After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 670321 - playbin2 hangs and crashes in notify_source_cb() when controlled by rhythmbox
playbin2 hangs and crashes in notify_source_cb() when controlled by rhythmbox
Status: RESOLVED DUPLICATE of bug 673888
Product: GStreamer
Classification: Platform
Component: gst-plugins-base
0.10.x
Other Linux
: Normal normal
: git master
Assigned To: GStreamer Maintainers
GStreamer Maintainers
: 660001 674477 676501 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2012-02-17 20:51 UTC by Thomas Meyer
Modified: 2012-06-17 10:22 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
debugger session of the crash (232.12 KB, image/png)
2012-02-17 20:51 UTC, Thomas Meyer
Details
valgrind log (78.42 KB, text/plain)
2012-04-21 15:03 UTC, André Klapper
Details
second valgrind log (with --leak-check=full --track-origins=yes), part 1 of 2 (829.89 KB, text/plain)
2012-04-21 17:34 UTC, André Klapper
Details
second valgrind log (with --leak-check=full --track-origins=yes), part 2 of 2 (511.08 KB, text/plain)
2012-04-21 17:35 UTC, André Klapper
Details

Description Thomas Meyer 2012-02-17 20:51:51 UTC
Created attachment 207904 [details]
debugger session of the crash

Hi,

this crash happens very often to me in Fedora 16. See also fedora's bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=702778.

I just did a fresh compile of gstreamer and gst-plugins-base from the git tree and checked out the resp. 0.10 branch on both.

here is the result of the crash

Stack trace is:

Thread [1] 24264 [core: 0] (Suspended : Signal : SIGINT:Interrupt)	
	__kernel_vsyscall() at 0xf7785430	
	raise() at 0x43ed5b4e	
	rb_debug_stop_in_debugger() at rb-debug.c:282 0x41554149	
	log_handler() at rb-debug.c:299 0x415541b5	
	g_logv() at gmessages.c:545 0x4753726f	
	g_log() at gmessages.c:591 0x475375e4	
	g_return_if_fail_warning() at gmessages.c:600 0x4753784e	
	g_object_get() at gobject.c:1.881 0x47332bd0	
	notify_source_cb() at gstplaybin2.c:3.437 0xeb3658f1	
	g_cclosure_marshal_VOID__PARAM() at gmarshal.c:539 0x4732c5cb	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.003 0x473462ff	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	g_object_dispatch_properties_changed() at gobject.c:925 0x4732d837	
	gst_object_dispatch_properties_changed() at gstobject.c:530 0xf75a4f92	
	g_object_notify_dispatcher() at gobject.c:331 0x4732ccb0	
	g_object_notify_queue_thaw() at gobjectnotifyqueue.c:132 0x4732fa62	
	g_object_notify_by_spec_internal() at gobject.c:983 0x4732fa62	
	g_object_notify() at gobject.c:1.024 0x4732fa62	
	setup_source() at gsturidecodebin.c:2.015 0xea29fc4a	
	gst_uri_decode_bin_change_state() at gsturidecodebin.c:2.493 0xea29fc4a	
	gst_element_change_state() at gstelement.c:2.761 0xf75c2a9b	
	gst_element_set_state_func() at gstelement.c:2.717 0xf75c34c5	
	gst_element_set_state() at gstelement.c:2.618 0xf75c27d1	
	gst_bin_element_set_state() at gstbin.c:2.209 0xf75adc0e	
	gst_bin_change_state_func() at gstbin.c:2.518 0xf75adc0e	
	gst_pipeline_change_state() at gstpipeline.c:482 0xf75e6364	
	gst_play_bin_change_state() at gstplaybin2.c:3.936 0xeb367d99	
	gst_element_change_state() at gstelement.c:2.761 0xf75c2a9b	
	gst_element_set_state_func() at gstelement.c:2.717 0xf75c34c5	
	gst_element_set_state() at gstelement.c:2.618 0xf75c27d1	
	start_state_change() at rb-player-gst.c:382 0x41552092	
	state_change_finished() at rb-player-gst.c:411 0x4155225b	
	impl_play() at rb-player-gst.c:849 0x41552cbd	
	rb_player_play() at rb-player.c:434 0x415433bc	
	rb_shell_player_open_location() at rb-shell-player.c:1.654 0x414c42cc	
	rb_shell_player_set_playing_entry() at rb-shell-player.c:1.769 0x414c5fa4	
	rb_shell_player_property_row_activated_cb() at rb-shell-player.c:2.778 0x414c9297	
	g_cclosure_marshal_VOID__STRING() at gmarshal.c:504 0x4732c50b	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.003 0x473462ff	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	rb_property_view_row_activated_cb() at rb-property-view.c:737 0x415094a5	
	_gtk_marshal_VOID__BOXED_OBJECT() at gtkmarshalers.c:1.386 0x4115c1b2	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.003 0x473462ff	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	gtk_tree_view_row_activated() at gtktreeview.c:12.464 0x41289c4a	
	gtk_tree_view_button_press() at gtktreeview.c:3.166 0x4128f68c	
	_gtk_marshal_BOOLEAN__BOXED() at gtkmarshalers.c:85 0x4115a3ba	
	g_type_class_meta_marshal() at gclosure.c:885 0x4732903e	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.310 0x4733d6a8	
	g_signal_emit_valist() at gsignal.c:3.013 0x47346118	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	gtk_widget_event_internal() at gtkwidget.c:6.132 0x412aac53	
	gtk_propagate_event() at gtkmain.c:2.614 0x41159a62	
	rb_tree_dnd_button_release_event_cb() at rb-tree-dnd.c:383 0x4155edfe	
	_gtk_marshal_BOOLEAN__BOXED() at gtkmarshalers.c:85 0x4115a3ba	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.013 0x47346118	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	gtk_widget_event_internal() at gtkwidget.c:6.132 0x412aac53	
	gtk_propagate_event() at gtkmain.c:2.614 0x41159a62	
	gtk_main_do_event() at gtkmain.c:1.889 0x41159ec8	
	_gdk_event_emit() at gdkevents.c:71 0x4faadf9d	
	gdk_event_source_dispatch() at gdkeventsource.c:360 0x4fad64d9	
	g_main_dispatch() at gmain.c:2.441 0x4752e62f	
	g_main_context_dispatch() at gmain.c:3.011 0x4752e62f	
	g_main_context_iterate() at gmain.c:3.089 0x4752ed70	
	g_main_loop_run() at gmain.c:3.297 0x4752f3a7	
	gtk_main() at gtkmain.c:1.362 0x41159155	
	main() at main.c:324 0x804a2e4	

