Ubuntu
gstreamer0.10 package

nautilus crashed with SIGSEGV in IA__g_type_value_table_peek()

Bug #258167 reported by Fabien Tassin on 2008-08-15

Affects		Status	Importance	Assigned to	Milestone
	gstreamer0.10 (Ubuntu)	Fix Released	Medium	Unassigned

Bug Description

Binary package hint: nautilus

[intrepid, up-to-date]

this happens when right-clicking on Properties on an .avi file in nautilus.
This .avi file has no thumbnail, as totem-gstreamer-video-thumbnailer is also crashing on it (see trace below). It could be the same cause.

Starting program: /usr/bin/totem-gstreamer-video-thumbnailer -s 128 file:///home/fta/Desktop/crash/foo.avi /tmp/fff

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb44eab90 (LWP 20769)]
0xb6f9388c in ?? () from /lib/tls/i686/cmov/libc.so.6
(gdb) bt
#0 0xb6f9388c in ?? () from /lib/tls/i686/cmov/libc.so.6
#1 0xb6f94dff in ?? () from /lib/tls/i686/cmov/libc.so.6
#2 0xb6f95d26 in realloc () from /lib/tls/i686/cmov/libc.so.6
#3 0xb7219d8a in IA__g_realloc (mem=0xb3c00010, n_bytes=3010146920) at /build/buildd/glib2.0-2.17.6/glib/gmem.c:170
#4 0xb71ea6d0 in g_array_maybe_expand (array=0x90a5e08, len=<value optimized out>) at /build/buildd/glib2.0-2.17.6/glib/garray.c:339
#5 0xb71eac49 in IA__g_array_append_vals (farray=0x90a5e08, data=0xb3dd4254, len=1) at /build/buildd/glib2.0-2.17.6/glib/garray.c:132
#6 0xb7ed95ad in gst_structure_set_field (structure=<value optimized out>, field=0xb3dd4254) at gststructure.c:628
#7 0xb7eda433 in gst_structure_id_set_valist (structure=0x90a9f38, fieldname=49, varargs=0xb3dd42c0 "") at gststructure.c:602
#8 0xb7eda51f in gst_structure_id_set (structure=0x28, field=49) at gststructure.c:560
#9 0xb7ed38ef in gst_query_new_duration (format=GST_FORMAT_BYTES) at gstquery.c:483
#10 0xb7ee884c in gst_pad_query_duration (pad=0x8f9bcd8, format=0xb3dd4338, duration=0xb3dd4378) at gstutils.c:2723
#11 0xb7ee8951 in gst_pad_query_peer_duration (pad=0x8f9bd98, format=0xb3dd4338, duration=0xb3dd4378) at gstutils.c:2759
#12 0xb5d95fae in mp3parse_total_bytes (mp3parse=0x905e800, total=0x28) at gstmpegaudioparse.c:1464
#13 0xb5d96562 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4430) at gstmpegaudioparse.c:1498
#14 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4540) at gstmpegaudioparse.c:1605
#15 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4540) at gstmpegaudioparse.c:1501
#16 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4650) at gstmpegaudioparse.c:1605
#17 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4650) at gstmpegaudioparse.c:1501
#18 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4760) at gstmpegaudioparse.c:1605
#19 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4760) at gstmpegaudioparse.c:1501
#20 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4870) at gstmpegaudioparse.c:1605
#21 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4870) at gstmpegaudioparse.c:1501
#22 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4980) at gstmpegaudioparse.c:1605
#23 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4980) at gstmpegaudioparse.c:1501
#24 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4a90) at gstmpegaudioparse.c:1605
#25 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4a90) at gstmpegaudioparse.c:1501
#26 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4ba0) at gstmpegaudioparse.c:1605
#27 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4ba0) at gstmpegaudioparse.c:1501
#28 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4cb0) at gstmpegaudioparse.c:1605
#29 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4cb0) at gstmpegaudioparse.c:1501

(....)

