ = "gst_ffmpegviddec_handle_frame"
#5  0x00007f5049621a09 in gst_video_decoder_decode_frame
(decoder=decoder at entry=0x7f5030067710, frame=0x7f5038094030) at
gstvideodecoder.c:2832
        priv = 0x7f5030067590
        decoder_class = 0x7f50300658d0
        ret = GST_FLOW_OK
        __func__ = "gst_video_decoder_decode_frame"
        __PRETTY_FUNCTION__ = "gst_video_decoder_decode_frame"
#6  0x00007f5049621d6d in gst_video_decoder_chain_forward
(decoder=decoder at entry=0x7f5030067710, buf=buf at entry=0x7f505d1ec620,
at_eos=at_eos at entry=0) at gstvideodecoder.c:1757
        priv = 0x7f5030067590
        klass = <optimized out>
        ret = GST_FLOW_OK
        __func__ = "gst_video_decoder_chain_forward"
#7  0x00007f5049623f6d in gst_video_decoder_chain (pad=<optimized out>,
parent=0x7f5030067710, buf=0x7f505d1ec620) at gstvideodecoder.c:2037
        decoder = 0x7f5030067710
        ret = GST_FLOW_OK
        __PRETTY_FUNCTION__ = "gst_video_decoder_chain"
#8  0x00007f5059b5fce8 in gst_pad_chain_data_unchecked (data=0x7f505d1ec620,
type=<optimized out>, pad=0x7f5030068080) at gstpad.c:3760
        chainfunc = 0x7f5049623ca0 <gst_video_decoder_chain>
        ret = <optimized out>
        parent = 0x7f5030067710
#9  gst_pad_push_data (pad=0x7f50380168e0, type=type at entry=4112,
data=<optimized out>) at gstpad.c:3990
        peer = 0x7f5030068080
        ret = <optimized out>
        __PRETTY_FUNCTION__ = "gst_pad_push_data"
#10 0x00007f5059b66996 in gst_pad_push (pad=<optimized out>, buffer=<optimized
out>) at gstpad.c:4093
        __func__ = "gst_pad_push"
#11 0x00007f5053ebb299 in gst_base_transform_chain (pad=<optimized out>,
parent=0x7f5038026130, buffer=<optimized out>) at gstbasetransform.c:2237
        position_out = <optimized out>
        trans = 0x7f5038026130
        klass = <optimized out>
        priv = 0x7f5038026060
        ret = <optimized out>
        position = <optimized out>
        timestamp = <optimized out>
        duration = <optimized out>
        outbuf = 0x7f505d1ec620
        __PRETTY_FUNCTION__ = "gst_base_transform_chain"
#12 0x00007f5059b5fce8 in gst_pad_chain_data_unchecked (data=0x7f505d1ec620,
type=<optimized out>, pad=0x7f50380166b0) at gstpad.c:3760
        chainfunc = 0x7f5053ebb030 <gst_base_transform_chain>
        ret = <optimized out>
        parent = 0x7f5038026130
#13 gst_pad_push_data (pad=0x7f5038016480, type=type at entry=4112,
data=<optimized out>, data at entry=0x7f505d1ec620) at gstpad.c:3990
        peer = 0x7f50380166b0
        ret = <optimized out>
        __PRETTY_FUNCTION__ = "gst_pad_push_data"
#14 0x00007f5059b66996 in gst_pad_push (pad=<optimized out>,
buffer=buffer at entry=0x7f505d1ec620) at gstpad.c:4093
        __func__ = "gst_pad_push"
#15 0x00007f5053e9db09 in gst_base_parse_push_frame
(parse=parse at entry=0x7f503801feb0, frame=frame at entry=0x7f5043196970) at
gstbaseparse.c:2299
        ret = <optimized out>
        last_start = <optimized out>
        last_stop = 418834708333
        klass = <optimized out>
        buffer = 0x7f505d1ec620
        size = <optimized out>
        __func__ = "gst_base_parse_push_frame"
