Bug 361584 – [mpeg2dec] framerate=0/0 on caps leads to crash

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 361584 - [mpeg2dec] framerate=0/0 on caps leads to crash


Summary:	[mpeg2dec] framerate=0/0 on caps leads to crash


Status:	RESOLVED FIXED

Product:	GStreamer
Classification:	Platform
Component:	gst-plugins-ugly
Version:	git master
Hardware:	Other All

Importance:	High critical
Target Milestone:	0.10.5
Assigned To:	Wim Taymans
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Duplicates:	370306 386235 390720 399161 406114 412740 461505 (view as bug list)
Depends on:
Blocks:

Reported:	2006-10-11 23:45 UTC by olek_nospam
Modified:	2007-07-29 16:50 UTC

See Also:
GNOME target:	---
GNOME version:	2.15/2.16

Attachments
Example of file that causes Totem to crash (674.98 KB, application/octet-stream) 2006-11-02 03:08 UTC, olek_nospam		Details
Proposed patch (1.61 KB, patch) 2006-11-09 13:32 UTC, Jan Arne Petersen	none	Details \| Review
Simplified (2.23 KB, patch) 2006-11-09 13:45 UTC, Jan Arne Petersen	none	Details \| Review
Simply use 27000000 for fps_n and frame_period for fps_d (1.96 KB, patch) 2006-11-15 12:38 UTC, Jan Arne Petersen	committed	Details \| Review

Description olek_nospam 2006-10-11 23:45:26 UTC

Version: 2.16.2

What were you doing when the application crashed?
Opening an old .MPG file. 


Distribution: Ubuntu 6.10 (edgy)
Gnome Release: 2.16.1 2006-10-02 (Ubuntu)
BugBuddy Version: 2.16.0

Memory status: size: 118501376 vsize: 0 resident: 118501376 share: 0 rss: 26210304 rss_rlim: 0
CPU usage: start_time: 1160609344 rtime: 0 utime: 92 stime: 0 cutime:84 cstime: 0 timeout: 8 it_real_value: 0 frequency: 4

Backtrace was generated from '/usr/bin/totem'

(no debugging symbols found)
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread -1226794272 (LWP 31313)]
[New Thread -1313297504 (LWP 31322)]
[New Thread -1304904800 (LWP 31321)]
[New Thread -1284695136 (LWP 31318)]
[New Thread -1276302432 (LWP 31317)]
(no debugging symbols found)
0xffffe410 in __kernel_vsyscall ()

+ Trace 75907

Thread 2 (Thread -1313297504 (LWP 31322))

#0 __kernel_vsyscall
#1 __waitpid_nocancel
from /lib/tls/i686/cmov/libpthread.so.0
#2 gnome_gtk_module_info_get
from /usr/lib/libgnomeui-2.so.0
#3 <signal handler called>
#4 __kernel_vsyscall
#5 raise
from /lib/tls/i686/cmov/libc.so.6
#6 abort
from /lib/tls/i686/cmov/libc.so.6
#7 g_logv
from /usr/lib/libglib-2.0.so.0
#8 g_log
from /usr/lib/libglib-2.0.so.0
#9 g_assert_warning
from /usr/lib/libglib-2.0.so.0
#10 gst_value_can_compare
from /usr/lib/libgstreamer-0.10.so.0
#11 gst_value_compare
from /usr/lib/libgstreamer-0.10.so.0
#12 gst_value_subtract
from /usr/lib/libgstreamer-0.10.so.0
#13 gst_value_subtract
from /usr/lib/libgstreamer-0.10.so.0
#14 gst_bus_peek
from /usr/lib/libgstreamer-0.10.so.0
#15 gst_structure_foreach
from /usr/lib/libgstreamer-0.10.so.0
#16 gst_bus_peek
from /usr/lib/libgstreamer-0.10.so.0
#17 gst_caps_subtract
from /usr/lib/libgstreamer-0.10.so.0
#18 gst_caps_is_subset
from /usr/lib/libgstreamer-0.10.so.0
#19 gst_pad_get_element_private
from /usr/lib/libgstreamer-0.10.so.0
#20 gst_pad_get_caps
from /usr/lib/libgstreamer-0.10.so.0
#21 gst_proxy_pad_do_query_type
from /usr/lib/libgstreamer-0.10.so.0
#22 gst_pad_get_element_private
from /usr/lib/libgstreamer-0.10.so.0
#23 gst_pad_get_caps
from /usr/lib/libgstreamer-0.10.so.0
#24 gst_pad_peer_get_caps
from /usr/lib/libgstreamer-0.10.so.0
#25 gst_stream_selector_get_type
from /usr/lib/gstreamer-0.10/libgstplaybin.so
#26 gst_pad_get_element_private
from /usr/lib/libgstreamer-0.10.so.0
#27 gst_pad_get_caps
from /usr/lib/libgstreamer-0.10.so.0
#28 gst_pad_get_allowed_caps
from /usr/lib/libgstreamer-0.10.so.0
#29 gst_pad_accept_caps
from /usr/lib/libgstreamer-0.10.so.0
#30 gst_pad_accept_caps
from /usr/lib/libgstreamer-0.10.so.0
#31 gst_pad_accept_caps
from /usr/lib/libgstreamer-0.10.so.0
#32 gst_stream_selector_get_type
from /usr/lib/gstreamer-0.10/libgstplaybin.so
#33 gst_pad_accept_caps
from /usr/lib/libgstreamer-0.10.so.0
#34 _gst_format_initialize
from /usr/lib/libgstreamer-0.10.so.0
#35 gst_pad_accept_caps
from /usr/lib/libgstreamer-0.10.so.0
#36 ??
from /usr/lib/gstreamer-0.10/libgstmpeg2dec.so
#37 ??
#38 ??
#39 ??
#40 ??
#41 ??
#42 ??
#43 ??
#44 ??
from /usr/lib/gstreamer-0.10/libgstmpeg2dec.so
#45 ??
#46 ??
#47 ??
from /usr/lib/gstreamer-0.10/libgstmpeg2dec.so
#48 ??
#49 ??
#50 ??
#51 ??
from /usr/lib/gstreamer-0.10/libgstmpeg2dec.so
#52 ??
#53 ??

