Created attachment 254155 [details] [review]
patch to fix

If a pad is removed while a collectpads element (say adder) is in a chain function waiting to be collected, there is a possibility that an unref happens on a NULL pointer.

The code below shows the pad_removed label would only be gone to when data is NULL:

    if (G_UNLIKELY ((data = gst_pad_get_element_private (pad)) == NULL))
      goto pad_removed;

Yet in pad_removed, it does a goto unlock_done:

pad_removed:
  {
    GST_WARNING ("%s got removed from collectpads", GST_OBJECT_NAME (pad));
    GST_OBJECT_UNLOCK (pad);
    ret = GST_FLOW_NOT_LINKED;
    goto unlock_done;
  }

And in unlock_done, unref_data is done on data, which in this case is guaranteed to be NULL.