log_handler(): says
--------------------
message="g_object_get: assertion `G_IS_OBJECT (object)' failed"	

notify_source_cb():
--------------------
source	GstElement *	0x0 (I changed the source to be initialized with NULL)

*group	GstSourceGroup	{...}	
	playbin	GstPlayBin *	0x9701cf8 [GstPlayBin2]	
	lock	GMutex *	0x9166cb0	
	valid	gboolean	0	
	active	gboolean	0	
	uri	gchar *	0x9c657e8 "file:///home/thomas/Musik/Tom%20Waits/Bad%20As%20Me%20(Deluxe%20Version)/02%20Raised%20Right%20Men.mp3"	
	suburi	gchar *	0x0	
	streaminfo	GValueArray *	0x0	
	source	GstElement *	0x0	
	video_channels	GPtrArray *	0xeace07c8	
	audio_channels	GPtrArray *	0xeace0780	
	text_channels	GPtrArray *	0xeace0798	
	audio_sink	GstElement *	0x0	
	video_sink	GstElement *	0x0	
	uridecodebin	GstElement *	0x0	-> Is NULL!! Bad!
	suburidecodebin	GstElement *	0x0	
	pending	gint	0	
	sub_pending	gboolean	0	
	pad_added_id	gulong	0	
	pad_removed_id	gulong	0	
	no_more_pads_id	gulong	0	
	notify_source_id	gulong	0	
	drained_id	gulong	0	
	autoplug_factories_id	gulong	0	
	autoplug_select_id	gulong	0	
	autoplug_continue_id	gulong	0	
	sub_pad_added_id	gulong	0	
	sub_pad_removed_id	gulong	0	
	sub_no_more_pads_id	gulong	0	
	sub_autoplug_continue_id	gulong	0	
	stream_changed_pending_lock	GMutex *	0x8f5ebb0	
	stream_changed_pending	GList *	{...}	
	selector	GstSourceSelect [3]	0x9701e78	

