After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 709734 - speed: Crashes when using more than one audio channel
speed: Crashes when using more than one audio channel
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: common
1.0.10
Other Linux
: Normal normal
: 1.2.1
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2013-10-09 14:12 UTC by Dan Vrátil
Modified: 2013-10-10 10:38 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Dan Vrátil 2013-10-09 14:12:09 UTC 
I get a crash in my application which uses GStreamer backend when I start playing a track with the "speed" effect enabled.

The value was set to 1.0, but apparently it crashes with any settings. Disabling the effect solves the problem.


Backtrace:
(gdb) bt

+ Trace 232593

  • #0 __GI_raise
    at ../nptl/sysdeps/unix/sysv/linux/raise.c line 56
  • #1 __GI_abort
    at abort.c line 90
  • #2 __libc_message
    at ../sysdeps/unix/sysv/linux/libc_fatal.c line 196
  • #3 malloc_printerr
  • #4 _int_free
    at malloc.c line 3789
  • #5 g_free
    at gmem.c line 252
  • #6 g_value_unset
    at gvalue.c line 274
  • #7 gst_value_intersect_list
    at gstvalue.c line 3505
  • #8 gst_structure_intersect_field1
    at gststructure.c line 3025
  • #9 gst_structure_foreach
    at gststructure.c line 1122
  • #10 gst_structure_intersect
    at gststructure.c line 3072
  • #11 gst_caps_intersect_first
    at gstcaps.c line 1268
  • #12 gst_caps_intersect_full
    at gstcaps.c line 1298
  • #13 gst_base_transform_query_caps
    at gstbasetransform.c line 724
  • #14 gst_base_transform_default_query
    at gstbasetransform.c line 1487
  • #15 gst_pad_query
    at gstpad.c line 3419
  • #16 gst_pad_peer_query
    at gstpad.c line 3550
  • #17 gst_pad_peer_query_caps
    at gstutils.c line 2811
  • #18 gst_base_transform_query_caps
    at gstbasetransform.c line 696
  • #19 gst_base_transform_default_query
    at gstbasetransform.c line 1487
  • #20 gst_pad_query
    at gstpad.c line 3419
  • #21 gst_pad_peer_query
    at gstpad.c line 3550
  • #22 gst_pad_peer_query_caps
    at gstutils.c line 2811
  • #23 gst_base_transform_query_caps
    at gstbasetransform.c line 696
  • #24 gst_base_transform_default_query
    at gstbasetransform.c line 1487
  • #25 gst_pad_query
    at gstpad.c line 3419
  • #26 gst_pad_peer_query
    at gstpad.c line 3550
  • #27 query_caps_func
    at gstutils.c line 2481
  • #28 gst_pad_forward
    at gstpad.c line 2674
  • #29 gst_pad_proxy_query_caps
    at gstutils.c line 2531
  • #30 gst_pad_query_caps_default
    at gstpad.c line 2838
  • #31 gst_pad_query_default
    at gstpad.c line 2949
  • #32 gst_pad_query
    at gstpad.c line 3419
  • #33 gst_pad_peer_query
    at gstpad.c line 3550
  • #34 query_caps_func
    at gstutils.c line 2481
  • #35 gst_pad_forward
