Bug 745557 – Crash when printing debug message

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 745557 - Crash when printing debug message


Summary:	Crash when printing debug message


Status:	RESOLVED INCOMPLETE

Product:	GStreamer
Classification:	Platform
Component:	dont know
Version:	unspecified
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	NONE
Assigned To:	GStreamer Maintainers
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2015-03-03 20:31 UTC by Xavier Claessens
Modified:	2016-02-22 00:19 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Xavier Claessens 2015-03-03 20:31:07 UTC

When setting debug level to 5 on android, I get this crash:

+ Trace 234772

Thread 25 (Thread 1721)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 frame_worker_thread
at libavcodec/pthread_frame.c line 133
#3 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#4 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#5 ??

Thread 24 (Thread 1720)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 frame_worker_thread
at libavcodec/pthread_frame.c line 133
#3 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#4 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#5 ??

Thread 23 (Thread 1719)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 frame_worker_thread
at libavcodec/pthread_frame.c line 133
#3 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#4 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#5 ??

Thread 22 (Thread 1718)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 ff_thread_get_buffer
at libavcodec/pthread_frame.c line 733
#3 alloc_picture
at libavcodec/h264_slice.c line 251
#4 h264_frame_start
at libavcodec/h264_slice.c line 696
#5 ff_h264_decode_slice_header
at libavcodec/h264_slice.c line 1549
#6 decode_nal_units
at libavcodec/h264.c line 1522
#7 h264_decode_frame
at libavcodec/h264.c line 1777
#8 frame_worker_thread
at libavcodec/pthread_frame.c line 145
#9 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#10 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#11 ??

Thread 21 (Thread 1713)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 g_cond_wait
at gthread-posix.c line 767
#3 gst_multi_queue_loop
at gstmultiqueue.c line 1465
#4 gst_task_func
at gsttask.c line 331
#5 g_thread_pool_thread_proxy
at gthreadpool.c line 307
#6 g_thread_proxy
at gthread.c line 764
#7 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#8 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#9 ??

Thread 20 (Thread 1711)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 g_cond_wait
at gthread-posix.c line 767
#3 gst_data_queue_push
at gstdataqueue.c line 520
#4 gst_multi_queue_chain
at gstmultiqueue.c line 1680
#5 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#6 gst_pad_push_data
at gstpad.c line 4210
#7 gst_pad_push
at gstpad.c line 4321
#8 gst_qtdemux_decorate_and_push_buffer
at qtdemux.c line 4383
#9 gst_qtdemux_process_adapter
at qtdemux.c line 5453
#10 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#11 gst_pad_push_data
at gstpad.c line 4210
#12 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#13 gst_pad_push_data
at gstpad.c line 4210
#14 gst_pad_push
at gstpad.c line 4321
#15 gst_proxy_pad_chain_default
at gstghostpad.c line 126
#16 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#17 gst_pad_push_data
at gstpad.c line 4210
#18 gst_pad_push
at gstpad.c line 4321
#19 gst_queue2_push_one
at gstqueue2.c line 2691
#20 gst_queue2_loop
at gstqueue2.c line 2797
#21 gst_task_func
at gsttask.c line 331
#22 g_thread_pool_thread_proxy
at gthreadpool.c line 307
#23 g_thread_proxy
at gthread.c line 764
#24 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#25 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#26 ??

Thread 19 (Thread 1710)

