[Bug 797039] Race condition: double free or corruption (fasttop) with vaapih264dec ! vaapipostproc

Wed Aug 29 07:31:36 UTC 2018

https://bugzilla.gnome.org/show_bug.cgi?id=797039

--- Comment #4 from Florent Thiéry <florent.thiery at ubicast.eu> ---
Sorry, just managed to reproduce it without my script

(gdb) run filesrc location=/tmp/sample.h264 ! tee name=tee ! queue ! fakesink
tee. ! queue ! h264parse ! vaapih264dec ! vaapipostproc ! "video/x-raw,
format=(string)NV12, width=(int)1280, height=(int)720, framerate=(fraction)30"
! fakesink tee. ! queue ! h264parse ! vaapih264dec ! vaapipostproc !
"video/x-raw, format=(string)NV12, width=(int)1280, height=(int)720,
framerate=(fraction)30" ! fakesink tee. ! queue ! h264parse ! vaapih264dec !
vaapipostproc ! "video/x-raw, format=(string)NV12, width=(int)1280,
height=(int)720, framerate=(fraction)30" ! fakesink tee. ! queue ! h264parse !
vaapih264dec ! vaapipostproc ! "video/x-raw, format=(string)NV12,
width=(int)1280, height=(int)720, framerate=(fraction)30" ! fakesink
Starting program:
/home/fthiery/gst-build/build/subprojects/gstreamer/tools/gst-launch-1.0
filesrc location=/tmp/sample.h264 ! tee name=tee ! queue ! fakesink tee. !
queue ! h264parse ! vaapih264dec ! vaapipostproc ! "video/x-raw,
format=(string)NV12, width=(int)1280, height=(int)720, framerate=(fraction)30"
! fakesink tee. ! queue ! h264parse ! vaapih264dec ! vaapipostproc !
"video/x-raw, format=(string)NV12, width=(int)1280, height=(int)720,
framerate=(fraction)30" ! fakesink tee. ! queue ! h264parse ! vaapih264dec !
vaapipostproc ! "video/x-raw, format=(string)NV12, width=(int)1280,
height=(int)720, framerate=(fraction)30" ! fakesink tee. ! queue ! h264parse !
vaapih264dec ! vaapipostproc ! "video/x-raw, format=(string)NV12,
width=(int)1280, height=(int)720, framerate=(fraction)30" ! fakesink
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Setting pipeline to PAUSED ...
[New Thread 0x7ffff1e3f700 (LWP 8518)]
[New Thread 0x7ffff163e700 (LWP 8519)]
[New Thread 0x7ffff163e700 (LWP 8520)]
[Thread 0x7ffff163e700 (LWP 8519) exited]
[New Thread 0x7ffff0e3d700 (LWP 8521)]
[New Thread 0x7fffe268c700 (LWP 8522)]
[New Thread 0x7fffe1b8b700 (LWP 8523)]
[New Thread 0x7fffe138a700 (LWP 8524)]
[New Thread 0x7fffe0b89700 (LWP 8525)]
[New Thread 0x7fffd3fff700 (LWP 8526)]
[New Thread 0x7fffd37fe700 (LWP 8527)]
Pipeline is PREROLLING ...
[New Thread 0x7fffd2ffd700 (LWP 8528)]
double free or corruption (fasttop)
Got context from element 'vaapipostproc3': gst.gl.GLDisplay=context,
gst.gl.GLDisplay=(GstGLDisplay)"\(GstGLDisplayX11\)\ gldisplayx11-0";
Got context from element 'vaapipostproc3': gst.vaapi.Display=context,
gst.vaapi.Display=(GstVaapiDisplay)"\(GstVaapiDisplayGLX\)\ vaapidisplayglx0";

Thread 10 "queue2:src" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffd3fff700 (LWP 8526)]
0x00007ffff7738d7f in raise () from /usr/lib/libc.so.6

