Pulseaudio crashes if you repeat audio too much

[ShawnStarr]

Gdb crach info
========

Program received signal SIGSEGV, Segmentation fault.
malloc_consolidate (av=0x7fedf8023e40) at malloc.c:5095
5095 malloc.c: No such file or directory.
        in malloc.c

Simple trace
=======

#0 malloc_consolidate (av=0x7fedf8023e40) at malloc.c:5095
#1 0x00007fedf7d31439 in _int_malloc (av=0x7fedf8023e40, bytes=33) at malloc.c:4338
#2 0x00007fedf7d34df8 in malloc_check (sz=8208, caller=<value optimized out>) at hooks.c:264
#3 0x00007fedf7d330a3 in __libc_calloc (n=<value optimized out>, elem_size=<value optimized out>) at malloc.c:4006
#4 0x00007fedf952f7af in pa_xmalloc0 (size=<value optimized out>) at pulse/xmalloc.c:76
#5 0x00007fedf9753f1f in pa_flist_new (size=1024) at pulsecore/flist.c:97
#6 0x00007fedf975c05e in pa_mempool_vacuum (p=0x6eb8c0) at pulsecore/memblock.c:828
#7 0x00007fedf99c510d in pa_sink_input_unlink (i=0x7f3730) at pulsecore/sink-input.c:472
#8 0x00007fedf086985d in playback_stream_unlink (s=0x7cee20) at pulsecore/protocol-native.c:727
#9 0x00007fedf086be09 in command_delete_stream (pd=<value optimized out>, command=<value optimized out>, tag=11, t=0x742eb0, userdata=0x7a01d0) at pulsecore/protocol-native.c:2035
#10 0x00007fedf9763766 in pa_pdispatch_run (pd=0x80a9f0, packet=<value optimized out>, creds=<value optimized out>, userdata=0x7a01d0) at pulsecore/pdispatch.c:330
#11 0x00007fedf086e1a9 in pstream_packet_callback (p=0x819ca0, packet=0x7e76c0, creds=0x819df0, userdata=0x7a01d0) at pulsecore/protocol-native.c:4359
#12 0x00007fedf9767ed4 in do_read (p=0x819ca0) at pulsecore/pstream.c:816
#13 do_something (p=0x819ca0) at pulsecore/pstream.c:184
#14 0x00007fedf951b593 in dispatch_pollfds (m=0x6e9650) at pulse/mainloop.c:712
#15 pa_mainloop_dispatch (m=0x6e9650) at pulse/mainloop.c:923
#16 0x00007fedf951b9c8 in pa_mainloop_iterate (m=0x6e9650, block=<value optimized out>, retval=0x7fff56f1ca7c) at pulse/mainloop.c:953
#17 0x00007fedf951ba70 in pa_mainloop_run (m=0x6e9650, retval=0x7fff56f1ca7c) at pulse/mainloop.c:968
#18 0x000000000040a070 in main (argc=<value optimized out>, argv=<value optimized out>) at daemon/main.c:917

