GNOME Bugzilla – Bug 570761
[goom] crash in plugin_info_init allocating 260kB struct on stack
Last modified: 2010-06-28 18:59:00 UTC
Ekiga's experimental gstreamer code for video input leads to a crash ; here is the pipeline : audiotestsrc ! goom ! ffmpegcolorspace ! appsink max_buffers=2 drop=true caps=video/x-raw-yuv,format=(fourcc)I420,width=176,height=144,framerate=(fraction)25/1 name=ekiga_sink which works ok for video preview, but leads to the following trace when entering a call : Program received signal SIGSEGV, Segmentation fault.
+ Trace 212291
Thread 2983979920 (LWP 11309)
Hrm, this crash doesn't really make sense at all. Can you still reproduce this? Have you tried running it in valgrind?
Yes, I can reproduce it, it's pretty easy. Valgrind says : ==24321== Process terminating with default action of signal 11 (SIGSEGV) ==24321== Bad permissions for mapped region at address 0xB13A130 ==24321== at 0xAC68890: plugin_info_init (plugin_info.c:112) ==24321== by 0xAC6C867: goom_init (goom_core.c:83) ==24321== by 0xAC61C39: gst_goom_init (gstgoom.c:187) ==24321== by 0x558677E: g_type_create_instance (gtype.c:1674) ==24321== by 0x556B647: g_object_constructor (gobject.c:1383) ==24321== by 0x556CA61: g_object_newv (gobject.c:1252) ==24321== by 0x977AF8F: gst_element_factory_create (gstelementfactory.c:415) ==24321== by 0x977B7CB: gst_element_factory_make (gstelementfactory.c:482) ==24321== by 0x97DABEC: _gst_parse_yyparse (grammar.y:601) ==24321== by 0x97DCB85: _gst_parse_launch (grammar.y:870) ==24321== by 0x97D1C91: gst_parse_launch_full (gstparse.c:293) ==24321== by 0x97D1D03: gst_parse_launch (gstparse.c:259)
> Valgrind says : > ==24321== Process terminating with default action of signal 11 (SIGSEGV) > ==24321== Bad permissions for mapped region at address 0xB13A130 > ==24321== at 0xAC68890: plugin_info_init (plugin_info.c:112) > ==24321== by 0xAC6C867: goom_init (goom_core.c:83) so it crashes in: PluginInfo p = { 0, }; ? ...
Yes, it does crash at that very line. Notice that doing the same testing call with the videotest plugin doesn't lead to a crash : only goom has the problem! Weird, isn't it?
Does it still happen with the latest release / current git?
I'm using debian unstable's latest gstreamer0.10-plugins-good (0.10.22-1), and yes I still get a crash. Mysterious...
Does it also happen if you use that pipeline in connection with gst-launch-0.10?
No, only in ekiga's plugin... the one I pushed AppSrc&AppSink for...
Ok, so what is the easiest/minimal way to reproduce this on a debian sid system then?
1) compile ekiga with --enable-gstreamer ; 2) choose goom as a video input device ; 3) finally connect to the echo test. There's no problem in video preview : only during a call (and only with goom... using a real webcam or some other source seems to work).
Well, I don't seem to be able to comiple ekiga master using the packages in debian sid or experimental, so giving up on that (opal too old it seems). If you can't reproduce this with gst-launch or a small test program, then chances are it's ekiga's fault. Please provide a small test program in C (or python, but preferably C) that reproduces this bug.
Hm Julien. Do you have any news on this?
I just tested ; the bad news is that I still get a crash -- the good news is that the trace is different and even looks sane! Let me leave that bug NEEDINFO for now, but I'm hopeful something can be done.
Created attachment 164786 [details] Trace Sigh... here is a better trace. What I saw which had a better look was just warnings about string conversions elsewhere in the code :-/ Could we be hit by a threading issue?
Created attachment 164787 [details] [review] goom: don't allocate 260kB struct on the stack PluginInfo is quite a sizeable struct, let's not allocate it on the stack, especially not if we're copying it over into another dynamically allocated copy anyway. Possibly fixes #570761. Any chance you could try this patch?
I tried your patch : the crash disappeared! Very good! When will it go out? (ie: be found in distributions)
Great, thanks for testing: commit cf8dddd5c7913c3b80aa2c28c19afaa8a2757f5e Author: Tim-Philipp Müller <tim.muller@collabora.co.uk> Date: Mon Jun 28 09:07:58 2010 +0100 goom: don't allocate 260kB struct on the stack PluginInfo is quite a sizeable struct, let's not allocate it on the stack, especially not if we're copying it over into another dynamically allocated copy anyway. Fixes #570761. Will be part of the 0.10.24 gst-plugins-good release which should be out in 1-2 weeks or so. When that will be found in distros depends on the distros. On a side note, it's a bit surprising you experienced this problem on a normal desktop system (as opposed to an embedded environment with smaller stack sizes). Something up higher in the stack must be allocating lots of stuff on the stack as well, which may or may not cause problems. You might want to look into that too...
Indeed a stack issue is alarming... if only I knew how to debug that :-(