        __PRETTY_FUNCTION__ = "gst_base_parse_push_frame"
#16 0x00007f5053e9e510 in gst_base_parse_chain (pad=<optimized out>,
parent=0x7f503801feb0, buffer=0x7f505d1ec620) at gstbaseparse.c:2805
        frame = {buffer = 0x0, out_buffer = 0x0, flags = 0, offset = 0,
overhead = 0, size = 0, _gst_reserved_i = {0, 0}, _gst_reserved_p = {0x0, 0x0},
_private_flags = 1}
        bclass = <optimized out>
        parse = 0x7f503801feb0
        ret = <optimized out>
        tmpbuf = 0x0
        skip = -1
        data = <optimized out>
        min_size = <optimized out>
        av = <optimized out>
        pts = <optimized out>
        dts = <optimized out>
        __PRETTY_FUNCTION__ = "gst_base_parse_chain"
#17 0x00007f5059b5fce8 in gst_pad_chain_data_unchecked (data=0x7f505d1ec620,
type=<optimized out>, pad=0x7f5038016250) at gstpad.c:3760
        chainfunc = 0x7f5053e9e240 <gst_base_parse_chain>
        ret = <optimized out>
        parent = 0x7f503801feb0
#18 gst_pad_push_data (pad=0x7f5038016020, type=type at entry=4112,
data=<optimized out>, data at entry=0x7f505d1ec620) at gstpad.c:3990
        peer = 0x7f5038016250
        ret = <optimized out>
        __PRETTY_FUNCTION__ = "gst_pad_push_data"
#19 0x00007f5059b66996 in gst_pad_push (pad=<optimized out>,
buffer=buffer at entry=0x7f505d1ec620) at gstpad.c:4093
        __func__ = "gst_pad_push"
#20 0x00007f504915ca23 in gst_single_queue_push_one (object=0x7f505d1ec620,
sq=0x7f50380199b0, mq=0x7f503801a070) at gstmultiqueue.c:1089
        buffer = 0x7f505d1ec620
        timestamp = 418793000000
        duration = <optimized out>
        result = GST_FLOW_OK
#21 gst_multi_queue_loop (pad=<optimized out>) at gstmultiqueue.c:1338
        sq = 0x7f50380199b0
        item = <optimized out>
        sitem = 0x7f505d2a4240
        mq = 0x7f503801a070
        object = <optimized out>
        newid = 86
        result = -2113795008
        next_time = <optimized out>
        is_buffer = 1
        do_update_buffering = 0
        __PRETTY_FUNCTION__ = "gst_multi_queue_loop"
#22 0x00007f5059b8d4e9 in gst_task_func (task=0x7f505d35cb90) at gsttask.c:316
        lock = 0x7f5038016090
        tself = 0x7f5038013c50
        priv = 0x7f505d35cb40
        __PRETTY_FUNCTION__ = "gst_task_func"
#23 0x00007f505961489c in g_thread_pool_thread_proxy (data=<optimized out>) at
/build/buildd/glib2.0-2.39.91/./glib/gthreadpool.c:307
        task = 0x7f5038015260
        pool = 0x7f505cfea080
#24 0x00007f5059613f15 in g_thread_proxy (data=0x7f5038013c50) at
/build/buildd/glib2.0-2.39.91/./glib/gthread.c:764
        thread = 0x7f5038013c50
#25 0x00007f505908a182 in start_thread (arg=0x7f5043197700) at
pthread_create.c:312
        __res = <optimized out>
        pd = 0x7f5043197700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139982699853568,
8358587158387526105, 0, 0, 139982699854272, 139982699853568,
-8259834199845598759, -8259856058700363303}, mask_was_saved = 0}}, priv = {pad
= {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
        __PRETTY_FUNCTION__ = "start_thread""


Similar report on f20
https://bugzilla.redhat.com/show_bug.cgi?id=1076842

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.