Full trace
=====

#0 malloc_consolidate (av=0x7fedf8023e40) at malloc.c:5095
        fb = 0x7fedf8023e48
        maxfb = 0x7fedf8023e90
        p = 0xf7fffffffffd4130
        nextp = 0x0
        unsorted_bin = 0x7fedf8023e98
        first_unsorted = <value optimized out>
        nextchunk = 0x7e7670
        size = 576460752311891264
        nextsize = <value optimized out>
        prevsize = 576460752311891264
        bck = 0x21
        fwd = <value optimized out>
        __PRETTY_FUNCTION__ = "malloc_consolidate"
#1 0x00007fedf7d31439 in _int_malloc (av=0x7fedf8023e40, bytes=33) at malloc.c:4338
        nb = 8224
        idx = <value optimized out>
        bin = <value optimized out>
        victim = 0x611040
        size = <value optimized out>
        victim_index = <value optimized out>
        remainder = <value optimized out>
        remainder_size = <value optimized out>
        block = <value optimized out>
        bit = <value optimized out>
        map = <value optimized out>
        fwd = <value optimized out>
        bck = <value optimized out>
        __PRETTY_FUNCTION__ = "_int_malloc"
#2 0x00007fedf7d34df8 in malloc_check (sz=8208, caller=<value optimized out>) at hooks.c:264
        victim = 0x800000000813540
#3 0x00007fedf7d330a3 in __libc_calloc (n=<value optimized out>, elem_size=<value optimized out>) at malloc.c:4006
        av = <value optimized out>
        oldtop = <value optimized out>
        bytes = 8208
        csz = <value optimized out>
        oldtopsize = <value optimized out>
        mem = <value optimized out>
        clearsize = <value optimized out>
        nclears = <value optimized out>
        __PRETTY_FUNCTION__ = "__libc_calloc"
#4 0x00007fedf952f7af in pa_xmalloc0 (size=<value optimized out>) at pulse/xmalloc.c:76
        __func__ = "pa_xmalloc0"
        __PRETTY_FUNCTION__ = "pa_xmalloc0"
#5 0x00007fedf9753f1f in pa_flist_new (size=1024) at pulsecore/flist.c:97
        __func__ = "pa_flist_new"
        __PRETTY_FUNCTION__ = "pa_flist_new"
#6 0x00007fedf975c05e in pa_mempool_vacuum (p=0x6eb8c0) at pulsecore/memblock.c:828
        slot = <value optimized out>
        list = <value optimized out>
        __func__ = "pa_mempool_vacuum"
        __PRETTY_FUNCTION__ = "pa_mempool_vacuum"
#7 0x00007fedf99c510d in pa_sink_input_unlink (i=0x7f3730) at pulsecore/sink-input.c:472
        linked = true
        p = 0x7261c0
        __func__ = "pa_sink_input_unlink"
        __PRETTY_FUNCTION__ = "pa_sink_input_unlink"
#8 0x00007fedf086985d in playback_stream_unlink (s=0x7cee20) at pulsecore/protocol-native.c:727
        __func__ = "playback_stream_unlink"
        __PRETTY_FUNCTION__ = "playback_stream_unlink"
#9 0x00007fedf086be09 in command_delete_stream (pd=<value optimized out>, command=<value optimized out>, tag=11, t=0x742eb0, userdata=0x7a01d0) at pulsecore/protocol-native.c:2035
        channel = 0
        __func__ = "command_delete_stream"
        __PRETTY_FUNCTION__ = "command_delete_stream"
#10 0x00007fedf9763766 in pa_pdispatch_run (pd=0x80a9f0, packet=<value optimized out>, creds=<value optimized out>, userdata=0x7a01d0) at pulsecore/pdispatch.c:330
        tag = 11
        command = 4
        ts = 0x742eb0
        ret = 0
        __func__ = "pa_pdispatch_run"
        __PRETTY_FUNCTION__ = "pa_pdispatch_run"
#11 0x00007fedf086e1a9 in pstream_packet_callback (p=0x819ca0, packet=0x7e76c0, creds=0x819df0, userdata=0x7a01d0) at pulsecore/protocol-native.c:4359
        __func__ = "pstream_packet_callback"
        __PRETTY_FUNCTION__ = "pstream_packet_callback"
#12 0x00007fedf9767ed4 in do_read (p=0x819ca0) at pulsecore/pstream.c:816
        release_memblock = 0x0
        d = <value optimized out>
        l = 15
        r = 15
#13 do_something (p=0x819ca0) at pulsecore/pstream.c:184
        __func__ = "do_something"
        __PRETTY_FUNCTION__ = "do_something"
#14 0x00007fedf951b593 in dispatch_pollfds (m=0x6e9650) at pulse/mainloop.c:712
        e = 0x7c12a0
        k = 0
        r = 1
#15 pa_mainloop_dispatch (m=0x6e9650) at pulse/mainloop.c:923
        dispatched = 0
        __func__ = "pa_mainloop_dispatch"
        __PRETTY_FUNCTION__ = "pa_mainloop_dispatch"
#16 0x00007fedf951b9c8 in pa_mainloop_iterate (m=0x6e9650, block=<value optimized out>, retval=0x7fff56f1ca7c) at pulse/mainloop.c:953
        r = <value optimized out>
        __func__ = "pa_mainloop_iterate"
        __PRETTY_FUNCTION__ = "pa_mainloop_iterate"
#17 0x00007fedf951ba70 in pa_mainloop_run (m=0x6e9650, retval=0x7fff56f1ca7c) at pulse/mainloop.c:968
        r = <value optimized out>
#18 0x000000000040a070 in main (argc=<value optimized out>, argv=<value optimized out>) at daemon/main.c:917
        c = <value optimized out>
        buf = <value optimized out>
        conf = <value optimized out>
        mainloop = <value optimized out>
        s = <value optimized out>
        r = <value optimized out>
        retval = 0
        d = 3
        valid_pid_file = true
        ltdl_init = <value optimized out>
        passed_fd = <value optimized out>
        e = <value optimized out>
        daemon_pipe = {-1, -1}
        autospawn_fd = -1
        autospawn_locked = false
        dbus = <value optimized out>
        __func__ = "main"
        __PRETTY_FUNCTION__ = "main"