#61644 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb45d2a30) at gstmpegaudioparse.c:1605
#61645 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb45d2a30) at gstmpegaudioparse.c:1501
#61646 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb45d2b40) at gstmpegaudioparse.c:1605
#61647 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb45d2b40) at gstmpegaudioparse.c:1501
#61648 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb45d2c50) at gstmpegaudioparse.c:1605
#61649 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb45d2c50) at gstmpegaudioparse.c:1501
#61650 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb45d2d60) at gstmpegaudioparse.c:1605
#61651 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb45d2d60) at gstmpegaudioparse.c:1501
#61652 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb45d2e70) at gstmpegaudioparse.c:1605
#61653 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb45d2e70) at gstmpegaudioparse.c:1501
#61654 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb45d3040) at gstmpegaudioparse.c:1605
#61655 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb45d3040) at gstmpegaudioparse.c:1501
#61656 0xb5d99b11 in gst_mp3parse_chain (pad=0x8f9bd98, buf=0x8f96d90) at gstmpegaudioparse.c:950
#61657 0xb7ec2b09 in gst_pad_chain_unchecked (pad=0x8f9bd98, buffer=0x8f96d90) at gstpad.c:3576
#61658 0xb7ec3d1a in gst_pad_push (pad=0x8f9bcd8, buffer=0x8f96d90) at gstpad.c:3744
#61659 0xb6607eb2 in gst_queue_loop (pad=0x8f9bcd8) at gstqueue.c:1028
#61660 0xb7ee2be3 in gst_task_func (task=0x8f9ae98, tclass=0x8e735b8) at gsttask.c:192
#61661 0xb723d9e6 in g_thread_pool_thread_proxy (data=0x8e73648) at /build/buildd/glib2.0-2.17.6/glib/gthreadpool.c:265
#61662 0xb723c34f in g_thread_create_proxy (data=0x905f6c8) at /build/buildd/glib2.0-2.17.6/glib/gthread.c:635
#61663 0xb70874ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#61664 0xb700364e in clone () from /lib/tls/i686/cmov/libc.so.6
(gdb)
(gdb) bt f
#0 0xb6f9388c in ?? () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#1 0xb6f94dff in ?? () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2 0xb6f95d26 in realloc () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#3 0xb7219d8a in IA__g_realloc (mem=0xb3c00010, n_bytes=3010146920) at /build/buildd/glib2.0-2.17.6/glib/gmem.c:170
No locals.
#4 0xb71ea6d0 in g_array_maybe_expand (array=0x90a5e08, len=<value optimized out>) at /build/buildd/glib2.0-2.17.6/glib/garray.c:339
        want_alloc = <value optimized out>
#5 0xb71eac49 in IA__g_array_append_vals (farray=0x90a5e08, data=0xb3dd4254, len=1) at /build/buildd/glib2.0-2.17.6/glib/garray.c:132
No locals.
#6 0xb7ed95ad in gst_structure_set_field (structure=<value optimized out>, field=0xb3dd4254) at gststructure.c:628
        f = (GstStructureField *) 0xb36b3248
        i = 3015704592
#7 0xb7eda433 in gst_structure_id_set_valist (structure=0x90a9f38, fieldname=49, varargs=0xb3dd42c0 "") at gststructure.c:602
        field = {name = 51, value = {g_type = 40, data = {{v_int = -1, v_uint = 4294967295, v_long = -1, v_ulong = 4294967295, v_int64 = -1, v_uint64 = 18446744073709551615, v_float = -nan(0x7fffff),
        v_double = -nan(0xfffffffffffff), v_pointer = 0xffffffff}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}}
        err = <value optimized out>
        type = <value optimized out>
        __PRETTY_FUNCTION__ = "gst_structure_id_set_valist"
#8 0xb7eda51f in gst_structure_id_set (structure=0x28, field=49) at gststructure.c:560
        __PRETTY_FUNCTION__ = "gst_structure_id_set"
#9 0xb7ed38ef in gst_query_new_duration (format=GST_FORMAT_BYTES) at gstquery.c:483
        structure = (GstStructure *) 0x90a9f38
#10 0xb7ee884c in gst_pad_query_duration (pad=0x8f9bcd8, format=0xb3dd4338, duration=0xb3dd4378) at gstutils.c:2723
        query = <value optimized out>
        ret = <value optimized out>
        __PRETTY_FUNCTION__ = "gst_pad_query_duration"
#11 0xb7ee8951 in gst_pad_query_peer_duration (pad=0x8f9bd98, format=0xb3dd4338, duration=0xb3dd4378) at gstutils.c:2759
        ret = 0
        peer = <value optimized out>
        __PRETTY_FUNCTION__ = "gst_pad_query_peer_duration"
#12 0xb5d95fae in mp3parse_total_bytes (mp3parse=0x905e800, total=0x28) at gstmpegaudioparse.c:1464
        fmt = GST_FORMAT_BYTES
#13 0xb5d96562 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4430) at gstmpegaudioparse.c:1498
        total_bytes = <value optimized out>
#14 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4540) at gstmpegaudioparse.c:1605
        total_bytes = <value optimized out>
        total_time = <value optimized out>
#15 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4540) at gstmpegaudioparse.c:1501
        total_bytes = 1157172244897
#16 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4650) at gstmpegaudioparse.c:1605
        total_bytes = <value optimized out>
        total_time = <value optimized out>
#17 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4650) at gstmpegaudioparse.c:1501
        total_bytes = 1157172244897
#18 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4760) at gstmpegaudioparse.c:1605
        total_bytes = <value optimized out>
        total_time = <value optimized out>
#19 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4760) at gstmpegaudioparse.c:1501
        total_bytes = 1157172244897
#20 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4870) at gstmpegaudioparse.c:1605
        total_bytes = <value optimized out>
        total_time = <value optimized out>
#21 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4870) at gstmpegaudioparse.c:1501
        total_bytes = 1157172244897
#22 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4980) at gstmpegaudioparse.c:1605
        total_bytes = <value optimized out>
        total_time = <value optimized out>
#23 0xb5d96592 in mp3parse_total_time (mp3parse=0x905e800, total=0xb3dd4980) at gstmpegaudioparse.c:1501
        total_bytes = 1157172244897
#24 0xb5d96273 in mp3parse_bytepos_to_time (mp3parse=0x905e800, bytepos=1157172244897, ts=0xb3dd4a90) at gstmpegaudioparse.c:1605