    at gstpad.c line 2674
  • #36 gst_pad_proxy_query_caps
    at gstutils.c line 2531
  • #37 gst_pad_query_caps_default
    at gstpad.c line 2838
  • #38 gst_pad_query_default
    at gstpad.c line 2949
  • #39 gst_pad_query
    at gstpad.c line 3419
  • #40 gst_pad_peer_query
    at gstpad.c line 3550
  • #41 query_caps_func
    at gstutils.c line 2481
  • #42 gst_pad_forward
    at gstpad.c line 2674
  • #43 gst_pad_proxy_query_caps
    at gstutils.c line 2531
  • #44 gst_pad_query_caps_default
    at gstpad.c line 2838
  • #45 gst_pad_query_default
    at gstpad.c line 2949
  • #46 gst_pad_query
    at gstpad.c line 3419
  • #47 gst_pad_peer_query
    at gstpad.c line 3550
  • #48 query_caps_func
    at gstutils.c line 2481
  • #49 gst_pad_forward
    at gstpad.c line 2674
  • #50 gst_pad_proxy_query_caps
    at gstutils.c line 2531
  • #51 gst_pad_query_caps_default
    at gstpad.c line 2838
  • #52 gst_pad_query_default
    at gstpad.c line 2949
  • #53 gst_pad_query
    at gstpad.c line 3419
  • #54 gst_pad_peer_query
    at gstpad.c line 3550
  • #55 query_caps_func
    at gstutils.c line 2481
  • #56 gst_pad_forward
    at gstpad.c line 2674
  • #57 gst_pad_proxy_query_caps
    at gstutils.c line 2531
  • #58 gst_pad_query_caps_default
    at gstpad.c line 2838
  • #59 gst_pad_query_default
    at gstpad.c line 2949
  • #60 gst_pad_query
    at gstpad.c line 3419
  • #61 gst_pad_peer_query
    at gstpad.c line 3550
  • #62 gst_pad_peer_query_caps
    at gstutils.c line 2811
  • #63 gst_base_transform_query_caps
    at gstbasetransform.c line 696
  • #64 gst_base_transform_default_query
    at gstbasetransform.c line 1487
  • #65 gst_pad_query
    at gstpad.c line 3419
  • #66 gst_pad_query_caps
    at gstutils.c line 2765
  • #67 gst_base_transform_acceptcaps_default
    at gstbasetransform.c line 1242
  • #68 gst_base_transform_default_query
    at gstbasetransform.c line 1475
  • #69 gst_pad_query
    at gstpad.c line 3419
  • #70 gst_pad_query_accept_caps
    at gstutils.c line 2848
  • #71 pre_eventfunc_check
    at gstpad.c line 4701
  • #72 gst_pad_send_event_unchecked
    at gstpad.c line 4815
  • #73 gst_pad_push_event_unchecked
    at gstpad.c line 4515
  • #74 push_sticky
    at gstpad.c line 3286
  • #75 events_foreach
    at gstpad.c line 514
  • #76 check_sticky
    at gstpad.c line 3334
  • #77 gst_pad_push_event
    at gstpad.c line 4636
  • #78 gst_queue_push_one
    at gstqueue.c line 1105
  • #79 gst_queue_loop
    at gstqueue.c line 1170
  • #80 gst_task_func
    at gsttask.c line 316
  • #81 g_thread_pool_thread_proxy
    at gthreadpool.c line 309
  • #82 g_thread_proxy
    at gthread.c line 798
  • #83 start_thread
    at pthread_create.c line 308
  • #84 clone
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 113 