[Daniel T Chen (crimsun)]

Next time, please use "ubuntu-bug pulseaudio". As it stands, I can't tell if you are using the ~ubuntu-audio-dev PPA version of PA (it will enter main next week).

[David Tomaschik (matir)]

Additionally, a more detailed description of what you did to trigger the bug would be useful. What do you mean by "repeat audio too much"?

[ShawnStarr (shawn-starr)]

Packages installed
===========
ii pulseaudio 1:0.9.16~test6-3-g57e1-0ubuntu2 PulseAudio sound server
ii libpulse-browse0 1:0.9.16~test6-3-g57e1-0ubuntu2 PulseAudio client libraries (zeroconf suppor
ii libpulse-mainloop-glib0 1:0.9.16~test6-3-g57e1-0ubuntu2 PulseAudio client libraries (glib support)
ii libpulse0 1:0.9.16~test6-3-g57e1-0ubuntu2 PulseAudio client libraries
iii pulseaudio-esound-compat 1:0.9.16~test6-3-g57e1-0ubuntu2 PulseAudio ESD compatibility layer
ii pulseaudio-module-udev 1:0.9.16~test6-3-g57e1-0ubuntu2 udev device detection module for PulseAudio
ii pulseaudio-module-x11 1:0.9.16~test6-3-g57e1-0ubuntu2 X11 module for PulseAudio sound server

Now for some details, this is Kubuntu Karmic (latest in repository). If I open konsole, press backspace many times, PA will crash with the above strack trace.

As for my ubuntu bug ignore he fact I am using VirtualBox at this moment in this report

