After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 686327 - mpegtsmux: fix refcount issue with input buffers
mpegtsmux: fix refcount issue with input buffers
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-bad
1.x
Other Linux
: Normal critical
: 1.0.2
Assigned To: GStreamer Maintainers
GStreamer Maintainers
: 686543 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2012-10-17 19:35 UTC by Andoni Morales
Modified: 2012-11-13 14:34 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Fix refcount issue with input buffers (726 bytes, patch)
2012-10-17 19:35 UTC, Andoni Morales
rejected Details | Review
mpegtsmux: Don't make the same buffer writable twice. (3.47 KB, patch)
2012-10-21 14:40 UTC, Jan Schmidt
committed Details | Review

Description Andoni Morales 2012-10-17 19:35:13 UTC
Created attachment 226680 [details] [review]
Fix refcount issue with input buffers

It seems there is refcount error in stream_data_new and mpegtsmux is segfault with both schroenc and x264enc with the following pipeline:

gst-launch-1.0 videotestsrc ! x264enc ! mpegtsmux ! fakesink

(gst-launch-1.0:6206): GStreamer-CRITICAL **: gst_mini_object_unref: assertion `mini_object->refcount > 0' failed
 
Program received signal SIGTRAP, Trace/breakpoint trap.
[Cambiando a Thread 0x7ffff3b4b700 (LWP 6225)]
0x00007ffff75a3f95 in g_logv () from /home/andoni/cerbero/dist/linux_x86_64/lib/libglib-2.0.so.0
(gdb) bt
  • #0 g_logv
    from /home/andoni/cerbero/dist/linux_x86_64/lib/libglib-2.0.so.0
  • #1 g_log
    from /home/andoni/cerbero/dist/linux_x86_64/lib/libglib-2.0.so.0
  • #2 g_return_if_fail_warning
    from /home/andoni/cerbero/dist/linux_x86_64/lib/libglib-2.0.so.0
  • #3 gst_buffer_unref
    at /home/andoni/cerbero/dist/linux_x86_64/include/gstreamer-1.0/gst/gstbuffer.h line 350
  • #4 _gst_video_codec_frame_free
    at gstvideoutils.c line 46
  • #5 gst_video_codec_frame_unref
    at gstvideoutils.c line 128
  • #6 gst_video_encoder_finish_frame
    at gstvideoencoder.c line 1868
  • #7 gst_x264_enc_encode_frame
    at gstx264enc.c line 1732
  • #8 gst_x264_enc_handle_frame
    at gstx264enc.c line 1604
  • #9 gst_video_encoder_chain
    at gstvideoencoder.c line 1341
  • #10 gst_pad_chain_data_unchecked
    at gstpad.c line 3654
  • #11 gst_pad_push_data
    at gstpad.c line 3871
  • #12 gst_base_src_loop
    at gstbasesrc.c line 2700
  • #13 gst_task_func
    at gsttask.c line 316
  • #14 g_thread_pool_thread_proxy
    from /home/andoni/cerbero/dist/linux_x86_64/lib/libglib-2.0.so.0
  • #15 g_thread_proxy
    from /home/andoni/cerbero/dist/linux_x86_64/lib/libglib-2.0.so.0
  • #16 start_thread
    at pthread_create.c line 308
  • #17 clone
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 112
  • #18 ??

Comment 1 Andoni Morales 2012-10-18 19:35:11 UTC
This doesn't look like a good idea, as it seems that all buffers are leaked now.
Comment 2 Andoni Morales 2012-10-18 21:44:34 UTC
GstCollectPads unref the input buffer, so it seems correct incrementing the reference count in stream_data_new as proposed in the patch.

But still, it seems there is a memory leak somewhere else.
Comment 3 Tim-Philipp Müller 2012-10-20 19:58:10 UTC
> GstCollectPads unref the input buffer

Where does it do that? And input buffer to which function?
Comment 4 Jan Schmidt 2012-10-21 11:36:39 UTC
I think this may correlate with a problem Andreas was complaining about
Comment 5 Jan Schmidt 2012-10-21 14:40:37 UTC
Created attachment 226927 [details] [review]
mpegtsmux: Don't make the same buffer writable twice.

Fixes Bug 686327 - mpegtsmux: fix refcount issue with input buffers
Comment 6 Jan Schmidt 2012-10-21 14:42:37 UTC
The patch is incorrect in that CollectPads passes a refcount to the buffer when the callback is executed (it pops the buffer from the pad, and then passes it to mpegtsmux).

The actual problem lies in the custom buffer clip function, where it calls gst_buffer_make_writable on the same input pointer twice - the first time gives away the reference to that buffer.

Fix pushed.
Comment 7 Tim-Philipp Müller 2012-10-21 15:20:45 UTC
*** Bug 686543 has been marked as a duplicate of this bug. ***