Adding many tracks to the tracklist with metadata retrieval enabled causes a segfault in glib

Bug #1479383 reported by Jim Hodapp
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Canonical System Image
Fix Released
High
John McAleely
media-hub (Ubuntu)
Fix Released
Critical
Jim Hodapp
media-hub (Ubuntu RTM)
Fix Released
Undecided
Unassigned

Bug Description

When the code to retrieve the basic metadata about a track is enabled in TrackListImplementation::add_track_with_uri_at(), adding several tracks back-to-back will cause a segfault in glib at g_hook_free(). Backtrace:

Signaled that we just added track id: /core/ubuntu/media/Service/sessions/62/TrackList/0
*** void core::ubuntu::media::TrackListSkeleton::Private::handle_add_track_with_uri_at(const Ptr&)
virtual void core::ubuntu::media::TrackListImplementation::add_track_with_uri_at(const UriType&, const Id&, bool)
Adding Track::Id: /core/ubuntu/media/Service/sessions/62/TrackList/1
 URI: file:///home/phablet/dev/qtubuntu-media/tests/integration/testdata/testfile.mp4
container.size(): 2
[New Thread 0xa64e7370 (LWP 29240)]
[New Thread 0xa901a370 (LWP 29230)]
[New Thread 0xaa0fa370 (LWP 29229)]
[New Thread 0xaaa23370 (LWP 29228)]
[New Thread 0xab223370 (LWP 29227)]
[New Thread 0xa4f15370 (LWP 29226)]
[New Thread 0xa57ff370 (LWP 29225)]
[New Thread 0xa7f96370 (LWP 29224)]
[New Thread 0xa4715370 (LWP 29223)]
[New Thread 0xa3f15370 (LWP 29199)]
[New Thread 0xa981a370 (LWP 28842)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xa64e7370 (LWP 29240)]
0xab91ef00 in ?? ()
(gdb) bt
#0 0xffffffff in ()
#1 0xffffffff in g_hook_free (hook_list=0xac73b810, hook=0x2aff4a0) at /build/glib2.0-w3DiQY/glib2.0-2.45.3/./glib/ghook.c:302
#2 0xffffffff in g_hook_next_valid (hook_list=0xac73b810, hook=0x2af3c78, may_be_in_call=<optimized out>)
    at /build/glib2.0-w3DiQY/glib2.0-2.45.3/./glib/ghook.c:751
#3 0xffffffff in g_hook_list_marshal (hook_list=hook_list@entry=0xac73b810, may_recurse=may_recurse@entry=1, marshaller=0xb6d22371 <probe_hook_marshal>, data=data@entry=0xa64e668c) at /build/glib2.0-w3DiQY/glib2.0-2.45.3/./glib/ghook.c:676
#4 0xffffffff in do_probe_callbacks (pad=pad@entry=0xac73b7a8 [GstDecodePad], info=info@entry=0xa64e6708, defaultval=defaultval@entry=GST_FLOW_OK)
    at gstpad.c:3268
#5 0xffffffff in gst_pad_push_event_unchecked (pad=pad@entry=0xac73b7a8 [GstDecodePad], event=<optimized out>, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4807
#6 0xffffffff in push_sticky (pad=0xac73b7a8 [GstDecodePad], ev=0xa64e67ac, user_data=0xa64e67f0) at gstpad.c:3443
#7 0xffffffff in events_foreach (pad=pad@entry=0xac73b7a8 [GstDecodePad], func=0xb6d234f1 <push_sticky>, user_data=user_data@entry=0xa64e67f0)
    at gstpad.c:570
#8 0xffffffff in gst_pad_push_event (event=0xb2405940, pad=0xac73b7a8 [GstDecodePad]) at gstpad.c:3499
#9 0xffffffff in gst_pad_push_event (pad=pad@entry=0xac73b7a8 [GstDecodePad], event=0xb2405940) at gstpad.c:4952
#10 0xffffffff in event_forward_func (pad=0xac73b7a8 [GstDecodePad], data=0xa64e68e8) at gstpad.c:2842
#11 0xffffffff in gst_pad_forward (pad=pad@entry=0xab928900 [GstProxyPad], forward=0xb6d2a3a1 <event_forward_func>, user_data=user_data@entry=0xa64e68e8)
    at gstpad.c:2796
#12 0xffffffff in gst_pad_event_default (pad=0xab928900 [GstProxyPad], parent=<optimized out>, event=0xb2405940) at gstpad.c:2893
#13 0xffffffff in gst_pad_send_event_unchecked (pad=pad@entry=0xab928900 [GstProxyPad], event=event@entry=0xb2405940, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:5135