*(group->playbin)	GstPlayBin	{...}	
	parent	GstPipeline	{...}	
	lock	GStaticRecMutex	{...}	
	groups	GstSourceGroup [2]	0x9701dfc	
		groups[0]	GstSourceGroup	{...}	
			playbin	GstPlayBin *	0x9701cf8 [GstPlayBin2]	
			lock	GMutex *	0x9166cb0	
			valid	gboolean	0	
			active	gboolean	0	
			uri	gchar *	0x9c657e8 "file:///home/thomas/Musik/Tom%20Waits/Bad%20As%20Me%20(Deluxe%20Version)/02%20Raised%20Right%20Men.mp3"	
			suburi	gchar *	0x0	
			streaminfo	GValueArray *	0x0	
			source	GstElement *	0x0	
			video_channels	GPtrArray *	0xeace07c8	
			audio_channels	GPtrArray *	0xeace0780	
			text_channels	GPtrArray *	0xeace0798	
			audio_sink	GstElement *	0x0	
			video_sink	GstElement *	0x0	
			uridecodebin	GstElement *	0x0	
			suburidecodebin	GstElement *	0x0	
			pending	gint	0	
			sub_pending	gboolean	0	
			pad_added_id	gulong	0	
			pad_removed_id	gulong	0	
			no_more_pads_id	gulong	0	
			notify_source_id	gulong	0	
			drained_id	gulong	0	
			autoplug_factories_id	gulong	0	
			autoplug_select_id	gulong	0	
			autoplug_continue_id	gulong	0	
			sub_pad_added_id	gulong	0	
			sub_pad_removed_id	gulong	0	
			sub_no_more_pads_id	gulong	0	
			sub_autoplug_continue_id	gulong	0	
			stream_changed_pending_lock	GMutex *	0x8f5ebb0	
			stream_changed_pending	GList *	{...}	
			selector	GstSourceSelect [3]	0x9701e78	
		groups[1]	GstSourceGroup	{...}	
			playbin	GstPlayBin *	0x9701cf8 [GstPlayBin2]	
			lock	GMutex *	0x91f80e0	
			valid	gboolean	1	
			active	gboolean	1	
			uri	gchar *	0x9a423a8 "file:///home/thomas/Musik/Eminem/Relapse/11%20Paul.mp3"	
			suburi	gchar *	0x0	
			streaminfo	GValueArray *	0x0	
			source	GstElement *	0x0	
			video_channels	GPtrArray *	0xeace04c0	
			audio_channels	GPtrArray *	0xeace0708	
			text_channels	GPtrArray *	0xeace0490	
			audio_sink	GstElement *	0x9714838 [GstBin]	
			video_sink	GstElement *	0x96a4830 [GstFakeSink]	
			uridecodebin	GstElement *	0x8634950 [GstURIDecodeBin]	
			suburidecodebin	GstElement *	0x0	
			pending	gint	0	
			sub_pending	gboolean	0	
			pad_added_id	gulong	10376	
			pad_removed_id	gulong	10377	
			no_more_pads_id	gulong	10378	
			notify_source_id	gulong	10379	
			drained_id	gulong	10380	
			autoplug_factories_id	gulong	10381	
			autoplug_select_id	gulong	10382	
			autoplug_continue_id	gulong	10383	
			sub_pad_added_id	gulong	0	
			sub_pad_removed_id	gulong	0	
			sub_no_more_pads_id	gulong	0	
			sub_autoplug_continue_id	gulong	0	
			stream_changed_pending_lock	GMutex *	0x96fbc58	
			stream_changed_pending	GList *	{...}	
			selector	GstSourceSelect [3]	0x9701fb4	
	curr_group	GstSourceGroup *	0x9701f38	
	next_group	GstSourceGroup *	0x9701dfc	
	connection_speed	guint	0	
	current_video	gint	-1	
	current_audio	gint	0	
	current_text	gint	-1	
	buffer_duration	guint64	18446744073709551615	
	buffer_size	guint	4294967295	
	playsink	GstPlaySink *	0x96a2020 [GstPlaySink]	
	source	GstElement *	0x9872518 [GstFileSrc]	
	dyn_lock	GMutex *	0x8cf6ab8	
	shutdown	gint	0	
	elements_lock	GMutex *	0x92bc2d8	
	elements_cookie	guint32	1013	
	elements	GList *	{...}	
	have_selector	gboolean	1	
	audio_sink	GstElement *	0x9714838 [GstBin]	
	video_sink	GstElement *	0x96a4830 [GstFakeSink]	
	text_sink	GstElement *	0x0	
	duration	struct {...} [5]	0x97020c4	
	ring_buffer_max_size	guint64	0	

