GNOME Bugzilla – Bug 656715
playbin2, playsink: reference count ts_offset to avoid crashes
Last modified: 2011-08-25 22:03:21 UTC
See https://bugzilla.redhat.com/show_bug.cgi?id=706744 While tracking down that bug, I found that the crash is due to improper refcounting in gstreamer. Unless I'm missing something, the code path is all gstreamer. It never hits totem. See the test here at: http://p.mecheye.net/refcount/0 Notice how it incorrectly gets decremented to 0 during a message free, and is then used later. (After its memory has been replaced by various pango stuff) The gdb commands I used: http://p.mecheye.net/refcount-commands/1
I think this might be fixed by the patch in https://bugzilla.gnome.org/show_bug.cgi?id=653840.
Actually, no, that patch is bad, sorry.
Jasper, how did you reproduce this? Is it random?
(In reply to comment #3) > Jasper, how did you reproduce this? Is it random? It's "random", but it happens a lot of the time for me. 1. $ totem ~/thing.mp3 2. Sometimes the file won't play (no visualizer, "00:00 / 00:00") 3. Open a file from the Recent Files list. 4. Boom. You sometimes get an assert on something like "g_type_instance", you sometimes get a segfault. It's just trying to access memory it thinks it has but doesn't. Additionally, it might be related to threading sync issues: I forget it now, but while debugging this with gdb I found a breakpoint I could set that would make the issue go away (I tested six or seven times with that breakpoint, and it never failed once)
Created attachment 194337 [details] [review] patch A potential fix. This seems to decrease the probability of seeing the bug to ~0, but I'd like to get some confirmation from other people.
*** Bug 657209 has been marked as a duplicate of this bug. ***
Looks correct to me and should prevent all crashes caused by the ts-offset elements disappearing because we now really own a reference. Please push, it can't hurt even though I can't guarantee that it fixes this bug either :)
commit a91237434271ed17d59bf95e0762dc9161c09864 Author: David Schleef <ds@schleef.org> Date: Sun Aug 21 14:51:45 2011 -0700 playback: reference count ts_offset Apparently this object is being used after it's freed. This is one way to fix it, although perhaps not the best way. Fixes: #656715. I will assume it fixes this bug and close it.