#14 0xffffffff in gst_pad_push_event_unchecked (pad=pad@entry=0xa821cbf0 [GstPad], event=0xb2405940, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4833
#15 0xffffffff in push_sticky (pad=0xa821cbf0 [GstPad], ev=0xa64e6a7c, user_data=0xa64e6ac0) at gstpad.c:3443
#16 0xffffffff in events_foreach (pad=pad@entry=0xa821cbf0 [GstPad], func=0xb6d234f1 <push_sticky>, user_data=user_data@entry=0xa64e6ac0) at gstpad.c:570
#17 0xffffffff in gst_pad_push_event (event=0xb2405940, pad=0xa821cbf0 [GstPad]) at gstpad.c:3499
#18 0xffffffff in gst_pad_push_event (pad=0xa821cbf0 [GstPad], event=event@entry=0xb2405940) at gstpad.c:4952
#19 0xffffffff in gst_video_decoder_push_event (decoder=decoder@entry=0xb2359cb8 [GstAmcVideoDec-OmxQcomVideoDecoderAvc], event=0xb2405940)
    at gstvideodecoder.c:917
#20 0xffffffff in gst_video_decoder_finish_frame (decoder=decoder@entry=0xb2359cb8 [GstAmcVideoDec-OmxQcomVideoDecoderAvc], frame=frame@entry=0xa8229540)
    at gstvideodecoder.c:2663
#21 0xffffffff in gst_amc_video_dec_loop (self=<optimized out>) at gstamcvideodechybris.c:1553
#22 0xffffffff in gst_task_func (task=0xa8229178 [GstTask]) at gsttask.c:316
#23 0xffffffff in g_thread_pool_thread_proxy (data=<optimized out>) at /build/glib2.0-w3DiQY/glib2.0-2.45.3/./glib/gthreadpool.c:307
#24 0xffffffff in g_thread_proxy (data=0xa71d4600) at /build/glib2.0-w3DiQY/glib2.0-2.45.3/./glib/gthread.c:764
#25 0xffffffff in start_thread () at /lib/arm-linux-gnueabihf/libpthread.so.0
#26 0xffffffff in () at /lib/arm-linux-gnueabihf/libc.so.6
(gdb) info threads
  Id Target Id Frame
  25 Thread 0xa981a370 (LWP 28842) "Binder_3" 0xb40c99c8 in ?? ()
  24 Thread 0xa3f15370 (LWP 29199) "qtdemux14:sink" 0xb61a6620 in syscall () from /lib/arm-linux-gnueabihf/libc.so.6
  23 Thread 0xa4715370 (LWP 29223) "multiqueue40:sr" 0xb6210d44 in __libc_do_syscall () from /lib/arm-linux-gnueabihf/libpthread.so.0
  22 Thread 0xa7f96370 (LWP 29224) "typefind:sink" 0xb61a6620 in syscall () from /lib/arm-linux-gnueabihf/libc.so.6
  21 Thread 0xa57ff370 (LWP 29225) "multiqueue40:sr" 0xa9840334 in ?? () from /usr/lib/arm-linux-gnueabihf/libfaad.so.2
  20 Thread 0xa4f15370 (LWP 29226) "ALooper" 0xb6210d46 in __libc_do_syscall () from /lib/arm-linux-gnueabihf/libpthread.so.0
  19 Thread 0xab223370 (LWP 29227) "CodecLooper" 0xb6210d46 in __libc_do_syscall () from /lib/arm-linux-gnueabihf/libpthread.so.0
  18 Thread 0xaaa23370 (LWP 29228) "VideoDecMsgThre" 0xb612b9a6 in ?? () from /lib/arm-linux-gnueabihf/libc.so.6
  17 Thread 0xaa0fa370 (LWP 29229) "VideoDecCallBac" 0xb40c99c8 in ?? ()
  16 Thread 0xa901a370 (LWP 29230) "OMXCallbackDisp" 0xb6210d44 in __libc_do_syscall () from /lib/arm-linux-gnueabihf/libpthread.so.0
* 15 Thread 0xa64e7370 (LWP 29240) "amcvideodec-omx" 0xab91ef00 in ?? ()
  7 Thread 0xb36e8370 (LWP 28219) "Binder_1" 0xb40c99c8 in ?? ()
  6 Thread 0xb2cff370 (LWP 28220) "Binder_2" 0xb40c99c8 in ?? ()
  5 Thread 0xb22ff370 (LWP 28221) "media-hub-serve" 0xb61a6620 in syscall () from /lib/arm-linux-gnueabihf/libc.so.6
  4 Thread 0xadafe370 (LWP 28222) "threaded-ml" 0xb61a24e2 in poll () from /lib/arm-linux-gnueabihf/libc.so.6
  3 Thread 0xad0ff370 (LWP 28223) "media-hub-serve" 0xb61a24e2 in poll () from /lib/arm-linux-gnueabihf/libc.so.6
  2 Thread 0xac29c370 (LWP 28224) "media-hub-serve" 0xb61a9132 in epoll_wait () from /lib/arm-linux-gnueabihf/libc.so.6
  1 Thread 0xb4137000 (LWP 28173) "media-hub-serve" 0xb61a24e2 in poll () from /lib/arm-linux-gnueabihf/libc.so.6