ProblemType: Crash
Architecture: i386
CrashCounter: 1
DistroRelease: Ubuntu 8.10
ExecutablePath: /usr/bin/nautilus
NonfreeKernelModules: nvidia
Package: nautilus 1:2.23.6.1-0ubuntu1
ProcAttrCurrent: unconfined
ProcCmdline: nautilus --no-desktop --browser
ProcEnviron:
SHELL=/usr/bin/tcsh
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games
LANG=en_US.UTF-8
Signal: 11
SourcePackage: nautilus
StacktraceTop:
IA__g_type_value_table_peek (type=172944280)
IA__g_value_init (value=0xb60b40e8, g_type=172944280)
gst_structure_id_set_valist (structure=0xa8c8d00,
gst_structure_id_set (structure=0xb60b40e8, field=2307)
gst_query_set_duration (query=0xa7a2980,
Title: nautilus crashed with SIGSEGV in IA__g_type_value_table_peek()
Uname: Linux 2.6.26-5-generic i686
UserGroups: adm admin audio cdrom dip floppy fuse kvm libvirtd lpadmin plugdev pulse-rt scanner video

Tags:

Revision history for this message

Fabien Tassin (fta) wrote on 2008-08-15:

Dependencies.txt Edit (6.1 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (1.2 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (46.2 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (811 bytes, text/plain; charset="utf-8")
Registers.txt Edit (516 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (341.2 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (353.8 KiB, text/plain; charset="utf-8")

Revision history for this message

Apport retracing service (apport) wrote on 2008-08-15: Symbolic stack trace

Stacktrace.txt (retraced) Edit (336.5 KiB, text/plain)

StacktraceTop:IA__g_type_value_table_peek (type=172944280) at /build/buildd/glib2.0-2.17.6/gobject/gtype.c:3893
IA__g_value_init (value=0xb60b40e8, g_type=172944280) at /build/buildd/glib2.0-2.17.6/gobject/gvalue.c:115
gst_structure_id_set_valist (structure=0xa8c8d00, fieldname=2307, varargs=0xb60b4138 "\230�n\003")
gst_structure_id_set (structure=0xb60b40e8, field=2307) at gststructure.c:560
gst_query_set_duration (query=0xa7a2980, format=GST_FORMAT_TIME, duration=1157172244897) at gstquery.c:508

Revision history for this message

Apport retracing service (apport) wrote on 2008-08-15: Symbolic threaded stack trace

ThreadStacktrace.txt (retraced) Edit (351.2 KiB, text/plain)

Changed in nautilus:
importance:	Undecided → Medium

Revision history for this message

Sebastien Bacher (seb128) wrote on 2008-08-15:

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please try to obtain a valgrind log following the instructions at https://wiki.ubuntu.com/Valgrind and attach the file to the bug report. This will greatly help us in tracking down your problem.

Changed in nautilus:
assignee:	nobody → desktop-bugs
status:	New → Incomplete

Revision history for this message

Fabien Tassin (fta) wrote on 2008-08-15:

valgrind-logs.tar.bz2 Edit (16.8 KiB, application/octet-stream)

Sébastien, here are the 2 valgrind logs (nautilus and totem-gstreamer-video-thumbnailer).

I noticed this in the log about nautilus:

==23892== Process terminating with default action of signal 11 (SIGSEGV)
==23892== Bad permissions for mapped region at address 0x5B89FFC
==23892== at 0x4A1E0F9: g_type_value_table_peek (gtype.c:3893)

==23892==
==23892== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 643 from 3)
==23892==
==23892== 1 errors in context 1 of 1:
==23892== Source and destination overlap in memcpy(0x56B77D4, 0x56B77E0, 36)
==23892== at 0x4025919: memcpy (mc_replace_strmem.c:402)
==23892== by 0x43D2B8F: ORBit_sequence_remove (in /usr/lib/libORBit-2.so.0.1.0)
==23892== by 0x439D9B1: bonobo_activation_set_activation_env_value (in /usr/lib/libbonobo-activation.so.4.0.0)
==23892== by 0x807FE87: (within /usr/bin/nautilus)
==23892== by 0x4D31684: (below main) (in /lib/tls/i686/cmov/libc-2.8.90.so)

Sebastien Bacher (seb128) on 2008-08-15

Changed in totem:
status:	Incomplete → New

Sebastien Bacher (seb128) on 2008-10-07

Changed in totem:
assignee:	desktop-bugs → nobody

Revision history for this message

Sebastien Bacher (seb128) wrote on 2008-10-09:

do you still get the issue using the current versions? could you add foo.avi to the bug?

Changed in gstreamer0.10:
status:	New → Incomplete

Revision history for this message

Fabien Tassin (fta) wrote on 2008-10-10:

Appears to be fixed now. closing.

Changed in gstreamer0.10:
status:	Incomplete → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntugstreamer0.10 package

nautilus crashed with SIGSEGV in IA__g_type_value_table_peek()

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
gstreamer0.10 package