Comment 1 Tim-Philipp Müller 2006-10-31 12:35:50 UTC

Hi, thanks for the bug report. This is quite an odd stack trace.

Do you still have the .mpg file that triggered this or can you still reproduce this with another .mpg file of yours?

Comment 2 olek_nospam 2006-11-02 03:08:09 UTC

Created attachment 75814 [details]
Example of file that causes Totem to crash

This happens 100% of the time with certain .mpg files. I'm attaching one. This is a brief intro clip from an old TV show. Please let me know if I can help in any other way!

Comment 3 Tim-Philipp Müller 2006-11-02 09:03:37 UTC

Thanks! Looks like an mpeg2dec problem:


(totem:2114): GStreamer-CRITICAL **: gst_value_set_fraction: assertion `denominator != 0' failed

GStreamer-ERROR **: file gstvalue.c: line 3709 (gst_value_compare_fraction): should not be reached

(gdb) bt

+ Trace 81801

#0 __kernel_vsyscall
#1 raise
from /lib/tls/i686/cmov/libc.so.6
#2 abort
from /lib/tls/i686/cmov/libc.so.6
#3 IA__g_logv
#4 IA__g_log
#5 IA__g_assert_warning
at gmessages.c line 552
#6 gst_value_compare_fraction
at gstvalue.c line 3709
#7 gst_value_compare
at gstvalue.c line 2779
#8 gst_value_subtract
at gstvalue.c line 3060
#9 gst_value_subtract
at gstvalue.c line 2579
#10 gst_caps_structure_subtract_field
at gstcaps.c line 1251
#11 gst_structure_foreach
at gststructure.c line 878
#12 gst_caps_structure_subtract
at gstcaps.c line 1275
#13 gst_caps_subtract
at gstcaps.c line 1339
#14 gst_caps_is_subset
at gstcaps.c line 1013
#15 gst_pad_get_caps_unlocked
at gstpad.c line 1945
#16 gst_pad_get_caps
at gstpad.c line 2018
#17 gst_proxy_pad_do_getcaps
at gstghostpad.c line 226
#18 gst_pad_get_caps_unlocked
at gstpad.c line 1930
#19 gst_pad_get_caps
at gstpad.c line 2018
#20 gst_pad_peer_get_caps
at gstpad.c line 2053
#21 gst_stream_selector_getcaps
at gststreamselector.c line 289
#22 gst_pad_get_caps_unlocked
at gstpad.c line 1930
#23 gst_pad_get_caps
at gstpad.c line 2018
#24 gst_pad_acceptcaps_default
at gstpad.c line 2170
#25 gst_pad_accept_caps
at gstpad.c line 2218
#26 gst_pad_configure_src
at gstpad.c line 2396
#27 gst_pad_alloc_buffer_full
at gstpad.c line 2691
#28 gst_stream_selector_bufferalloc
at gststreamselector.c line 313
#29 gst_pad_alloc_buffer_full
at gstpad.c line 2606
#30 gst_proxy_pad_do_bufferalloc
at gstghostpad.c line 178
#31 gst_pad_alloc_buffer_full
at gstpad.c line 2606
#32 gst_mpeg2dec_chain
at gstmpeg2dec.c line 449
#33 gst_pad_chain_unchecked
at gstpad.c line 3395
#34 gst_pad_push
at gstpad.c line 3561
#35 gst_type_find_element_chain
at gsttypefindelement.c line 570
#36 gst_pad_chain_unchecked
at gstpad.c line 3395
#37 gst_pad_push
at gstpad.c line 3561
#38 gst_proxy_pad_do_chain
at gstghostpad.c line 189
#39 gst_pad_chain_unchecked
at gstpad.c line 3395
#40 gst_pad_push
at gstpad.c line 3561
#41 gst_base_src_loop
at gstbasesrc.c line 1570
#42 gst_task_func
at gsttask.c line 192
#43 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#44 g_thread_create_proxy
at gthread.c line 553
#45 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#46 clone
from /lib/tls/i686/cmov/libc.so.6
#27 gst_pad_alloc_buffer_full
at gstpad.c line 2691