Valgrind:
==14860== Thread 15:
==14860== Invalid read of size 4
==14860==    at 0x35C5813450: orc_code_region_allocate_codemem_dual_map (orccodemem.c:219)
==14860==    by 0x35C58136C1: orc_code_region_allocate_codemem (orccodemem.c:293)
==14860==    by 0x35C5813764: orc_code_region_new (orccodemem.c:64)
==14860==    by 0x35C5813820: orc_code_region_get_free_chunk (orccodemem.c:136)
==14860==    by 0x35C58138CA: orc_code_allocate_codemem (orccodemem.c:160)
==14860==    by 0x35C581712A: orc_program_compile_full (orccompiler.c:341)
==14860==    by 0x1A5D05C4: audio_convert_orc_pack_s32_float (tmp-orc.c:4737)
==14860==    by 0x1A5C5A7F: audio_convert_convert (audioconvert.c:807)
==14860==    by 0x1A5C3461: gst_audio_convert_transform (gstaudioconvert.c:813)
==14860==    by 0x35ADE313C6: gst_base_transform_handle_buffer (gstbasetransform.c:2069)
==14860==    by 0x35ADE31C20: gst_base_transform_chain (gstbasetransform.c:2176)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==  Address 0x131fba60 is 16 bytes inside a block of size 19 alloc'd
==14860==    at 0x4A06409: malloc (vg_replace_malloc.c:270)
==14860==    by 0x35C58133D8: orc_code_region_allocate_codemem_dual_map (orccodemem.c:204)
==14860==    by 0x35C58136C1: orc_code_region_allocate_codemem (orccodemem.c:293)
==14860==    by 0x35C5813764: orc_code_region_new (orccodemem.c:64)
==14860==    by 0x35C5813820: orc_code_region_get_free_chunk (orccodemem.c:136)
==14860==    by 0x35C58138CA: orc_code_allocate_codemem (orccodemem.c:160)
==14860==    by 0x35C581712A: orc_program_compile_full (orccompiler.c:341)
==14860==    by 0x1A5D05C4: audio_convert_orc_pack_s32_float (tmp-orc.c:4737)
==14860==    by 0x1A5C5A7F: audio_convert_convert (audioconvert.c:807)
==14860==    by 0x1A5C3461: gst_audio_convert_transform (gstaudioconvert.c:813)
==14860==    by 0x35ADE313C6: gst_base_transform_handle_buffer (gstbasetransform.c:2069)
==14860==    by 0x35ADE31C20: gst_base_transform_chain (gstbasetransform.c:2176)
==14860== 
==14860== Invalid read of size 4
==14860==    at 0x1A7DA147: speed_chain (gstspeed.c:488)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x35ADE31E2A: gst_base_transform_chain (gstbasetransform.c:2212)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x1EA040DA: gst_queue_loop (gstqueue.c:1054)
==14860==    by 0x35ADA879D8: gst_task_func (gsttask.c:316)
==14860==    by 0x35A086CB45: g_thread_pool_thread_proxy (gthreadpool.c:309)
==14860==    by 0x35A086C184: g_thread_proxy (gthread.c:798)
==14860==    by 0x359E807C52: start_thread (pthread_create.c:308)
==14860==    by 0x359DCF5E1C: clone (clone.S:113)
==14860==  Address 0x282ca808 is 1 bytes after a block of size 9,367 alloc'd
==14860==    at 0x4A06409: malloc (vg_replace_malloc.c:270)
==14860==    by 0x35A084D89E: g_malloc (gmem.c:159)
==14860==    by 0x35A086344D: g_slice_alloc (gslice.c:1003)
==14860==    by 0x35ADA2A11C: _default_mem_new_block (gstallocator.c:410)
==14860==    by 0x35ADA33401: gst_buffer_new_allocate (gstbuffer.c:621)
==14860==    by 0x35ADE2F7DC: default_prepare_output_buffer (gstbasetransform.c:1594)
==14860==    by 0x35ADE312DA: gst_base_transform_handle_buffer (gstbasetransform.c:2040)
==14860==    by 0x35ADE31C20: gst_base_transform_chain (gstbasetransform.c:2176)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x1EA040DA: gst_queue_loop (gstqueue.c:1054)
==14860==    by 0x35ADA879D8: gst_task_func (gsttask.c:316)
==14860==    by 0x35A086CB45: g_thread_pool_thread_proxy (gthreadpool.c:309)
==14860== 
==14860== Invalid write of size 4