ard0.Amixer.info:
  Card hw:0 'Intel'/'HDA Intel at 0xfc020000 irq 17'
    Mixer name : 'Conexant CX20561 (Hermosa)'
    Components : 'HDA:14f15051,17aa2100,00100000 HDA:14f12c06,17aa2122,00100000'
    Controls : 15
    Simple ctrls : 8
PackageArchitecture: amd64
SourcePackage: pulseaudio
ProcVersionSignature: Ubuntu 2.6.31-9.29-generic
ProcEnviron:
  PATH=(custom, no user)
  LANG=en_CA.UTF-8
  SHELL=/bin/bash
Card0.Codecs.codec.1:
  Codec: Conexant ID 2c06
  Address: 1
  Function Id: 0x2
  Vendor Id: 0x14f12c06
  Subsystem Id: 0x17aa2122
  Revision Id: 0x100000
  Modem Function Group: 0x2
Card0.Codecs.codec.0:
  Codec: Conexant CX20561 (Hermosa)
  Address: 0
  Function Id: 0x1
  Vendor Id: 0x14f15051
  Subsystem Id: 0x17aa2100
  Revision Id: 0x100000
  No Modem Function Group found
  Default PCM:
      rates [0x160]: 44100 48000 96000
      bits [0xe]: 16 20 24
      formats [0x1]: PCM
  Default Amp-In caps: N/A
  Default Amp-Out caps: N/A
  GPIO: io=4, o=0, i=0, unsolicited=1, wake=0
    IO[0]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
    IO[1]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
    IO[2]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
    IO[3]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
  Node 0x10 [Audio Output] wcaps 0xc1d: Stereo Amp-Out R/L
    Amp-Out caps: ofs=0x4a, nsteps=0x4a, stepsize=0x03, mute=0
    Amp-Out vals: [0x4a 0x4a]
    Converter: stream=0, channel=0
    PCM:
      rates [0x560]: 44100 48000 96000 192000
      bits [0xe]: 16 20 24
      formats [0x1]: PCM
    Power: setting=D0, actual=D0
  Node 0x11 [Audio Output] wcaps 0xc1d: Stereo Amp-Out R/L
    Amp-Out caps: ofs=0x4a, nsteps=0x4a, stepsize=0x03, mute=0
    Amp-Out vals: [0x4a 0x4a]
    Converter: stream=0, channel=0
    PCM:
      rates [0x560]: 44100 48000 96000 192000
      bits [0xe]: 16 20 24
      formats [0x1]: PCM
    Power: setting=D0, actual=D0
  Node 0x12 [Audio Output] wcaps 0x211: Stereo Digital
    Converter: stream=0, channel=0
    Digital:
    Digital category: 0x0
    PCM:
      rates [0x160]:...

[Daniel T Chen (crimsun)]

Right, so please reproduce the symptom using the PPA version.

On Sep 4, 2009 11:35 PM, "ShawnStarr" <email address hidden> wrote:

Packages installed
===========
ii pulseaudio 1:0.9.16~test6-3-g57e1-0ubuntu2
       PulseAudio sound server
ii libpulse-browse0 1:0.9.16~test6-3-g57e1-0ubuntu2
       PulseAudio client libraries (zeroconf suppor
ii libpulse-mainloop-glib0 1:0.9.16~test6-3-g57e1-0ubuntu2
       PulseAudio client libraries (glib support)
ii libpulse0 1:0.9.16~test6-3-g57e1-0ubuntu2
       PulseAudio client libraries
iii pulseaudio-esound-compat 1:0.9.16~test6-3-g57e1-0ubuntu2
         PulseAudio ESD compatibility layer
ii pulseaudio-module-udev 1:0.9.16~test6-3-g57e1-0ubuntu2
       udev device detection module for PulseAudio
ii pulseaudio-module-x11 1:0.9.16~test6-3-g57e1-0ubuntu2
       X11 module for PulseAudio sound server

Now for some details, this is Kubuntu Karmic (latest in repository). If
I open konsole, press backspace many times, PA will crash with the above
strack trace.

As for my ubuntu bug ignore he fact I am using VirtualBox at this moment
in this report