#0 sprintf
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 _g_gnulib_vasnprintf
at vasnprintf.c line 980
#2 _g_gnulib_vasprintf
at printf.c line 142
#3 g_vasprintf
at gprintf.c line 310
#4 g_strdup_vprintf
at gstrfuncs.c line 507
#5 g_strdup_printf
at gstrfuncs.c line 533
#6 gst_value_serialize_fraction_range
at gstvalue.c line 1817
#7 gst_value_serialize
at gstvalue.c line 5093
#8 priv_gst_structure_append_to_gstring
at gststructure.c line 1882
#9 gst_caps_to_string
at gstcaps.c line 2213
#10 gst_debug_print_object
at gstinfo.c line 686
#11 gst_info_printf_pointer_extension_func
at gstinfo.c line 800
#12 printf_postprocess_args
at vasnprintf.c line 248
#13 __gst_vasnprintf
at vasnprintf.c line 280
#14 __gst_vasprintf
at printf.c line 154
#15 gst_debug_message_get
at gstinfo.c line 537
#16 gst_debug_log_default
at gstinfo.c line 1036
#17 gst_debug_log_valist
at gstinfo.c line 515
#18 gst_debug_log
at gstinfo.c line 442
#19 gst_base_transform_query_caps
at gstbasetransform.c line 746
#20 gst_base_transform_default_query
at gstbasetransform.c line 1556
#21 gst_pad_query
at gstpad.c line 3731
#22 gst_pad_peer_query
at gstpad.c line 3859
#23 query_caps_func
at gstutils.c line 2552
#24 gst_pad_forward
at gstpad.c line 2822
#25 gst_pad_proxy_query_caps
at gstutils.c line 2602
#26 gst_pad_query_caps_default
at gstpad.c line 2994
#27 gst_pad_query_default
at gstpad.c line 3222
#28 gst_pad_query
at gstpad.c line 3731
#29 gst_pad_peer_query
at gstpad.c line 3859
#30 query_caps_func
at gstutils.c line 2552
#31 gst_pad_forward
at gstpad.c line 2822
#32 gst_pad_proxy_query_caps
at gstutils.c line 2602
#33 gst_pad_query_caps_default
at gstpad.c line 2994
#34 gst_pad_query_default
at gstpad.c line 3222
#35 gst_pad_query
at gstpad.c line 3731
#36 gst_pad_peer_query
at gstpad.c line 3859
#37 gst_pad_peer_query_caps
at gstutils.c line 2882
#38 gst_base_transform_query_caps
at gstbasetransform.c line 727
#39 gst_base_transform_default_query
at gstbasetransform.c line 1556
#40 gst_pad_query
at gstpad.c line 3731
#41 gst_pad_query_caps
at gstutils.c line 2836
#42 gst_base_transform_acceptcaps_default
at gstbasetransform.c line 1297
#43 gst_base_transform_default_query
at gstbasetransform.c line 1544
#44 gst_pad_query
at gstpad.c line 3731
#45 gst_pad_peer_query
at gstpad.c line 3859
#46 query_accept_caps_func
at gstutils.c line 2492
#47 gst_pad_forward
at gstpad.c line 2822
#48 gst_pad_proxy_query_accept_caps
at gstutils.c line 2532
#49 gst_pad_query_accept_caps_default
at gstpad.c line 2948
#50 gst_pad_query_default
at gstpad.c line 3218
#51 gst_pad_query
at gstpad.c line 3731
#52 gst_pad_query_accept_caps
at gstutils.c line 2919
#53 pre_eventfunc_check
at gstpad.c line 5173
#54 gst_pad_send_event_unchecked
at gstpad.c line 5289
#55 gst_pad_push_event_unchecked
at gstpad.c line 4983
#56 push_sticky
at gstpad.c line 3590
#57 events_foreach
at gstpad.c line 583
#58 check_sticky
at gstpad.c line 3646
#59 gst_pad_push_event
at gstpad.c line 5108
#60 event_forward_func
at gstpad.c line 2868
#61 gst_pad_forward
at gstpad.c line 2822
#62 gst_pad_event_default
at gstpad.c line 2919
#63 gst_pad_send_event_unchecked
at gstpad.c line 5296
#64 gst_pad_push_event_unchecked
at gstpad.c line 4983
#65 push_sticky
at gstpad.c line 3590
#66 events_foreach
at gstpad.c line 583
#67 check_sticky
at gstpad.c line 3646
#68 gst_pad_push_event
at gstpad.c line 5108
#69 gst_pad_set_caps
at /opt/cerbero-scout/dist/android_armv7/include/gstreamer-1.0/gst/gstcompat.h line 55
#70 gst_video_decoder_negotiate_default
at gstvideodecoder.c line 3487
#71 gst_video_decoder_negotiate
at gstvideodecoder.c line 3538
#72 gst_ffmpegviddec_negotiate
at gstavviddec.c line 1036
#73 gst_ffmpegviddec_negotiate
at gstavviddec.c line 879
#74 gst_ffmpegviddec_get_buffer
at gstavviddec.c line 640
#75 ff_get_buffer
at libavcodec/utils.c line 698
#76 submit_packet
at libavcodec/pthread_frame.c line 350
#77 ff_thread_decode_frame
#78 avcodec_decode_video2
at libavcodec/utils.c line 1597
#79 gst_ffmpegviddec_video_frame
at gstavviddec.c line 1254
#80 gst_ffmpegviddec_frame
at gstavviddec.c line 1422
#81 gst_ffmpegviddec_handle_frame
at gstavviddec.c line 1534
#82 gst_video_decoder_decode_frame
at gstvideodecoder.c line 3080
#83 gst_video_decoder_chain_forward
at gstvideodecoder.c line 1957
#84 gst_video_decoder_chain
at gstvideodecoder.c line 2257
#85 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#86 gst_pad_push_data
at gstpad.c line 4210
#87 gst_pad_push
at gstpad.c line 4321
#88 gst_base_transform_chain
at gstbasetransform.c line 2281
#89 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#90 gst_pad_push_data
at gstpad.c line 4210
#91 gst_pad_push
at gstpad.c line 4321
#92 gst_base_parse_push_frame
at gstbaseparse.c line 2341
#93 gst_base_parse_chain
at gstbaseparse.c line 2950
#94 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#95 gst_pad_push_data
at gstpad.c line 4210
#96 gst_pad_push
at gstpad.c line 4321
#97 gst_single_queue_push_one
at gstmultiqueue.c line 1238
#98 gst_multi_queue_loop
at gstmultiqueue.c line 1516
#99 gst_task_func
at gsttask.c line 331
#100 g_thread_pool_thread_proxy
at gthreadpool.c line 307
#101 g_thread_proxy
at gthread.c line 764
#102 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#103 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#104 ??