(gdb) bt
#0  0x00007ffff7738d7f in raise () at /usr/lib/libc.so.6
#1  0x00007ffff7723672 in abort () at /usr/lib/libc.so.6
#2  0x00007ffff777b878 in __libc_message () at /usr/lib/libc.so.6
#3  0x00007ffff778218a in  () at /usr/lib/libc.so.6
#4  0x00007ffff7783b27 in _int_free () at /usr/lib/libc.so.6
#5  0x00007ffff77861d5 in _int_realloc () at /usr/lib/libc.so.6
#6  0x00007ffff77874cb in realloc () at /usr/lib/libc.so.6
#7  0x00007ffff7b8bb89 in g_realloc () at /usr/lib/libglib-2.0.so.0
#8  0x00007ffff7b570f7 in  () at /usr/lib/libglib-2.0.so.0
#9  0x00007ffff7b5748a in g_array_append_vals () at /usr/lib/libglib-2.0.so.0
#10 0x00007ffff58f80ab in append_format (flags=<optimized out>,
format=GST_VIDEO_FORMAT_NV12, formats=0x7fffd8009410)
    at ../subprojects/gstreamer-vaapi/gst-libs/gst/vaapi/gstvaapidisplay.c:180
#11 0x00007ffff58f80ab in append_formats (formats=0x7fffd8009410,
va_formats=va_formats at entry=0x7fffc8009800, flags=flags at entry=0x0, n=<optimized
out>)
    at ../subprojects/gstreamer-vaapi/gst-libs/gst/vaapi/gstvaapidisplay.c:203
#12 0x00007ffff58f83fb in ensure_image_formats
(display=display at entry=0x5555557e2410) at
../subprojects/gstreamer-vaapi/gst-libs/gst/vaapi/gstvaapidisplay.c:673
#13 0x00007ffff58f923e in gst_vaapi_display_get_image_formats
(display=display at entry=0x5555557e2410) at
../subprojects/gstreamer-vaapi/gst-libs/gst/vaapi/gstvaapidisplay.c:1582
#14 0x00007ffff58d011a in ensure_allowed_raw_caps (plugin=0x5555557d8170) at
../subprojects/gstreamer-vaapi/gst/vaapi/gstvaapipluginbase.c:1273
#15 0x00007ffff58d011a in gst_vaapi_plugin_base_get_allowed_raw_caps
(plugin=plugin at entry=0x5555557d8170) at
../subprojects/gstreamer-vaapi/gst/vaapi/gstvaapipluginbase.c:1332
#16 0x00007ffff58d553a in ensure_allowed_sinkpad_caps (postproc=0x5555557d8170)
at ../subprojects/gstreamer-vaapi/gst/vaapi/gstvaapipostproc.c:1095
#17 0x00007ffff58d553a in gst_vaapipostproc_transform_caps_impl
(direction=<optimized out>, trans=0x5555557d8170) at
../subprojects/gstreamer-vaapi/gst/vaapi/gstvaapipostproc.c:1189
#18 0x00007ffff58d553a in gst_vaapipostproc_transform_caps
(trans=0x5555557d8170, direction=<optimized out>, caps=0x7fffc80048f0,
filter=0x7fffc8006000)
    at ../subprojects/gstreamer-vaapi/gst/vaapi/gstvaapipostproc.c:1212
#19 0x00007ffff5e83781 in gst_base_transform_transform_caps
(trans=trans at entry=0x5555557d8170, direction=GST_PAD_SRC,
caps=caps at entry=0x7fffc80048f0, filter=filter at entry=0x7fffc8006000)
    at ../subprojects/gstreamer/libs/gst/base/gstbasetransform.c:474
#20 0x00007ffff5e87414 in gst_base_transform_query_caps (filter=0x7fffc8006000,
pad=0x5555557c5200, trans=0x5555557d8170) at
../subprojects/gstreamer/libs/gst/base/gstbasetransform.c:695
#21 0x00007ffff5e87414 in gst_base_transform_default_query
(trans=0x5555557d8170, direction=<optimized out>, query=0x7fffc80060a0)
    at ../subprojects/gstreamer/libs/gst/base/gstbasetransform.c:1550
#22 0x00007ffff7f12920 in gst_pad_query (pad=pad at entry=0x5555557c5200,
query=query at entry=0x7fffc80060a0) at ../subprojects/gstreamer/gst/gstpad.c:4067
#23 0x00007ffff7f1309b in gst_pad_peer_query (pad=pad at entry=0x5555557c4fb0,
query=query at entry=0x7fffc80060a0) at ../subprojects/gstreamer/gst/gstpad.c:4199
#24 0x00007ffff7f4ffbc in gst_pad_peer_query_caps
(pad=pad at entry=0x5555557c4fb0, filter=filter at entry=0x7fffc8006000) at
../subprojects/gstreamer/gst/gstutils.c:3089
#25 0x00007ffff5d294b9 in __gst_video_element_proxy_getcaps
