[gst-devel] opt scheduler refs freed group

[Colin Walters]

Hi,

Rhythmbox uses something like the following command to do tag reading:

walters at nexus> valgrind --num-callers=20 --gdb-attach=yes --alignment=8 /build/gstreamer-0.7/bin/gst-launch-0.7 -t gnomevfssrc location=/media/music/Evanescence/Fallen/Tourniquet.ogg ! typefind ! spider ! application/x-gst-tags ! fakesink

This crashes after unreffing the pipeline:

==2746== valgrind's libpthread.so: KLUDGED call to: pthread_cond_destroy
==2746== valgrind's libpthread.so: KLUDGED call to: pthread_cond_destroy
==2746==
==2746== Invalid read of size 4
==2746==    at 0xDC7378: group_can_reach_group (gstoptimalscheduler.c:1867)
==2746==    by 0xDC751E: group_can_reach_group (gstoptimalscheduler.c:1900)
==2746==    by 0xDC77D9: gst_opt_scheduler_pad_unlink (gstoptimalscheduler.c:1961)
==2746==    by 0xBAA9EB: gst_scheduler_pad_unlink (gstscheduler.c:186)
==2746==    by 0xB7EE14: gst_bin_unset_element_sched (gstbin.c:388)
==2746==    by 0x191B9E: g_list_foreach (in /usr/lib/libglib-2.0.so.0.200.3)
==2746==    by 0xB7EB17: gst_bin_unset_element_sched (gstbin.c:362)
==2746==    by 0xB7F47B: gst_bin_remove_func (gstbin.c:516)
==2746==    by 0xB7F7D7: gst_bin_remove (gstbin.c:570)
==2746==    by 0xB803DE: gst_bin_dispose (gstbin.c:794)
==2746==    by 0xBA3E85: gst_pipeline_dispose (gstpipeline.c:132)
==2746==    by 0x6C7C4E: (within /usr/lib/libgobject-2.0.so.0.200.3)
==2746==    by 0xB7BF45: gst_object_unref (gstobject.c:241)
==2746==    by 0x804A739: main (gst-launch.c:467)
==2746==    by 0x982BAE: __libc_start_main (in /lib/libc-2.3.2.so)
==2746==    by 0x8049658: (within /build/gstreamer-0.7/bin/gst-launch-0.7)
==2746==    Address 0x5D2EE98 is 32 bytes inside a block of size 48 free'd
==2746==    at 0x2A65AC: free (vg_replace_malloc.c:231)
==2746==    by 0x199A63: g_free (in /usr/lib/libglib-2.0.so.0.200.3)
==2746==    by 0xDC4710: destroy_group (gstoptimalscheduler.c:708)
==2746==    by 0xDC42A4: unref_group (gstoptimalscheduler.c:621)
==2746==    by 0xDC48C9: remove_from_group (gstoptimalscheduler.c:735)
==2746==    by 0xDC7B18: gst_opt_scheduler_pad_unlink (gstoptimalscheduler.c:2028)
==2746==    by 0xBAA9EB: gst_scheduler_pad_unlink (gstscheduler.c:186)
==2746==    by 0xB7EE14: gst_bin_unset_element_sched (gstbin.c:388)
==2746==    by 0xB7F47B: gst_bin_remove_func (gstbin.c:516)
==2746==    by 0xB7F7D7: gst_bin_remove (gstbin.c:570)
==2746==    by 0xB803DE: gst_bin_dispose (gstbin.c:794)
==2746==    by 0xBA3E85: gst_pipeline_dispose (gstpipeline.c:132)
==2746==    by 0x6C7C4E: (within /usr/lib/libgobject-2.0.so.0.200.3)
==2746==    by 0xB7BF45: gst_object_unref (gstobject.c:241)
==2746==    by 0x804A739: main (gst-launch.c:467)
==2746==    by 0x982BAE: __libc_start_main (in /lib/libc-2.3.2.so)
==2746==    by 0x8049658: (within /build/gstreamer-0.7/bin/gst-launch-0.7)


After staring at this a bit, I came to the conclusion that it was due to
one of the existing groups still pointing at a destroyed group.  If I
remove the g_free call in destroy_group, it doesn't crash...

The above code works OK with the pre-caps merge.  Does anyone know why
that would break it?


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://lists.freedesktop.org/archives/gstreamer-devel/attachments/20031223/65835926/attachment.pgp>