After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 536521 - Refcounting errors in playbin
Refcounting errors in playbin
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-base
git master
Other Linux
: Normal normal
: 0.10.20
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2008-06-03 22:48 UTC by Michael Smith
Modified: 2008-06-04 17:47 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Patch to fix this (1.08 KB, patch)
2008-06-03 22:50 UTC, Michael Smith
committed Details | Review

Description Michael Smith 2008-06-03 22:48:47 UTC
I'm getting occasional errors like:
  GLib-GObject-WARNING **: invalid unclassed pointer in cast to `GstPlayBaseBin'

With G_DEBUG=fatal_warnings, I got this stack trace:

(gdb) bt
  • #0 __kernel_vsyscall
  • #1 raise
    from /lib/tls/i686/cmov/libc.so.6
  • #2 abort
    from /lib/tls/i686/cmov/libc.so.6
  • #3 g_logv
    from /usr/lib/libglib-2.0.so.0
  • #4 g_log
    from /usr/lib/libglib-2.0.so.0
  • #5 g_type_check_instance_cast
    from /usr/lib/libgobject-2.0.so.0
  • #6 decodebin_element_removed_cb
    at gstplaybasebin.c line 1469
  • #7 g_cclosure_marshal_VOID__OBJECT
    from /usr/lib/libgobject-2.0.so.0
  • #8 g_closure_invoke
    from /usr/lib/libgobject-2.0.so.0
  • #9 ??
    from /usr/lib/libgobject-2.0.so.0
  • #10 g_signal_emit_valist
    from /usr/lib/libgobject-2.0.so.0
  • #11 g_signal_emit
    from /usr/lib/libgobject-2.0.so.0
  • #12 gst_bin_remove_func
    at gstbin.c line 1237
  • #13 gst_bin_remove
    at gstbin.c line 1298
  • #14 gst_bin_dispose
    at gstbin.c line 505
  • #15 gst_decode_bin_dispose
    at gstdecodebin.c line 404
  • #16 g_object_unref
    from /usr/lib/libgobject-2.0.so.0
  • #17 gst_object_unref
    at gstobject.c line 355
  • #18 gst_message_finalize
    at gstmessage.c line 216
  • #19 gst_mini_object_unref
    at gstminiobject.c line 320
  • #20 gst_bus_source_dispatch
    at gstbus.c line 784
  • #21 g_main_context_dispatch
    from /usr/lib/libglib-2.0.so.0
  • #22 ??
    from /usr/lib/libglib-2.0.so.0
  • #23 g_main_context_iteration
    from /usr/lib/libglib-2.0.so.0
  • #24 ??


So, what seems to be happening is this:
 1. My code hangs on to some things it gets via a bus messagefor a while. In this case, a message whose source is the decodebin inside playbin. That's fine; it has a reference to it.
 2. We set playbin to NULL, then unref it. It gets freed.
 3. We're now done with our bus message, so we unref it. This unrefs its source - the decodebin.
 4. In GstBin's dispose method, it removes all its children.
 5. And thus the element-removed signal is fired. Playbin connected to this signal (and never disconnected). Our callback tries to cast to a playbin instance... but it's been freed, so we explode.

Patch to be attached disconnects the signals that playbin attaches to decodebin before unreffing decodebin.
Comment 1 Michael Smith 2008-06-03 22:50:03 UTC
Created attachment 112095 [details] [review]
Patch to fix this

This patch works for my code, but I'm not sure if there's a nicer fix. Suggestions welcomed.
Comment 2 Sebastian Dröge (slomo) 2008-06-04 17:29:57 UTC
Wim said on IRC that this code should be fine but he's not sure either if it's the best thing to do. So maybe let's get this in for now for the upcoming releases as it fixes a crash and add a FIXME above the code.
Comment 3 Michael Smith 2008-06-04 17:47:56 UTC
2008-06-04  Michael Smith <msmith@songbirdnest.com>

    * gst/playback/gstplaybasebin.c:
      Disconnect signals from decodebins we created before we remove it from
      playbin, to avoid crashes if the decodebin is eventually disposed after
      the playbin itself (possible if the app takes a reference on the
      decodebin).
      Fixes #536521.