GNOME Bugzilla – Bug 753147
osxaudiosink: Pitch element causes pipeline failures and crashes when used with autoaudiosink
Last modified: 2018-11-03 13:39:24 UTC
Created attachment 308627 [details] Output of the Address Sanitizer The pitch element, part of the soundtouch plugin in gst-plugins-bad, seems to be causing pipeline failures and even crashes in some pipelines on Mac OS X when used together directly with the autoaudiosink. Address Sanitizer detects "heap use after free" or segmentation fault on various addresses in some pipelines as well. I have not yet extensively debugged the issue, but have tried to grasp the scope of it below. This is tested using GStreamer 1.4.5 on Mac OS X 10.10.4. The GStreamer core package and gst-plugins-bad were built by Homebrew, with two manual changes, one to build Soundtouch and one to enable Address Sanitizer by building with GCC 5.2.0 and adding -fsanitize=address. I have yet to rebuild gst-plugins-{base,good} with ASAN and will also enable debugging symbols so I can provide more debugging information. I believe the simplest command that should succeed but causes an internal data flow error is the following: ----8<---- $ gst-launch-1.0 audiotestsrc ! pitch ! autoaudiosink Setting pipeline to PAUSED ... Pipeline is PREROLLING ... ERROR: from element /GstPipeline:pipeline0/GstAudioTestSrc:audiotestsrc0: Internal data flow error. Additional debug info: gstbasesrc.c(2933): gst_base_src_loop (): /GstPipeline:pipeline0/GstAudioTestSrc:audiotestsrc0: streaming task paused, reason not-negotiated (-4) ERROR: pipeline doesn't want to preroll. Setting pipeline to NULL ... Freeing pipeline ... ---->8---- This command succeeds on my Linux test machine (a test sound is audible). On OS X, the problem seems gone when adding an audioconvert as well: ----8<---- $ gst-launch-1.0 audiotestsrc ! pitch ! audioconvert ! autoaudiosink Setting pipeline to PAUSED ... Pipeline is PREROLLING ... Redistribute latency... [...] Pipeline is PREROLLED ... Setting pipeline to PLAYING ... New clock: GstAudioSinkClock Redistribute latency... [...] ---->8---- Also, the following similar command without audioconvert does succeed on this OS X machine: ----8<---- $ gst-launch-1.0 audiotestsrc ! pitch ! filesink location=/dev/null (similar output to above) ---->8---- The simplest command that should succeed but instead triggers the Address Sanitizer is the following (ASAN output replaced with output from asan_symbolize). Note that it does not trigger this exact error in all cases; in others, it causes a pipeline error similar to the above one, or a different kind of ASAN error, which leads me to suspect a race condition... ----8<---- $ gst-launch-1.0 filesrc location=../jg.mp3 ! mad ! audioconvert ! pitch ! autoaudiosink Setting pipeline to PAUSED ... Pipeline is PREROLLING ... ERROR: from element /GstPipeline:pipeline0/GstFileSrc:filesrc0: Internal data flow error. Additional debug info: gstbasesrc.c(2933): gst_base_src_loop (): /GstPipeline:pipeline0/GstFileSrc:filesrc0: streaming task paused, reason not-negotiated (-4) ERROR: pipeline doesn't want to preroll. Setting pipeline to NULL ... ================================================================= ==90797==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200002bef0 at pc 0x000108abc405 bp 0x00010ed86bc0 sp 0x00010ed86370 [...] ---->8---- The full output of the ASAN symbolizer is attached to this bug report for brevity. Like above, this error does not occur when adding an audioconvert, or when using a filesink or fakesink. ----8<---- $ gst-launch-1.0 filesrc location=../jg.mp3 ! mad ! audioconvert ! pitch ! audioconvert ! autoaudiosink (similar output to succesful runs above) ---->8---- I will try to add information to this bug report as I go. I would appreciate it if others could repeat my experiments and confirm my findings. Thank you!