(gdb) call gst_caps_to_string (caps)

$1 = (gchar *) 0x80c5600 "video/x-raw-yuv, format=(fourcc)I420, width=(int)320, height=(int)240, pixel-aspect-ratio=(fraction)1/1, framerate=(fraction)0/0"

Comment 4 Jan Arne Petersen 2006-11-09 11:17:05 UTC

The relevant part from the debug output of a gst-launch run with a mpeg file with 12 fps:

0:00:01.546620000 25221 0x8123d88 DEBUG             mpeg2dec gstmpeg2dec.c:645:handle_sequence:<mpeg2dec0> sequence flags: 165, frame period: 2250000 (0.0833333), frame rate: 0/0

The frame_period 2250000 is not contained in the list of predefined frame_periods and so the find-the-framerate code in handle_sequence:

/* find framerate */
for (i = 0; i < 9; i++) {
  if (info->sequence->frame_period == frame_periods[i]) {
    mpeg2dec->fps_n = fpss[i][0];
    mpeg2dec->fps_d = fpss[i][1];
  }
}

doesn't find any framerate.

Comment 5 Jan Arne Petersen 2006-11-09 11:46:47 UTC

*** Bug 370306 has been marked as a duplicate of this bug. ***

Comment 6 Jan Arne Petersen 2006-11-09 13:32:27 UTC

Created attachment 76266 [details] [review]
Proposed patch

Comment 7 Jan Arne Petersen 2006-11-09 13:45:44 UTC

Created attachment 76269 [details] [review]
Simplified

Comment 8 Jan Arne Petersen 2006-11-15 12:38:30 UTC

Created attachment 76633 [details] [review]
Simply use 27000000 for fps_n and frame_period for fps_d

Comment 9 Wim Taymans 2006-11-15 13:57:51 UTC

        Patch by: Jan Arne Petersen <jpetersen at jpetersen dot org>

        * ext/mpeg2dec/gstmpeg2dec.c: (handle_sequence), (handle_slice):
        Simplify the framerate code and support more framerates. Fixes #361584.

Comment 10 palfrey 2006-12-16 15:18:55 UTC

*** Bug 386235 has been marked as a duplicate of this bug. ***

Comment 11 palfrey 2006-12-29 19:13:51 UTC

*** Bug 390720 has been marked as a duplicate of this bug. ***

Comment 12 André Klapper 2007-01-22 10:13:43 UTC

*** Bug 399161 has been marked as a duplicate of this bug. ***

Comment 13 André Klapper 2007-02-09 15:52:21 UTC

*** Bug 406114 has been marked as a duplicate of this bug. ***

Comment 14 Christian Kirbach 2007-02-27 19:50:53 UTC

*** Bug 412740 has been marked as a duplicate of this bug. ***

Comment 15 Philip Withnall 2007-07-29 16:50:16 UTC

*** Bug 461505 has been marked as a duplicate of this bug. ***