Bug 681955 – gst_discoverer_stream_info_list_free () causes a critical error

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 681955 - gst_discoverer_stream_info_list_free () causes a critical error


Summary:	gst_discoverer_stream_info_list_free () causes a critical error


Status:	RESOLVED INVALID

Product:	GStreamer
Classification:	Platform
Component:	gst-plugins-base
Version:	git master
Hardware:	Other Windows

Importance:	Normal minor
Target Milestone:	git master
Assigned To:	GStreamer Maintainers
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2012-08-16 00:00 UTC by LRN
Modified:	2012-08-16 00:21 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description LRN 2012-08-16 00:00:07 UTC

I have the following function for processing :
void
infoprocess (GstDiscovererStreamInfo * info)
{
  <non-disruptive code (only works with const data)>
  if (GST_IS_DISCOVERER_CONTAINER_INFO (info))
  {
    GstDiscovererContainerInfo *c = GST_DISCOVERER_CONTAINER_INFO (info);
    GList *children = gst_discoverer_container_info_get_streams (c);
    if (children)
    {
      GstDiscovererStreamInfo *sinfo = children->data;
      while (NULL != sinfo)
      {
        GstDiscovererStreamInfo *next;
        infoprocess (sinfo);
        next = gst_discoverer_stream_info_get_next (sinfo);
        gst_discoverer_stream_info_unref (sinfo);
        sinfo = next;
      }
      gst_discoverer_stream_info_list_free (children);
    }
  }
}

On some files this code throws a critical error:

+ Trace 230681

#0 g_logv
at /src/glib-2.33.1a/glib/gmessages.c line 662
#1 g_log
at /src/glib-2.33.1a/glib/gmessages.c line 792
#2 g_return_if_fail_warning
#3 g_object_unref
at /src/glib-2.33.1a/gobject/gobject.c line 2915
#4 gst_discoverer_stream_info_list_free
at gstdiscoverer-types.c line 450
#5 gst_discoverer_container_info_finalize
at gstdiscoverer-types.c line 171
#6 g_object_unref
at /src/glib-2.33.1a/gobject/gobject.c line 3023
#7 gst_discoverer_info_finalize
at gstdiscoverer-types.c line 361
#8 g_object_unref
at /src/glib-2.33.1a/gobject/gobject.c line 3023
#9 _fu138___gst_debug_min
at gstdiscoverer.c line 1221
#10 discoverer_bus_cb
at gstdiscoverer.c line 1506
#11 _fu142___gst_debug_min
at gstdiscoverer.c line 1497
#12 g_cclosure_marshal_VOID__BOXEDv
at /src/glib-2.33.1a/gobject/gmarshal.c line 1160
#13 _g_closure_invoke_va
at /src/glib-2.33.1a/gobject/gclosure.c line 840
#14 g_signal_emit_valist
at /src/glib-2.33.1a/gobject/gsignal.c line 3207
#15 g_signal_emit
at /src/glib-2.33.1a/gobject/gsignal.c line 3352
#16 gst_bus_async_signal_func
at gstbus.c line 1126
#17 gst_bus_source_dispatch
at gstbus.c line 773
#18 g_main_dispatch
at /src/glib-2.33.1a/glib/gmain.c line 2539
#19 g_main_context_dispatch
at /src/glib-2.33.1a/glib/gmain.c line 3075
#20 g_main_context_iterate
at /src/glib-2.33.1a/glib/gmain.c line 3146
#21 g_main_loop_run
at /src/glib-2.33.1a/glib/gmain.c line 3340


Commenting out the gst_discoverer_stream_info_list_free (children); line fixes this.

This might turn out to be just an issue with memory corruption though.

Comment 1 LRN 2012-08-16 00:21:35 UTC

OK, figured it out. I have to ref the first children in the list returned by gst_discoverer_container_info_get_streams(), because while loop body unrefs each object in the list, and gst_discoverer_stream_info_list_free() ALSO unrefs each object on the list. Problem is that gst_discoverer_stream_info_get_next() is not called for the first object in the list, so refs/unrefs are unbalanced for it.