Revision history for this message
Jim Hodapp (jhodapp) wrote :

This is reproducible using the new music-app dev branch which takes advantage of the media-hub tracklist:

lp:~music-app-dev/music-app/media-hub-bg-playlists-rework

Changed in media-hub (Ubuntu):
importance: Undecided → Critical
status: New → Triaged
Changed in canonical-devices-system-image:
status: New → Confirmed
kevin gunn (kgunn72)
Changed in canonical-devices-system-image:
milestone: none → ww40-2015
importance: Undecided → Critical
Changed in canonical-devices-system-image:
assignee: nobody → John McAleely (john.mcaleely)
Changed in canonical-devices-system-image:
milestone: ww40-2015 → ww46-2015
Changed in media-hub (Ubuntu):
assignee: nobody → Jim Hodapp (jhodapp)
Changed in canonical-devices-system-image:
milestone: ww46-2015 → ww02-2016
Revision history for this message
Jim Hodapp (jhodapp) wrote :

This shouldn't be happening still. Can the bug reporter please verify?

Changed in media-hub (Ubuntu):
status: Triaged → Incomplete
Changed in media-hub (Ubuntu RTM):
status: New → Incomplete
Revision history for this message
Jean-Baptiste Lallement (jibel) wrote :

@Jim, it seems that you are the bug reporter :)

Can this bug be closed then?

Changed in canonical-devices-system-image:
status: Confirmed → Incomplete
importance: Critical → High
milestone: ww02-2016 → none
Revision history for this message
Jim Hodapp (jhodapp) wrote :

@jibel: good point. :) It can be, I just wanted Saviq to confirm.

Revision history for this message
Jean-Baptiste Lallement (jibel) wrote :

Thanks, closing.

Changed in canonical-devices-system-image:
status: Incomplete → Fix Released
Changed in media-hub (Ubuntu):
status: Incomplete → Fix Released
Changed in media-hub (Ubuntu RTM):
status: Incomplete → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.