*uridecodebin	struct _GstURIDecodeBin	{...}	
	parent_instance	GstBin	{...}	
	lock	GMutex *	0x96e39e0	
	factories_lock	GMutex *	0x90124a8	
	factories_cookie	guint32	0	
	factories	GList *	{...}	
	uri	gchar *	0x9a3e020 "file:///home/thomas/Musik/Walter%20Moers%20-%20Die%2013%20%C2%BD%20Leben%20des%20K%C3%A4pt%C2%B4n%20Blaub%C3%A4r%20(H%C3%B6rbuch)/CD14/02%20-%2012.%20Mein%20Leben%20in%20Atlantis%20-%20Zweifel.mp3"	
	connection_speed	guint	0	
	caps	GstCaps *	0xea2a8b40	
	encoding	gchar *	0x0	
	is_stream	gboolean	0	
	is_download	gboolean	0	
	need_queue	gboolean	0	
	buffer_duration	guint64	18446744073709551615	
	buffer_size	guint	4294967295	
	download	gboolean	0	
	use_buffering	gboolean	0	
	source	GstElement *	0x9872720 [GstFileSrc]	-> Is filled correctly
	queue	GstElement *	0x0	
	typefind	GstElement *	0x0	
	have_type_id	guint	0	
	decodebins	GSList *	{...}	
	pending_decodebins	GSList *	{...}	
	streams	GHashTable *	{...}	
	numpads	gint	6	
	src_np_sig_id	guint	0	
	src_nmp_sig_id	guint	0	
	pending	gint	0	
	async_pending	gboolean	0	
	expose_allstreams	gboolean	1	
	ring_buffer_max_size	guint64	0	



somehow the group->uridecodebin gets out of sync with the uridecodebin object?!



*(uridecodebin->source) -> gdb don't want to map this for some unknown reason...
-> but this works:
*(0x9872720)	struct _GstFileSrc	{...}	
	element	GstBaseSrc	{...}	
	pagesize	guint	4096	
	filename	gchar *	0x995c468 "/home/thomas/Musik/Walter Moers - Die 13 \302\275 Leben des K\303\244pt\302\264n Blaub\303\244r (H\303\266rbuch)/CD14/02 - 12. Mein Leben in Atlantis - Zweifel.mp3"	
	uri	gchar *	0x9a5ff20 "file:///home/thomas/Musik/Walter%20Moers%20-%20Die%2013%20%C2%BD%20Leben%20des%20K%C3%A4pt%C2%B4n%20Blaub%C3%A4r%20(H%C3%B6rbuch)/CD14/02%20-%2012.%20Mein%20Leben%20in%20Atlantis%20-%20Zweifel.mp3"	
	fd	gint	0	
	read_position	guint64	0	
	touch	gboolean	1	
	using_mmap	gboolean	0	
	sequential	gboolean	0	
	seekable	gboolean	0	
	is_regular	gboolean	0	
	mapbuf	GstBuffer *	0x0	
	mapsize	size_t	4194304	
	use_mmap	gboolean	0	


the crash seems to happen excatly two seconds before switching to a new song. the rhyhtmbox player hangs at two seconds before a songs finishes. when you then press next in rhythmbox this crash happens.

I want this bug to get fixed as it makes rhythmbox nearly unusable. I'm not sure if this is a playbin2 or rhythmbox bug.

see also the attachment.
Comment 1 Thomas Meyer 2012-02-18 10:19:24 UTC
Hello,

I think above crash is a consecutive crash resulting from this stack trace:

Thread [1] 16033 [core: 0] (Suspended : Signal : SIGINT:Interrupt)	
	__kernel_vsyscall() at 0xf771b430	
	raise() at 0x43ed5b4e	
	rb_debug_stop_in_debugger() at rb-debug.c:282 0x41554149	
	log_handler() at rb-debug.c:299 0x415541b5	
	g_logv() at gmessages.c:545 0x4753726f	
	g_log() at gmessages.c:591 0x475375e4	
	g_return_if_fail_warning() at gmessages.c:600 0x4753784e	
	g_str_has_prefix() at gstrfuncs.c:2.944 0x4754fe1a	
	set_source_properties() at rb-audiocd-plugin.c:107 0xef4d84f5	
	rb_audiocd_plugin_prepare_player_source_cb() at rb-audiocd-plugin.c:140 0xef4d84f5	
	rb_marshal_VOID__STRING_OBJECT() at rb-marshal.c:2.253 0x41564cd2	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.003 0x473462ff	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	source_notify_cb() at rb-player-gst.c:618 0x41551687	
	g_cclosure_marshal_VOID__PARAM() at gmarshal.c:539 0x4732c5cb	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.003 0x473462ff	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	g_object_dispatch_properties_changed() at gobject.c:925 0x4732d837	
	gst_object_dispatch_properties_changed() at gstobject.c:530 0xf753af92	
	g_object_notify_dispatcher() at gobject.c:331 0x4732ccb0	
	g_object_notify_queue_thaw() at gobjectnotifyqueue.c:132 0x4732fa62	
	g_object_notify_by_spec_internal() at gobject.c:983 0x4732fa62	
	g_object_notify() at gobject.c:1.024 0x4732fa62	
	notify_source_cb() at gstplaybin2.c:3.451 0xef1ca938	
	g_cclosure_marshal_VOID__PARAM() at gmarshal.c:539 0x4732c5cb	
	g_closure_invoke() at gclosure.c:774 0x4732a645	
	signal_emit_unlocked_R() at gsignal.c:3.272 0x4733d860	
	g_signal_emit_valist() at gsignal.c:3.003 0x473462ff	
	g_signal_emit() at gsignal.c:3.060 0x47346464	
	g_object_dispatch_properties_changed() at gobject.c:925 0x4732d837	
	gst_object_dispatch_properties_changed() at gstobject.c:530 0xf753af92	
	g_object_notify_dispatcher() at gobject.c:331 0x4732ccb0	
	g_object_notify_queue_thaw() at gobjectnotifyqueue.c:132 0x4732fa62	
	g_object_notify_by_spec_internal() at gobject.c:983 0x4732fa62	
	g_object_notify() at gobject.c:1.024 0x4732fa62	
	setup_source() at gsturidecodebin.c:2.015 0xeef29c4a	
	gst_uri_decode_bin_change_state() at gsturidecodebin.c:2.493 0xeef29c4a	
	gst_element_change_state() at gstelement.c:2.761 0xf7558a9b	
	gst_element_set_state_func() at gstelement.c:2.717 0xf75594c5	
	gst_element_set_state() at gstelement.c:2.618 0xf75587d1	
	gst_bin_element_set_state() at gstbin.c:2.209 0xf7543c0e	
	gst_bin_change_state_func() at gstbin.c:2.518 0xf7543c0e	
	gst_pipeline_change_state() at gstpipeline.c:482 0xf757c2fa	
	gst_play_bin_change_state() at gstplaybin2.c:3.942 0xef1ccd99	
	gst_element_change_state() at gstelement.c:2.761 0xf7558a9b	
	gst_element_set_state_func() at gstelement.c:2.717 0xf75594c5	
	gst_element_set_state() at gstelement.c:2.618 0xf75587d1	
	start_state_change() at rb-player-gst.c:382 0x41552092	
	impl_close() at rb-player-gst.c:761 0x41552f56	
	rb_player_close() at rb-player.c:398 0x41543344	
	bus_cb() at rb-player-gst.c:509 0x4155265a	
	gst_bus_source_dispatch() at gstbus.c:764 0xf7548587	
	g_main_dispatch() at gmain.c:2.441 0x4752e62f	
	g_main_context_dispatch() at gmain.c:3.011 0x4752e62f	
	g_main_context_iterate() at gmain.c:3.089 0x4752ed70	
	g_main_loop_run() at gmain.c:3.297 0x4752f3a7	
	gtk_main() at gtkmain.c:1.362 0x41159155	
	main() at main.c:324 0x804a2e4	

I think this is happening:

bus_cb(): receives an error and try to close the player:

		/* close if not already closing */
		if (mp->priv->uri != NULL)
->			rb_player_close (RB_PLAYER (mp), NULL, NULL);

this will lead to a call to impl_close() that will set the player uri to NULL:
	mp->priv->uri = NULL;
	mp->priv->prev_uri = NULL;

and will call this state change
	if (mp->priv->playbin != NULL) {
->		start_state_change (mp, GST_STATE_NULL, PLAYER_SHUTDOWN);
	}

the state change will trigger gst_uri_decode_bin_change_state():

  switch (transition) {
    case GST_STATE_CHANGE_READY_TO_PAUSED:
->   if (!setup_source (decoder))
        goto source_failed;
      break;
    default:
      break;
  }

that method changes the current source via setup_source():
    /* notify of the new source used */
->  g_object_notify (G_OBJECT (decoder), "source");

this will notify notify_source_cb() in playbin2:
  GST_OBJECT_LOCK (playbin);
  if (playbin->source)
    gst_object_unref (playbin->source);
  playbin->source = source;
  GST_OBJECT_UNLOCK (playbin);

->  g_object_notify (G_OBJECT (playbin), "source");

playbin2 wants to notify all(?) dependent object of the source change in source_notify_cb():

static void
source_notify_cb (GObject *object, GParamSpec *pspec, RBPlayerGst *player)
{
	GstElement *source;
	g_object_get (object, "source", &source, NULL);

->	g_signal_emit (player, signals[PREPARE_SOURCE], 0, player->priv->uri, source);

remember player->priv->uri was set to NULL in impl_close()!