Thread 18 (Thread 1693)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 ??
#3 ??

Thread 17 (Thread 1692)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 __pthread_cond_timedwait_relative(pthread_cond_t*, pthread_mutex_t*, timespec const*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 ??
#3 ??

Thread 15 (Thread 1660)

#0 __ioctl
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ioctl
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 ??
#3 ??

Thread 14 (Thread 1658)

#0 __ioctl
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ioctl
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#2 ??
#3 ??

Thread 13 (Thread 1656)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 12 (Thread 1655)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 11 (Thread 1654)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 10 (Thread 1653)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 9 (Thread 1652)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 8 (Thread 1651)

#0 recvmsg
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 6 (Thread 1649)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 5 (Thread 1648)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 4 (Thread 1647)

#0 syscall
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#1 ??
#2 ??

Thread 3 (Thread 1709)

#0 gst_debug_print_object
at gstinfo.c line 685
#1 gst_info_printf_pointer_extension_func
at gstinfo.c line 800
#2 printf_postprocess_args
at vasnprintf.c line 248
#3 __gst_vasnprintf
at vasnprintf.c line 280
#4 __gst_vasprintf
at printf.c line 154
#5 gst_debug_message_get
at gstinfo.c line 537
#6 gst_debug_log_default
at gstinfo.c line 1036
#7 gst_debug_log_valist
at gstinfo.c line 515
#8 gst_debug_log
at gstinfo.c line 442
#9 gst_queue2_post_buffering
at gstqueue2.c line 927
#10 gst_queue2_chain_buffer_or_buffer_list
at gstqueue2.c line 2543
#11 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#12 gst_pad_push_data
at gstpad.c line 4210
#13 gst_pad_chain_data_unchecked
at gstpad.c line 3977
#14 gst_pad_push_data
at gstpad.c line 4210
#15 gst_pad_push
at gstpad.c line 4321
#16 gst_base_src_loop
at gstbasesrc.c line 2845
#17 gst_task_func
at gsttask.c line 331
#18 g_thread_pool_thread_proxy
at gthreadpool.c line 307
#19 g_thread_proxy
at gthread.c line 764
#20 __pthread_start(void*)
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#21 __start_thread
from /home/xclaesse/programmation/sintel/scout/scout-client/android/obj/local/armeabi/libc.so
#22 ??

Comment 1 Xavier Claessens 2015-03-03 20:32:52 UTC

Crash is in thread 3.

Comment 2 Sebastian Dröge (slomo) 2015-03-04 08:36:30 UTC

Do you have a testcase, and can you reproduce it outside Android too? Can you run it in a debugger and check what the value of "queue" at gstqueue2.c:927 is?

This only seems possible if there is a reference counting problem somewhere, and the queue is already dead at that point.

Comment 3 Nicolas Dufresne (ndufresne) 2015-03-04 22:39:51 UTC

I could not reproduce here with a simple playback app.

Comment 4 Tim-Philipp Müller 2016-02-22 00:19:51 UTC

Not sure what to do about this, and we don't even know what exact version this happened with.

I wonder if this is fixed by:

 commit 6c394643be52dc525af6b21b3ba7f014eea0eb7f
 Author: Tim-Philipp Müller <tim@centricular.com>
 Date:   Fri Apr 24 15:16:24 2015 +0100

    printf: fix invalid memory access in case of %%
    
    https://bugzilla.gnome.org/show_bug.cgi?id=748414


Since the only debug message I can see in post_buffering() is

GST_DEBUG_OBJECT (queue, "Going to post buffering: %d%%", percent);

Anyway, I think we'll have to close this without further information to go on.

Please re-open if you have a test case or can still reproduce it somehow.