ard0.Amixer.info:
 Card hw:0 'Intel'/'HDA Intel at 0xfc020000 irq 17'
   Mixer name : 'Conexant CX20561 (Hermosa)'
   Components : 'HDA:14f15051,17aa2100,00100000
HDA:14f12c06,17aa2122,00100000'
   Controls : 15
   Simple ctrls : 8
PackageArchitecture: amd64
SourcePackage: pulseaudio
ProcVersionSignature: Ubuntu 2.6.31-9.29-generic
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_CA.UTF-8
 SHELL=/bin/bash
Card0.Codecs.codec.1:
 Codec: Conexant ID 2c06
 Address: 1
 Function Id: 0x2
 Vendor Id: 0x14f12c06
 Subsystem Id: 0x17aa2122
 Revision Id: 0x100000
 Modem Function Group: 0x2
Card0.Codecs.codec.0:
 Codec: Conexant CX20561 (Hermosa)
 Address: 0
 Function Id: 0x1
 Vendor Id: 0x14f15051
 Subsystem Id: 0x17aa2100
 Revision Id: 0x100000
 No Modem Function Group found
 Default PCM:
     rates [0x160]: 44100 48000 96000
     bits [0xe]: 16 20 24
     formats [0x1]: PCM
 Default Amp-In caps: N/A
 Default Amp-Out caps: N/A
 GPIO: io=4, o=0, i=0, unsolicited=1, wake=0
   IO[0]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
   IO[1]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
   IO[2]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
   IO[3]: enable=0, dir=0, wake=0, sticky=0, data=0, unsol=0
 Node 0x10 [Audio Output] wcaps 0xc1d: Stereo Amp-Out R/L
   Amp-Out caps: ofs=0x4a, nsteps=0x4a, stepsize=0x03, mute=0
   Amp-Out vals: [0x4a 0x4a]
   Converter: stream=0, channel=0
   PCM:
     rates [0x560]: 44100 48000 96000 192000
     bits [0xe]: 16 20 24
     formats [0x1]: PCM
   Power: setting=D0, actual=D0
 Node 0x11 [Audio Output] wcaps 0xc1d: Stereo Amp-Out R/L
   Amp-Out caps: ofs=0x4a, nsteps=0x4a, stepsize=0x03, mute=0
   Amp-Out vals: [0x4a 0x4a]
   Converter: stream=0, channel=0
   PCM:
     rates [0x560]: 44100 48000 96000 192000
     bits [0xe]: 16 20 24
     formats [0x1]: PCM
   Power: setting=D0, actual=D0
 Node 0x12 [Audio Output] wcaps 0x211: Stereo Digital
   Converter: stream=0, channel=0
   Digital:
 ...

[ShawnStarr (shawn-starr)]

It still crashes with the PPA builds, but let me do further testing...

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f68fa224910 (LWP 9141)]
0x00007f68fc67e4b5 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
        in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0 0x00007f68fc67e4b5 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007f68fc681f50 in *__GI_abort () at abort.c:92
#2 0x00007f68fe0f91a3 in ?? () from /usr/lib/libpulsecommon-0.9.16.so
#3 0x00007f68fe0efe73 in pa_memblock_unref () from /usr/lib/libpulsecommon-0.9.16.so
#4 0x00007f68fe0f267d in ?? () from /usr/lib/libpulsecommon-0.9.16.so
#5 0x00007f68fe0f3c45 in pa_memblockq_drop () from /usr/lib/libpulsecommon-0.9.16.so
#6 0x00007f68f5205b3a in ?? () from /usr/lib/pulse-0.9.16/modules/libprotocol-native.so
#7 0x00007f68fe358f1c in pa_sink_input_peek () from /usr/lib/libpulsecore-0.9.16.so
#8 0x00007f68fe363a4a in ?? () from /usr/lib/libpulsecore-0.9.16.so
#9 0x00007f68fe3642a4 in pa_sink_render_into () from /usr/lib/libpulsecore-0.9.16.so
#10 0x00007f68fe36483f in pa_sink_render_into_full () from /usr/lib/libpulsecore-0.9.16.so
#11 0x00007f68f42dc3e2 in ?? () from /usr/lib/pulse-0.9.16/modules/libalsa-util.so
#12 0x00007f68fe107040 in ?? () from /usr/lib/libpulsecommon-0.9.16.so
#13 0x00007f68fd050a04 in start_thread (arg=<value optimized out>) at pthread_create.c:300
#14 0x00007f68fc72a64d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#15 0x0000000000000000 in ?? ()

[ShawnStarr (shawn-starr)]