the next object that is triggered is rb_audiocd_plugin_prepare_player_source_cb():

rb_audiocd_plugin_prepare_player_source_cb (RBPlayer *player,
					    const char *stream_uri,
					    GstElement *source,
					    RBAudioCdPlugin *plugin)
{
->	set_source_properties (source, stream_uri, TRUE);
}

set_source_properties() will call 

set_source_properties (GstElement *source, const char *uri, gboolean playback_mode)
{
	const char *device;

->	if (g_str_has_prefix (uri, "cdda://") == FALSE)
		return;

which will trigger this asserion:

g_str_has_prefix (const gchar  *str,
                  const gchar  *prefix)
{
  int str_len;
  int prefix_len;

->  g_return_val_if_fail (str != NULL, FALSE);

after that the rhythmbox application hangs, two seconds before the end of the song. when I now double click on "all artist/songs" again the first crash reported in this bug is triggered.
Comment 2 Tim-Philipp Müller 2012-02-18 11:12:27 UTC
Thomas - this sounds like the bug is in rhythmbox then? (doing g_str_has_prefix() on a NULL uri)


> bus_cb(): receives an error and try to close the player:
> this will lead to a call to impl_close() that will set the player uri to NULL:
> and will call this state change
>     if (mp->priv->playbin != NULL) {
> ->        start_state_change (mp, GST_STATE_NULL, PLAYER_SHUTDOWN);
>     }
> 
> the state change will trigger gst_uri_decode_bin_change_state():
> 
>   switch (transition) {
>     case GST_STATE_CHANGE_READY_TO_PAUSED:
> ->   if (!setup_source (decoder))
>         goto source_failed;
>       break;
>     default:
>       break;
>   }

This doesn't seem right - why does shutting down the pipeline lead to an *upwards* state change? it should be PAUSED_TO_READY or READY_TO_NULL.
Comment 3 Thomas Meyer 2012-02-19 14:33:51 UTC
I'm not sure yet where the bug is... when removing the audiocd plugin, which triggers the assertion error, rhythmbox just hangs two seconds before the song ends. no assertion, nothing. It just get's stuck. pressing pause, play, or dobule-clicking an different song doesn't do anything! i'm not sure how to debug this error. stack trace of all threads in this "hung" state is:

/usr/bin/rhythmbox [4982] [cores: 0]	
	Thread [5] 5134 [core: 0] (Suspended : Container)	
		__kernel_vsyscall() at 0xf777e430	
		poll() at 0x43df9fb0	
		g_poll() at gpoll.c:132 0x4753d83c	
		g_main_context_poll() at gmain.c:3.402 0x4752ec76	
		g_main_context_iterate() at gmain.c:3.084 0x4752ec76	
		g_main_loop_run() at gmain.c:3.297 0x4752f3a7	
		0xf748f235	
		g_thread_create_proxy() at gthread.c:1.962 0x47555f45	
		start_thread() at 0x43ecdcd3	
		clone() at 0x43e0483e	
	Thread [4] 5135 [core: 0] (Suspended : Container)	
		__kernel_vsyscall() at 0xf777e430	
		poll() at 0x43df9fb0	
		g_poll() at gpoll.c:132 0x4753d83c	
		g_main_context_poll() at gmain.c:3.402 0x4752ec76	
		g_main_context_iterate() at gmain.c:3.084 0x4752ec76	
		g_main_loop_run() at gmain.c:3.297 0x4752f3a7	
		gdbus_shared_thread_func() at gdbusprivate.c:276 0x4f90b74b	
		g_thread_create_proxy() at gthread.c:1.962 0x47555f45	
		start_thread() at 0x43ecdcd3	
		clone() at 0x43e0483e	
	Thread [3] 5201 [core: 0] (Suspended : Container)	
		__kernel_vsyscall() at 0xf777e430	
		pthread_cond_wait@@GLIBC_2.3.2() at 0x43ed185c	
		g_async_queue_pop_intern_unlocked() at gasyncqueue.c:408 0x47500630	
		g_async_queue_pop() at gasyncqueue.c:447 0x47500d1f	
		action_thread_main() at rhythmdb.c:2.841 0x44d6a3af	
		g_thread_create_proxy() at gthread.c:1.962 0x47555f45	
		start_thread() at 0x43ecdcd3	
		clone() at 0x43e0483e	
	Thread [1] 4982 [core: 0] (Suspended : Signal : SIGINT:Interrupt)	
		__kernel_vsyscall() at 0xf777e430	
		poll() at 0x43df9fb0	
		g_poll() at gpoll.c:132 0x4753d83c	
		g_main_context_poll() at gmain.c:3.402 0x4752ec76	
		g_main_context_iterate() at gmain.c:3.084 0x4752ec76	
		g_main_loop_run() at gmain.c:3.297 0x4752f3a7	
		gtk_main() at gtkmain.c:1.362 0x41159155	
		main() at main.c:324 0x804a2e4	

but this isn't helpful at all as each threads just wait for some events...
do you have any idea how to obtain the address of the playbin2 "object"? do you have an advice where to set break points to investigate what's going on here?
Comment 4 Thomas Meyer 2012-02-20 20:29:39 UTC
This is the path from the main() method of rhythmbox:

