[gst-devel] opt scheduler refs freed group

[Benjamin Otte]

That bug is known (to me at least).
And it's the reason I use --gst-scheduler=basic{omega,gthread} everywhere.
Somebody broke opt ages ago but noone fixes it.
I won't either, that code is evil.

Benjamin.


On Wed, 24 Dec 2003, Colin Walters wrote:

> Hi,
>
> Rhythmbox uses something like the following command to do tag reading:
>
> walters at nexus> valgrind --num-callers=20 --gdb-attach=yes --alignment=8 /build/gstreamer-0.7/bin/gst-launch-0.7 -t gnomevfssrc location=/media/music/Evanescence/Fallen/Tourniquet.ogg ! typefind ! spider ! application/x-gst-tags ! fakesink
>
> This crashes after unreffing the pipeline:
>
> ==2746== valgrind's libpthread.so: KLUDGED call to: pthread_cond_destroy
> ==2746== valgrind's libpthread.so: KLUDGED call to: pthread_cond_destroy
> ==2746==
> ==2746== Invalid read of size 4
> ==2746==    at 0xDC7378: group_can_reach_group (gstoptimalscheduler.c:1867)
> ==2746==    by 0xDC751E: group_can_reach_group (gstoptimalscheduler.c:1900)
> ==2746==    by 0xDC77D9: gst_opt_scheduler_pad_unlink (gstoptimalscheduler.c:1961)
> ==2746==    by 0xBAA9EB: gst_scheduler_pad_unlink (gstscheduler.c:186)
> ==2746==    by 0xB7EE14: gst_bin_unset_element_sched (gstbin.c:388)
> ==2746==    by 0x191B9E: g_list_foreach (in /usr/lib/libglib-2.0.so.0.200.3)
> ==2746==    by 0xB7EB17: gst_bin_unset_element_sched (gstbin.c:362)
> ==2746==    by 0xB7F47B: gst_bin_remove_func (gstbin.c:516)
> ==2746==    by 0xB7F7D7: gst_bin_remove (gstbin.c:570)
> ==2746==    by 0xB803DE: gst_bin_dispose (gstbin.c:794)
> ==2746==    by 0xBA3E85: gst_pipeline_dispose (gstpipeline.c:132)
> ==2746==    by 0x6C7C4E: (within /usr/lib/libgobject-2.0.so.0.200.3)
> ==2746==    by 0xB7BF45: gst_object_unref (gstobject.c:241)
> ==2746==    by 0x804A739: main (gst-launch.c:467)
> ==2746==    by 0x982BAE: __libc_start_main (in /lib/libc-2.3.2.so)
> ==2746==    by 0x8049658: (within /build/gstreamer-0.7/bin/gst-launch-0.7)
> ==2746==    Address 0x5D2EE98 is 32 bytes inside a block of size 48 free'd
> ==2746==    at 0x2A65AC: free (vg_replace_malloc.c:231)
> ==2746==    by 0x199A63: g_free (in /usr/lib/libglib-2.0.so.0.200.3)
> ==2746==    by 0xDC4710: destroy_group (gstoptimalscheduler.c:708)
> ==2746==    by 0xDC42A4: unref_group (gstoptimalscheduler.c:621)
> ==2746==    by 0xDC48C9: remove_from_group (gstoptimalscheduler.c:735)
> ==2746==    by 0xDC7B18: gst_opt_scheduler_pad_unlink (gstoptimalscheduler.c:2028)
> ==2746==    by 0xBAA9EB: gst_scheduler_pad_unlink (gstscheduler.c:186)
> ==2746==    by 0xB7EE14: gst_bin_unset_element_sched (gstbin.c:388)
> ==2746==    by 0xB7F47B: gst_bin_remove_func (gstbin.c:516)
> ==2746==    by 0xB7F7D7: gst_bin_remove (gstbin.c:570)
> ==2746==    by 0xB803DE: gst_bin_dispose (gstbin.c:794)
> ==2746==    by 0xBA3E85: gst_pipeline_dispose (gstpipeline.c:132)
> ==2746==    by 0x6C7C4E: (within /usr/lib/libgobject-2.0.so.0.200.3)
> ==2746==    by 0xB7BF45: gst_object_unref (gstobject.c:241)
> ==2746==    by 0x804A739: main (gst-launch.c:467)
> ==2746==    by 0x982BAE: __libc_start_main (in /lib/libc-2.3.2.so)
> ==2746==    by 0x8049658: (within /build/gstreamer-0.7/bin/gst-launch-0.7)
>
>
> After staring at this a bit, I came to the conclusion that it was due to
> one of the existing groups still pointing at a destroyed group.  If I
> remove the g_free call in destroy_group, it doesn't crash...
>
> The above code works OK with the pre-caps merge.  Does anyone know why
> that would break it?
>
>
>