[Bug 761505] videoconvert / xvimagesink segment fault

[GStreamer (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=761505

--- Comment #12 from James Stevenson <james at stev.org> ---

Yes I can confirm it still happens. This seems specific to ubuntu 15.10 on a
skylake intel i7. This does not happen on an identical system also running
ubuntu 15.10 with an nvidia card. So it may be some graphics driver issue in
xwindows.


In fact I have traced it down to a specific part of the code. It looks like the
XvCreateImage is returning a really short buffer

See below (note that data_size = 4) in the returned value from XvCreateImage

Breakpoint 1, gst_xvimage_allocator_alloc (allocator=0x670b80,
im_format=406996818, padded_width=320, padded_height=240, 
    crop=crop at entry=0x7fffe40103ac, error=error at entry=0x7ffff3584840) at
xvimageallocator.c:487
487        mem->xvimage = XvCreateImage (context->disp,
(gdb) list
482            mem->SHMInfo.shmid, mem->SHMInfo.shmseg);
483      } else
484      no_xshm:
485    #endif /* HAVE_XSHM */
486      {
487        mem->xvimage = XvCreateImage (context->disp,
488            context->xv_port_id, im_format, NULL, padded_width,
padded_height);
489        if (!mem->xvimage || error_caught)
490          goto create_failed;
491    
(gdb) p mem->xvimage
$1 = (XvImage *) 0x0
(gdb) n
370      handler = XSetErrorHandler (gst_xvimage_handle_xerror);
(gdb) p mem->xvimage
$2 = (XvImage *) 0x0
(gdb) n
487        mem->xvimage = XvCreateImage (context->disp,
(gdb) 
489        if (!mem->xvimage || error_caught)
(gdb) p mem->xvimage
$3 = (XvImage *) 0x0
(gdb) n
487        mem->xvimage = XvCreateImage (context->disp,
(gdb) 
489        if (!mem->xvimage || error_caught)
(gdb) p mem->xvimage
$4 = (XvImage *) 0x7fffe400a500
(gdb) p *mem->xvimage
$5 = {id = 406996818, width = 320, height = 240, data_size = 4, num_planes = 1,
pitches = 0x7fffe400a538, 
  offsets = 0x7fffe400a53c, data = 0x0, obdata = 0x0}
(gdb) p padded_width
$6 = 320
(gdb) p padded_height
$7 = 240

The next code that is executed is then to allocate the buffer based on
data_size. But for something like GRAY8 I would expect this to be at least (320
* 240)

   /* we have to use the returned data_size for our image size */
    align = 15;                 /* g_malloc aligns to 8, we need 16 */
    mem->xvimage->data = g_malloc (mem->xvimage->data_size + align);

    XSync (context->disp, FALSE);


The other part I have considers that may be incorrect is the im_format
parameter in the call to XvCreateImage. I am not sure what a sensible value
looks like for an im_format I am not familiar with x windows programming at
all.

p *mem
$10 = {parent = {mini_object = {type = 7630384, refcount = 0, lockstate = 0,
flags = 0, copy = 0x0, dispose = 0x0, 
      free = 0x0, n_qdata = 0, qdata = 0x0}, allocator = 0x0, parent = 0x0,
maxsize = 0, align = 0, offset = 0, 
    size = 0}, im_format = 406996818, crop = {x = 0, y = 0, w = 320, h = 240},
xvimage = 0x7fffe400a500}

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.