*(rb_shell->priv->player_shell->priv->mmplayer)	struct _RBPlayerGst	{...}	
	obj	GObject	{...}	
	priv	RBPlayerGstPrivate *	0x98c6418	
		prev_uri	char *	0x0	
		uri	char *	0x0	
		stream_data	gpointer	0x0	
		stream_data_destroy	GDestroyNotify	0	
		next_stream_data	gpointer	0x0	
		next_stream_data_destroy	GDestroyNotify	0	
		playbin	GstElement *	0xaba7918 [GstPlayBin2]	
		audio_sink	GstElement *	0x9a4ecf0 [GstGSettingsAudioSink]	
		state_change_action	enum StateChangeAction	DO_NOTHING	
		playing	gboolean	0	
		buffering	gboolean	0	
		stream_change_pending	gboolean	0	
		current_track_finishing	gboolean	0	
		playbin_stream_changing	gboolean	1	
		track_change	gboolean	1	
		emitted_error	gboolean	1	
		stream_tags	GList *	{...}	
			[0]	gpointer	0xaa08800	
			[1]	gpointer	0xa0bae48	
			[2]	gpointer	0xaeab368	
			[3]	gpointer	0xab4b130	
			[4]	gpointer	0xa91f2c0	
			[5]	gpointer	0xa91f108	
			[6]	gpointer	0xa9cd750	
		volume_changed	gint	1	
		volume_applied	gint	1	
		cur_volume	float	1	
		tick_timeout_id	guint	0	
		waiting_tees	GList *	{...}	
		sinkbin	GstElement *	0xaa7fac8 [GstBin]	
		tee	GstElement *	0xa520c48 [GstTee]	
		waiting_filters	GList *	{...}	
		filterbin	GstElement *	0xaa7f858 [GstBin]	

You need to cast the RBPlayer "object" to an RBPlayerGst object. a "sub class"!
Comment 5 Thomas Meyer 2012-02-20 20:57:15 UTC
Next segfault i'm hitting:

Thread [1] 4982 [core: 0] (Suspended : Signal : SIGSEGV:Segmentation fault)	
	0x0	
	rhythmdb_entry_update_availability() at rhythmdb-entry-type.c:125 0x44d7e8ce	
	do_next_not_found_idle() at rb-shell-player.c:3.410 0x44d0e175	
	g_idle_dispatch() at gmain.c:4.801 0x4752a471	
	g_main_dispatch() at gmain.c:2.441 0x4752e62f	
	g_main_context_dispatch() at gmain.c:3.011 0x4752e62f	
	g_main_context_iterate() at gmain.c:3.089 0x4752ed70	
	g_main_loop_run() at gmain.c:3.297 0x4752f3a7	
	gtk_main() at gtkmain.c:1.362 0x41159155	
	main() at main.c:324 0x804a2e4
Comment 6 Milan Bouchet-Valat 2012-02-23 12:56:13 UTC
*** Bug 660001 has been marked as a duplicate of this bug. ***
Comment 7 Thomas Meyer 2012-02-24 18:39:17 UTC
this seems to be a rhythmbox bug. When recompiling rhythmbox version 2.90.1 (i.e. the current Fedora 16 version) with -O0 the rhythmbox doesn't seem to hang anymore. same for 2.95.

For gst-plugins-base and gstreamer I'm using the plain version of Fedora 16.

any ideas?
Comment 8 Thomas Meyer 2012-02-25 11:34:53 UTC
Opps! Sorry! Rhythmbox still hangs with -O0. Sorry for the noise.
Comment 9 Tim-Philipp Müller 2012-03-14 14:15:43 UTC
Have you tried running it in valgrind ? 