(element=element at entry=0x5555557d5a20, sinkpad=<optimized out>,
srcpad=0x5555557c4fb0, initial_caps=<optimized out>,
filter=filter at entry=0x555555798800) at
../subprojects/gst-plugins-base/gst-libs/gst/video/gstvideoutilsprivate.c:108
#26 0x00007ffff5d18cb9 in gst_video_decoder_proxy_getcaps
(decoder=decoder at entry=0x5555557d5a20, caps=<optimized out>,
filter=filter at entry=0x555555798800)
    at
../subprojects/gst-plugins-base/gst-libs/gst/video/gstvideodecoder.c:1761
#27 0x00007ffff58cb8a6 in gst_vaapidecode_sink_getcaps (vdec=<optimized out>,
filter=<optimized out>) at
../subprojects/gstreamer-vaapi/gst/vaapi/gstvaapidecode.c:1351
#28 0x00007ffff5d18d8b in gst_video_decoder_sink_getcaps (filter=<optimized
out>, decoder=0x5555557d5a20) at
../subprojects/gst-plugins-base/gst-libs/gst/video/gstvideodecoder.c:1775
#29 0x00007ffff5d18d8b in gst_video_decoder_sink_query_default
(decoder=0x5555557d5a20, query=0x7fffc0004b20) at
../subprojects/gst-plugins-base/gst-libs/gst/video/gstvideodecoder.c:1824
#30 0x00007ffff7f12920 in gst_pad_query (pad=pad at entry=0x5555557c4d60,
query=query at entry=0x7fffc0004b20) at ../subprojects/gstreamer/gst/gstpad.c:4067
#31 0x00007ffff7f1309b in gst_pad_peer_query (pad=pad at entry=0x5555557c4b10,
query=query at entry=0x7fffc0004b20) at ../subprojects/gstreamer/gst/gstpad.c:4199
#32 0x00007ffff7f1349f in gst_pad_get_allowed_caps (pad=0x5555557c4b10) at
../subprojects/gstreamer/gst/gstpad.c:2819
#33 0x00007ffff5e12f29 in gst_h264_parse_negotiate
(h264parse=h264parse at entry=0x5555557c31d0, in_format=in_format at entry=2,
in_caps=in_caps at entry=0x0)
    at ../subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c:371
#34 0x00007ffff5e189e3 in gst_h264_parse_handle_frame (parse=0x5555557c31d0,
frame=0x7fffc0004a80, skipsize=0x7fffd3ffec58)
    at ../subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c:1094
#35 0x00007ffff5e61402 in gst_base_parse_handle_buffer
(parse=parse at entry=0x5555557c31d0, buffer=<optimized out>,
skip=skip at entry=0x7fffd3ffec58, flushed=flushed at entry=0x7fffd3ffec5c)
    at ../subprojects/gstreamer/libs/gst/base/gstbaseparse.c:2202
#36 0x00007ffff5e6750c in gst_base_parse_chain (pad=<optimized out>,
parent=<optimized out>, buffer=<optimized out>) at
../subprojects/gstreamer/libs/gst/base/gstbaseparse.c:3287
#37 0x00007ffff7f0d192 in gst_pad_chain_data_unchecked (data=0x5555557ba730,
type=4112, pad=0x5555557c48c0) at ../subprojects/gstreamer/gst/gstpad.c:4322
#38 0x00007ffff7f0d192 in gst_pad_push_data (pad=pad at entry=0x5555557c4670,
type=type at entry=4112, data=data at entry=0x5555557ba730) at
../subprojects/gstreamer/gst/gstpad.c:4578
#39 0x00007ffff7f13bb2 in gst_pad_push (pad=0x5555557c4670,
buffer=buffer at entry=0x5555557ba730) at
../subprojects/gstreamer/gst/gstpad.c:4697
#40 0x00007ffff5ef8f47 in gst_queue_push_one (queue=0x55555579c630) at
../subprojects/gstreamer/plugins/elements/gstqueue.c:1384
---Type <return> to continue, or q <return> to quit---
#41 0x00007ffff5ef8f47 in gst_queue_loop (pad=<optimized out>) at
../subprojects/gstreamer/plugins/elements/gstqueue.c:1537
#42 0x00007ffff7f41771 in gst_task_func (task=0x5555557e2710) at
../subprojects/gstreamer/gst/gsttask.c:328
#43 0x00007ffff7baf463 in  () at /usr/lib/libglib-2.0.so.0
#44 0x00007ffff7baea2a in  () at /usr/lib/libglib-2.0.so.0
#45 0x00007ffff78cca9d in start_thread () at /usr/lib/libpthread.so.0
#46 0x00007ffff77fca43 in clone () at /usr/lib/libc.so.6

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.