[gst-devel] jpegdec segfaults

[Xavier B. <xav...@fr...>]

I added typefind to jpegdec (patch below), but now I have a problem: it
segfaults on buffer_unref on the output buffer. I tried to follow the
code but to me it seems the buffer's life cycle is normal. In short: I
don't understand.

The pipeline I run is:
gst-launch --gst-mask=-1 --gst-scheduler=basic gnomevfssrc location=/home/xav/Ptc_titre2000_n_b_08_s.jpg bytesperread=1000000000 ! jpegdec ! fakesink

The last lines of the log:
DEBUG(23102: 0)gst_jpegdec_chain:242: gst_jpegdec_chain: decompressing 1
DEBUG(23102: 0)gst_jpegdec_chain:259: gst_jpegdec_chain: decompressing finished
DEBUG(23102: 0)gst_jpegdec_term_source:117: gst_jpegdec_chain: term_source
DEBUG(23102: 0)gst_jpegdec_chain:262: gst_jpegdec_chain: sending buffer
DEBUG(23102: 0)gst_pad_push:1832: (jpegdec0:src): entering
DEBUG(23102: 0)gst_pad_push:1843: calling chainhandler &gst_basic_scheduler_chainhandler_proxy of peer pad fakesink0:sink
DEBUG(23102: 0)gst_basic_scheduler_chainhandler_proxy:401: (fakesink0:sink): entering
DEBUG(23102: 0)gst_basic_scheduler_chainhandler_proxy:403: putting buffer 0x80a1488 in peer "jpegdec0:src"'s pen
DEBUG(23102: 0)gst_basic_scheduler_chainhandler_proxy:434: switching to 0xbfe40000
INFO (23102: 0)cothread_switch:491: switching from cothread #2 to cothread #3
DEBUG(23102: 0)cothread_switch:505: exit thread #2 0 0xbfe3fffc<->0xbfe40000 (4) 0xbfe20020
DEBUG(23102: 0)cothread_switch:512: set stack to 0xbfe5fffc
DEBUG(23102: 0)cothread_switch:515: in thread 0xbfe40020
DEBUG(23102: 0)cothread_switch:501: enter thread #3 1 0xbfe5fffc<->0xbfe60000 (4) 0xbfe40020
DEBUG(23102: 0)gst_basic_scheduler_gethandler_proxy:498: done switching
DEBUG(23102: 0)gst_basic_scheduler_chain_wrapper:321: calling chain function of fakesink0:sink
DEBUG(23102: 0)gst_element_dispatch_properties_changed:238: deep notification from fakesink0 to pipeline0 (last-message)
fakesink0: last-message = "chain   ******* (fakesink0:sink)< (81000 bytes, -1) 0x80a1488"
INFO (23102: 0)gst_buffer_unref:396: unref buffer 0x80a1488, current count is 1
INFO (23103: 0)gst_buffer_destroy:298: freeing buffer 0x80a1488

The bt at the segfault:
Program received signal SIGSEGV, Segmentation fault.
0x40275bdd in free () from /lib/libc.so.6
(gdb) whe
#0  0x40275bdd in free () from /lib/libc.so.6
#1  0x40275aa3 in free () from /lib/libc.so.6
#2  0x401c1b9e in g_free () from /usr/lib/libglib-2.0.so.0
#3  0x4002763b in gst_buffer_destroy (buffer=0x80a1488) at gstbuffer.c:308
#4  0x40027924 in gst_buffer_unref (buffer=0x80a1488) at gstbuffer.c:410
#5  0x40525e9f in gst_fakesink_chain (pad=0x809934c, buf=0x80a1488) at gstfakesink.c:293
#6  0x4006570f in gst_basic_scheduler_chain_wrapper (argc=0, argv=0x809f6f8) at gstbasicscheduler.c:322
#7  0x4006956e in cothread_stub () at cothreads.c:359
#8  0x40069919 in cothread_switch (thread=0xbfe40000) at cothreads.c:523
#9  0x400688c5 in gst_basic_scheduler_iterate (sched=0x8093348) at gstbasicscheduler.c:1327
#10 0x40041bc2 in gst_scheduler_iterate (sched=0x8093348) at gstscheduler.c:587
#11 0x40026aae in gst_bin_iterate_func (bin=0x8092b80) at gstbin.c:830
#12 0x40026c30 in gst_bin_iterate (bin=0x8092b80) at gstbin.c:872
#13 0x080490f0 in idle_func (data=0x8092b80) at gst-launch.c:23
#14 0x401bf126 in g_timeout_add () from /usr/lib/libglib-2.0.so.0
#15 0x401bca09 in g_get_current_time () from /usr/lib/libglib-2.0.so.0
#16 0x401bd827 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#17 0x401bdc03 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#18 0x401be2df in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#19 0x4002211f in gst_main () at gst.c:515
#20 0x0804982e in main (argc=8, argv=0xbffff9f4) at gst-launch.c:205




The patch (NOTE: this does NOT fix the segfault):


Index: gstjpeg.c
===================================================================
RCS file: /cvsroot/gstreamer/gst-plugins/ext/jpeg/gstjpeg.c,v
retrieving revision 1.4
diff -u -r1.4 gstjpeg.c
--- gstjpeg.c	31 May 2002 08:24:28 -0000	1.4
+++ gstjpeg.c	18 Jun 2002 07:58:29 -0000
@@ -54,10 +54,33 @@
   	  NULL));
 }
 
+/* typefind stuff */
+static GstCaps*
+jpeg_type_find (GstBuffer *buf, gpointer private)
+{
+  gulong head = GUINT16_FROM_BE(*((gushort *)GST_BUFFER_DATA(buf)));
+  GstCaps *new = NULL;
+
+  /* minimal check for now */
+  if (head == 0xffd8) {
+    
+    new = gst_caps_new ("jpeg_type_find",
+                        "video/jpeg",
+			NULL
+		       );
+  }
+  return new;
+}
+
+static GstTypeDefinition jpeg_definition = {
+  "jpeg_jpeg", "video/jpeg", ".jpg", jpeg_type_find 
+};
+
 static gboolean
 plugin_init (GModule *module, GstPlugin *plugin)
 {
   GstElementFactory *dec, *enc;
+  GstTypeFactory *type;
   GstCaps *raw_caps, *jpeg_caps;
 
   /* create an elementfactory for the jpegdec element */
@@ -101,6 +124,9 @@
   gst_element_factory_add_pad_template (dec, jpegdec_src_template);
   
   gst_plugin_add_feature (plugin, GST_PLUGIN_FEATURE (dec));
+
+  type = gst_type_factory_new (&jpeg_definition);
+  gst_plugin_add_feature (plugin, GST_PLUGIN_FEATURE (type));
 
   return TRUE;
 }
Index: gstjpegdec.c
===================================================================
RCS file: /cvsroot/gstreamer/gst-plugins/ext/jpeg/gstjpegdec.c,v
retrieving revision 1.5
diff -u -r1.5 gstjpegdec.c
--- gstjpegdec.c	20 Apr 2002 21:42:21 -0000	1.5
+++ gstjpegdec.c	18 Jun 2002 07:58:32 -0000
@@ -99,7 +99,9 @@
 static void
 gst_jpegdec_skip_input_data (j_decompress_ptr cinfo, glong num_bytes)
 {
-  GST_DEBUG (0,"gst_jpegdec_chain: skip_input_data");
+  GST_DEBUG (0,"gst_jpegdec_chain: skip_input_data %ld bytes", num_bytes);
+  cinfo->src->next_input_byte += num_bytes;
+  cinfo->src->bytes_in_buffer -= num_bytes;
 }
 
 static gboolean