Yes I can reproduce with the 1:0.9.16~test7-14-g7ca81-0ubuntu1~ubuntuaudiodev1 debs

crash below
=======

Program received signal SIGSEGV, Segmentation fault.
0x00007f23ec158dcd in malloc_consolidate (av=0x7f23ec44de40) at malloc.c:5103
5103 malloc.c: No such file or directory.
        in malloc.c
(gdb) bt
#0 0x00007f23ec158dcd in malloc_consolidate (av=0x7f23ec44de40) at malloc.c:5103
#1 0x00007f23ec15b439 in _int_malloc (av=0x7f23ec44de40, bytes=32516468) at malloc.c:4338
#2 0x00007f23ec15edf8 in malloc_check (sz=1056, caller=<value optimized out>) at hooks.c:264
#3 0x00007f23ec15d0a3 in __libc_calloc (n=<value optimized out>, elem_size=<value optimized out>) at malloc.c:4006
#4 0x00007f23ed95979f in pa_xmalloc0 (size=<value optimized out>) at pulse/xmalloc.c:76
#5 0x00007f23edb7ed1e in pa_hashmap_new (hash_func=0x7f23edb7ed80 <pa_idxset_string_hash_func>, compare_func=0x1f02974)
    at pulsecore/hashmap.c:62
#6 0x00007f23e4c9ee4f in command_create_playback_stream (pd=<value optimized out>, command=<value optimized out>,
    tag=<value optimized out>, t=0x1f720d0, userdata=0x1f22270) at pulsecore/protocol-native.c:1879
#7 0x00007f23edb8da76 in pa_pdispatch_run (pd=0x1eee770, packet=<value optimized out>, creds=<value optimized out>,
    userdata=0x1f22270) at pulsecore/pdispatch.c:331
#8 0x00007f23e4c97c39 in pstream_packet_callback (p=0x1f2a1b0, packet=0x1f19040, creds=0x1f2a300, userdata=0x1f22270)
    at pulsecore/protocol-native.c:4380
#9 0x00007f23edb920b4 in do_read (p=0x1f2a1b0) at pulsecore/pstream.c:816
#10 do_something (p=0x1f2a1b0) at pulsecore/pstream.c:184
#11 0x00007f23ed945583 in dispatch_pollfds (m=0x1ece680) at pulse/mainloop.c:712
#12 pa_mainloop_dispatch (m=0x1ece680) at pulse/mainloop.c:923
#13 0x00007f23ed9459b8 in pa_mainloop_iterate (m=0x1ece680, block=<value optimized out>, retval=0x7ffff343d89c)
    at pulse/mainloop.c:953
#14 0x00007f23ed945a60 in pa_mainloop_run (m=0x1ece680, retval=0x7ffff343d89c) at pulse/mainloop.c:968
#15 0x000000000040a136 in main (argc=<value optimized out>, argv=<value optimized out>) at daemon/main.c:924

Full dump
======

#0 0x00007f23ec158dcd in malloc_consolidate (av=0x7f23ec44de40) at malloc.c:5103
        fb = 0x7f23ec44de50
        maxfb = 0x7f23ec44de90
        p = 0x1f22150
        nextp = 0x1ef5de0
        unsorted_bin = 0x7f23ec44de98
        first_unsorted = <value optimized out>
        nextchunk = 0x1f22180
        size = 48
        nextsize = 0
        prevsize = <value optimized out>
        bck = 0x1f02974
        fwd = 0x0
        __PRETTY_FUNCTION__ = "malloc_consolidate"
#1 0x00007f23ec15b439 in _int_malloc (av=0x7f23ec44de40, bytes=32516468) at malloc.c:4338
        nb = 1072
        idx = <value optimized out>
        bin = <value optimized out>
        victim = 0x7ffff343d410
        size = <value optimized out>
        victim_index = <value optimized out>
        remainder = <value optimized out>
        remainder_size = <value optimized out>
        block = <value optimized out>
        bit = <value optimized out>
        map = <value optimized out>
        fwd = <value optimized out>
        bck = <value optimized out>
        __PRETTY_FUNCTION__ = "...

[Daniel T Chen (crimsun)]

Can you reproduce this symptom using the most current daily-live desktop Lucid image?

[Launchpad Janitor (janitor)]

[Expired for pulseaudio (Ubuntu) because there has been no activity for 60 days.]