A slightly simpler command using only plugins from base and good, except for pitch, and still triggers ASAN, is the following. When repeated, this triggers different kinds of ASAN errors similar to the ones seen earlier, increasing my suspicion of a race condition. ---8<--- $ gst-launch-1.0 filesrc location=foo.wav ! wavparse ! pitch ! autoaudiosink 2>&1 | asan_symbolize.py Setting pipeline to PAUSED ... Pipeline is PREROLLING ... ERROR: from element /GstPipeline:pipeline0/GstWavParse:wavparse0: Internal data flow error. Additional debug info: gstwavparse.c(2186): gst_wavparse_loop (): /GstPipeline:pipeline0/GstWavParse:wavparse0: streaming task paused, reason not-negotiated (-4) ERROR: pipeline doesn't want to preroll. Setting pipeline to NULL ... ASAN:SIGSEGV ================================================================= ==91479==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000103765e3f bp 0x000108cab120 sp 0x000108cab100 T5) #0 0x103765e3e in gst_caps_features_is_equal (in libgstreamer-1.0.0.dylib) + 138 #1 0x10375fc4f in gst_caps_intersect_first (in libgstreamer-1.0.0.dylib) + 1568 #2 0x10375fecd in gst_caps_intersect_full (in libgstreamer-1.0.0.dylib) + 254 #3 0x1063ce0ff in gst_base_sink_query_caps (in libgstbase-1.0.0.dylib) + 354 #4 0x1063ed740 in gst_base_sink_default_query (in libgstbase-1.0.0.dylib) + 566 #5 0x1064dfaec in gst_audio_base_sink_query_pad (in libgstaudio-1.0.0.dylib) + 161 #6 0x106589b85 in gst_osx_audio_sink_query (in libgstosxaudio.so) + 317 #7 0x1063edb78 in gst_base_sink_sink_query (in libgstbase-1.0.0.dylib) + 165 #8 0x1037d1e22 in gst_pad_query (in libgstreamer-1.0.0.dylib) + 2038 #9 0x103860155 in gst_pad_query_caps (in libgstreamer-1.0.0.dylib) + 826 #10 0x106589ad3 in gst_osx_audio_sink_query (in libgstosxaudio.so) + 139 #11 0x1063edb78 in gst_base_sink_sink_query (in libgstbase-1.0.0.dylib) + 165 #12 0x1037d1e22 in gst_pad_query (in libgstreamer-1.0.0.dylib) + 2038 #13 0x1037d2fdc in gst_pad_peer_query (in libgstreamer-1.0.0.dylib) + 1955 #14 0x10385e295 in query_accept_caps_func (in libgstreamer-1.0.0.dylib) + 209 #15 0x1037cc5ed in gst_pad_forward (in libgstreamer-1.0.0.dylib) + 932 #16 0x10385e87e in gst_pad_proxy_query_accept_caps (in libgstreamer-1.0.0.dylib) + 1242 #17 0x1037cd138 in gst_pad_query_accept_caps_default (in libgstreamer-1.0.0.dylib) + 440 #18 0x1037ce578 in gst_pad_query_default (in libgstreamer-1.0.0.dylib) + 495 #19 0x1037d1e22 in gst_pad_query (in libgstreamer-1.0.0.dylib) + 2038 #20 0x1037d2fdc in gst_pad_peer_query (in libgstreamer-1.0.0.dylib) + 1955 #21 0x10385e295 in query_accept_caps_func (in libgstreamer-1.0.0.dylib) + 209 #22 0x1037cc5ed in gst_pad_forward (in libgstreamer-1.0.0.dylib) + 932 #23 0x10385e87e in gst_pad_proxy_query_accept_caps (in libgstreamer-1.0.0.dylib) + 1242 #24 0x1037cd138 in gst_pad_query_accept_caps_default (in libgstreamer-1.0.0.dylib) + 440 #25 0x1037ce578 in gst_pad_query_default (in libgstreamer-1.0.0.dylib) + 495 #26 0x1037d1e22 in gst_pad_query (in libgstreamer-1.0.0.dylib) + 2038 #27 0x103860af7 in gst_pad_query_accept_caps (in libgstreamer-1.0.0.dylib) + 812 #28 0x1037dbbf1 in pre_eventfunc_check (in libgstreamer-1.0.0.dylib) + 263 #29 0x1037dcb2a in gst_pad_send_event_unchecked (in libgstreamer-1.0.0.dylib) + 3577 #30 0x1037da9c1 in gst_pad_push_event_unchecked (in libgstreamer-1.0.0.dylib) + 2648 #31 0x1037d0998 in push_sticky (in libgstreamer-1.0.0.dylib) + 881 #32 0x1037d9f5f in sticky_changed (in libgstreamer-1.0.0.dylib) + 299 #33 0x1037bf1f3 in events_foreach (in libgstreamer-1.0.0.dylib) + 788 #34 0x1037da7c9 in gst_pad_push_event_unchecked (in libgstreamer-1.0.0.dylib) + 2144 #35 0x1037d15ae in check_sticky (in libgstreamer-1.0.0.dylib) + 726 #36 0x1037db553 in gst_pad_push_event (in libgstreamer-1.0.0.dylib) + 965 #37 0x1064a0a6f in gst_wavparse_loop (in libgstwavparse.so) + 1053 #38 0x103846767 in gst_task_func (in libgstreamer-1.0.0.dylib) + 1329 #39 0x1038487e3 in default_func (in libgstreamer-1.0.0.dylib) + 150 #40 0x103aa22bb in g_thread_pool_thread_proxy (in libglib-2.0.0.dylib) + 36 #41 0x103aa1611 in g_thread_proxy (in libglib-2.0.0.dylib) + 89 #42 0x7fff97f86267 in _pthread_body (in libsystem_pthread.dylib) + 130 #43 0x7fff97f861e4 in _pthread_start (in libsystem_pthread.dylib) + 175 #44 0x7fff97f8441c in thread_start (in libsystem_pthread.dylib) + 12 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV ??:0 ?? Thread T5 created by T0 here: #0 0x102a0b0f0 in wrap_pthread_create (in libasan.2.dylib) + 96 #1 0x103abc2dd in g_system_thread_new (in libglib-2.0.0.dylib) + 140 #2 0x103aa16e2 in g_thread_new_internal (in libglib-2.0.0.dylib) + 63 #3 0x103aa1aeb in g_thread_pool_start_thread (in libglib-2.0.0.dylib) + 95 #4 0x103aa1b7b in g_thread_pool_push (in libglib-2.0.0.dylib) + 90 #5 0x103848a1c in default_push (in libgstreamer-1.0.0.dylib) + 241 #6 0x10384914a in gst_task_pool_push (in libgstreamer-1.0.0.dylib) + 426 #7 0x103847b52 in start_task (in libgstreamer-1.0.0.dylib) + 478 #8 0x103847f57 in gst_task_set_state (in libgstreamer-1.0.0.dylib) + 743 #9 0x1037dea64 in gst_pad_start_task (in libgstreamer-1.0.0.dylib) + 1079 #10 0x1037c260c in gst_pad_activate_mode (in libgstreamer-1.0.0.dylib) + 1611 #11 0x1037c1949 in gst_pad_set_active (in libgstreamer-1.0.0.dylib) + 781 #12 0x10378e1ac in activate_pads (in libgstreamer-1.0.0.dylib) + 123 #13 0x1037ad562 in gst_iterator_fold (in libgstreamer-1.0.0.dylib) + 266 #14 0x10378e2c2 in iterator_activate_fold_with_resync (in libgstreamer-1.0.0.dylib) + 246 #15 0x10378e4d2 in gst_element_pads_activate (in libgstreamer-1.0.0.dylib) + 329 #16 0x10378ea14 in gst_element_change_state_func (in libgstreamer-1.0.0.dylib) + 676 #17 0x1064a5037 in gst_wavparse_change_state (in libgstwavparse.so) + 45 #18 0x10378da04 in gst_element_change_state (in libgstreamer-1.0.0.dylib) + 158 #19 0x10378d73d in gst_element_set_state_func (in libgstreamer-1.0.0.dylib) + 2363 #20 0x10378cdf9 in gst_element_set_state (in libgstreamer-1.0.0.dylib) + 375 #21 0x103735d6d in gst_bin_element_set_state (in libgstreamer-1.0.0.dylib) + 2270 #22 0x1037382ba in gst_bin_change_state_func (in libgstreamer-1.0.0.dylib) + 2425 #23 0x1037e3da1 in gst_pipeline_change_state (in libgstreamer-1.0.0.dylib) + 3678 #24 0x10378da04 in gst_element_change_state (in libgstreamer-1.0.0.dylib) + 158 #25 0x10378c54d in gst_element_continue_state (in libgstreamer-1.0.0.dylib) + 1169 #26 0x10378de1c in gst_element_change_state (in libgstreamer-1.0.0.dylib) + 1206 #27 0x10378d73d in gst_element_set_state_func (in libgstreamer-1.0.0.dylib) + 2363 #28 0x10378cdf9 in gst_element_set_state (in libgstreamer-1.0.0.dylib) + 375 #29 0x1029eb312 in main (in gst-launch-1.0) + 2567 #30 0x7fff972215c8 in start (in libdyld.dylib) + 0 #31 0x8 (<unknown module>) ==91479==ABORTING ---->8----
Looks more likely a bug in osxaudiosink.
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/issues/291.