Created attachment 365265 [details] [review]
0001-vaapipostproc-lock-ensure_filter-with-postproc_lock.patch

The vaapipostproc element contains a race between gst_vaapipostproc_transform_caps and gst_vaapipostproc_start for postproc->allowed_srcpad_caps. 

The caps are copied with the postproc_lock (introduced in https://bugzilla.gnome.org/show_bug.cgi?id=766940) held via

gst_vaapipostproc_transform_caps -> gst_vaapipostproc_transform_caps_impl -> gst_vaapipostproc_transform_srccaps -> gst_caps_get_structure

And the same structure is released without holding the lock in

gst_vaapipostproc_start -> gst_vaapipostproc_ensure_filter -> gst_caps_replace

The call from gst_vaapipostproc_start to gst_vaapipostproc_ensure_filter should also be protected by the postproc_lock.