==14860==    at 0x1A7DA155: speed_chain (gstspeed.c:486)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x35ADE31E2A: gst_base_transform_chain (gstbasetransform.c:2212)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x1EA040DA: gst_queue_loop (gstqueue.c:1054)
==14860==    by 0x35ADA879D8: gst_task_func (gsttask.c:316)
==14860==    by 0x35A086CB45: g_thread_pool_thread_proxy (gthreadpool.c:309)
==14860==    by 0x35A086C184: g_thread_proxy (gthread.c:798)
==14860==    by 0x359E807C52: start_thread (pthread_create.c:308)
==14860==    by 0x359DCF5E1C: clone (clone.S:113)
==14860==  Address 0x28346d78 is 1 bytes after a block of size 9,367 alloc'd
==14860==    at 0x4A06409: malloc (vg_replace_malloc.c:270)
==14860==    by 0x35A084D89E: g_malloc (gmem.c:159)
==14860==    by 0x35A086344D: g_slice_alloc (gslice.c:1003)
==14860==    by 0x35ADA2A11C: _default_mem_new_block (gstallocator.c:410)
==14860==    by 0x35ADA33401: gst_buffer_new_allocate (gstbuffer.c:621)
==14860==    by 0x1A7D9E5E: speed_chain (gstspeed.c:594)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x35ADE31E2A: gst_base_transform_chain (gstbasetransform.c:2212)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x1EA040DA: gst_queue_loop (gstqueue.c:1054)
==14860==    by 0x35ADA879D8: gst_task_func (gsttask.c:316)
==14860==    by 0x35A086CB45: g_thread_pool_thread_proxy (gthreadpool.c:309)
==14860== 
==14860== Invalid read of size 4
==14860==    at 0x1A7DA163: speed_chain (gstspeed.c:490)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x35ADE31E2A: gst_base_transform_chain (gstbasetransform.c:2212)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x1EA040DA: gst_queue_loop (gstqueue.c:1054)
==14860==    by 0x35ADA879D8: gst_task_func (gsttask.c:316)
==14860==    by 0x35A086CB45: g_thread_pool_thread_proxy (gthreadpool.c:309)
==14860==    by 0x35A086C184: g_thread_proxy (gthread.c:798)
==14860==    by 0x359E807C52: start_thread (pthread_create.c:308)
==14860==    by 0x359DCF5E1C: clone (clone.S:113)
==14860==  Address 0x282ca808 is 1 bytes after a block of size 9,367 alloc'd
==14860==    at 0x4A06409: malloc (vg_replace_malloc.c:270)
==14860==    by 0x35A084D89E: g_malloc (gmem.c:159)
==14860==    by 0x35A086344D: g_slice_alloc (gslice.c:1003)
==14860==    by 0x35ADA2A11C: _default_mem_new_block (gstallocator.c:410)
==14860==    by 0x35ADA33401: gst_buffer_new_allocate (gstbuffer.c:621)
==14860==    by 0x35ADE2F7DC: default_prepare_output_buffer (gstbasetransform.c:1594)
==14860==    by 0x35ADE312DA: gst_base_transform_handle_buffer (gstbasetransform.c:2040)
==14860==    by 0x35ADE31C20: gst_base_transform_chain (gstbasetransform.c:2176)
==14860==    by 0x35ADA5AEE9: gst_pad_push_data (gstpad.c:3655)
==14860==    by 0x1EA040DA: gst_queue_loop (gstqueue.c:1054)
==14860==    by 0x35ADA879D8: gst_task_func (gsttask.c:316)
==14860==    by 0x35A086CB45: g_thread_pool_thread_proxy (gthreadpool.c:309)
==14860==
Comment 1 Sebastian Dröge (slomo) 2013-10-09 15:01:59 UTC 
This crashes too already:
gst-launch-1.0 audiotestsrc ! audioconvert ! "audio/x-raw,format=F32LE,channels=2" ! speed speed=1.5 ! fakesink

Works with 1 channel, fails with more than 1 channel.
Comment 2 Sebastian Dröge (slomo) 2013-10-09 15:19:33 UTC 
commit f0b5d84c544a1f36e7ea9c4b7d857b8b95eac153
Author: Sebastian Dröge <slomo@circular-chaos.org>
Date:   Wed Oct 9 17:18:41 2013 +0200

    speed: Fix some bytes-per-frame vs. bytes-per-sample mixups
    
    Otherwise we will crash when handling multiple channels and
    miscalculate timestamps.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=709734