   $ G_SLICE=always-malloc rhythmbox 2>&1 | tee valgrind.log

Perhaps it shows something interesting?
Comment 10 Tim-Philipp Müller 2012-03-14 14:19:34 UTC
Perhaps it should be moved to rhythmbox for now? After all it crashes when accessing memory managed by rhythmbox, if I understand the previous comments correctly.
Comment 11 Milan Bouchet-Valat 2012-03-14 14:35:48 UTC
(In reply to comment #9)
> Have you tried running it in valgrind ? 
> 
>    $ G_SLICE=always-malloc rhythmbox 2>&1 | tee valgrind.log
I guess you meant
G_SLICE=always-malloc valgrind --tool=memcheck rhythmbox 2>&1 | tee valgrind.log
Comment 12 Tim-Philipp Müller 2012-03-14 14:45:12 UTC
Yes, I did, sorry.
Comment 13 Jonathan Matthew 2012-04-21 13:31:10 UTC
*** Bug 674477 has been marked as a duplicate of this bug. ***
Comment 14 Jonathan Matthew 2012-04-21 14:35:17 UTC
Finally looking at this a bit, it appears that after an error, the uridecodebin for the failed stream doesn't get removed from playbin2, so it gets included in the state change to PAUSED for the next track, which causes it to produce more errors, so playback stops working.  I'm not seeing any crashes though.
Comment 15 André Klapper 2012-04-21 15:03:34 UTC
Created attachment 212508 [details]
valgrind log

With "G_SLICE=always-malloc valgrind --tool=memcheck rhythmbox 2>&1 | tee
valgrind.log" and the steps in my dup report bug 674477 it does not hang or crash initially.
Instead Rhythmbox seems to iterate on every remaining song in my music library list and fails for each of them.
After watching this for a while I clicked the last song to stop this behavior. After rhythmbox had recognized that it cannot play that song, I clicked the last but one song. Rhythmbox finally crashed.
Comment 16 Thomas Meyer 2012-04-21 15:28:59 UTC
I switch from rhythmbox 2.90.1 (Fedora 16) to 2.95 (3a5b74ee288e52255ee3786f89e389289c22d756) and had not any crash/hang since then. for gstreamer and playbin2 I still use the plain Fedora 16 versions. So this bug must be part of rhythmbox. But I don't care anymore since 2.95 runs fine.
Comment 17 André Klapper 2012-04-21 17:34:02 UTC
Created attachment 212515 [details]
second valgrind log (with --leak-check=full --track-origins=yes), part 1 of 2

Part 1 of results for "G_SLICE=always-malloc valgrind --tool=memcheck --leak-check=full --track-origins=yes rhythmbox 2>&1 | tee valgrind2.log" while *trying* to follow the same steps from comment 15 (at first didn't succeed at the end of the music library list, so I had to change the sort order and try again).
Comment 18 André Klapper 2012-04-21 17:35:01 UTC
Created attachment 212516 [details]
second valgrind log (with --leak-check=full --track-origins=yes), part 2 of 2

Second part, as Bugzilla has a file size limit of 1MB.
Comment 19 Jonathan Matthew 2012-04-22 00:35:29 UTC
gstplaybin2.c:activate_group will add a uridecodebin to playbin, but if its state change fails, we exit the function with group->active set to FALSE and the uridecodebin still in the pipeline.  All of the paths that call deactivate_group check that group->active is TRUE first, so the uridecodebin doesn't get removed.  With that uridecodebin still in the pipeline, attempts at starting playback fail because it won't change to PAUSED.

Is this something I'm supposed to deal with?  If so, how?
Comment 20 André Klapper 2012-05-21 14:34:16 UTC
*** Bug 676501 has been marked as a duplicate of this bug. ***
Comment 21 André Klapper 2012-05-21 14:35:13 UTC
Any gstreamer dev around to answer comment 19? Tim maybe?
Comment 22 Sebastian Dröge (slomo) 2012-05-22 12:35:32 UTC
(In reply to comment #19)
> gstplaybin2.c:activate_group will add a uridecodebin to playbin, but if its
> state change fails, we exit the function with group->active set to FALSE and
> the uridecodebin still in the pipeline.  All of the paths that call
> deactivate_group check that group->active is TRUE first, so the uridecodebin
> doesn't get removed.  With that uridecodebin still in the pipeline, attempts at
> starting playback fail because it won't change to PAUSED.
> 
> Is this something I'm supposed to deal with?  If so, how?

No, this looks like a bug in playbin. Thanks for analyzing. Do you want to provide a patch? playbin should probably remove the uridecodebin immediately if something goes wrong before it sets group->active=TRUE.
Comment 23 Jonathan Matthew 2012-06-17 09:21:47 UTC
This was a duplicate of bug 673888, works fine with current 0.10 branch.

*** This bug has been marked as a duplicate of bug 673888 ***
Comment 24 Milan Bouchet-Valat 2012-06-17 10:22:32 UTC
Great!

I can confirm I did not see this problem on Fedora 17.