1057867 - crash in gstreamer/liboil code, after using google (gmail) contacts which opens google plus talk widget

Status: RESOLVED DUPLICATE of bug 981869

Description

[David Baron :dbaron: ⌚️UTC-7]

Twice in the past month (once on August 5, again today) I've crashed in gstreamer/liboil code.

In the case of today's crash, I actually have a reasonably good idea of what site caused it:  I had gone to google contacts (gmail contacts) to add and edit a contact, and from the process's standard output I could see:

JavaScript warning: https://talkgadget.google.com/_/scs/talk-static/_/js/k=wcs.wbl.en.b9IEM-Onv_g.O/m=b,r/am=RKjSkABAACEaMHA/rt=j/d=1/rs=AItRSTPLbX9TxfKXYpOEgXzMTDFSDx99Zg, line 1073: Using //@ to indicate sourceURL pragmas is deprecated. Use //# instead

and (a printf that's in my own build):

nsDocShell(0x82540560)::LoadURI(https://plus.google.com/hangouts/_/pre?hl=en&authuser=0)


Then I crashed with what appears to be the same crash on two different threads at the same time, with their stacks interleaved:

[Parent 5351] WARNING: gst_app_src_set_size: assertion 'GST_IS_APP_SRC (appsrc)' failed: 'glib warning', file /home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsSigHandlers.cpp, line 141

** (firefox:5351): CRITICAL **: gst_app_src_set_size: assertion 'GST_IS_APP_SRC (appsrc)' failed
[Parent 5351] WARNING: gst_app_src_set_size: assertion 'GST_IS_APP_SRC (appsrc)' failed: 'glib warning', file /home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsSigHandlers.cpp, line 141

** (firefox:5351): CRITICAL **: gst_app_src_set_size: assertion 'GST_IS_APP_SRC (appsrc)' failed

Program /home/dbaron/bin/running-firefox/firefox (pid = 5351) received signal 11.
Stack:

Program /home/dbaron/bin/running-firefox/firefox (pid = 5351) received signal 11.
Stack:
AsmJSFaultHandler (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/asmjs/AsmJSSignalHandlers.cpp:974)
AsmJSFaultHandler (/home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/asmjs/AsmJSSignalHandlers.cpp:974)
__restore_rt (sigaction.c:?)
__restore_rt (sigaction.c:?)
oil_init_structs (/build/buildd/liboil-0.3.17/liboil/liboilfunction.c:450)
oil_init_structs (/build/buildd/liboil-0.3.17/liboil/liboilfunction.c:450)
oil_init (/build/buildd/liboil-0.3.17/liboil/liboilfunction.c:141)
oil_init (/build/buildd/liboil-0.3.17/liboil/liboilfunction.c:141)
mp3_c_init (/build/buildd/gst-fluendo-mp3-0.10.23.debian/build-0.10/src/../../src/mp3-c.c:1838)
mp3_c_init (/build/buildd/gst-fluendo-mp3-0.10.23.debian/build-0.10/src/../../src/mp3-c.c:1838)
mp3tl_new (/build/buildd/gst-fluendo-mp3-0.10.23.debian/build-0.10/src/../../src/mp3tl.c:64)
mp3tl_new (/build/buildd/gst-fluendo-mp3-0.10.23.debian/build-0.10/src/../../src/mp3tl.c:64)
gst_flump3dec_init (/build/buildd/gst-fluendo-mp3-0.10.23.debian/build-0.10/src/../../src/flump3dec-0_10.c:1013)
gst_flump3dec_init (/build/buildd/gst-fluendo-mp3-0.10.23.debian/build-0.10/src/../../src/flump3dec-0_10.c:1013)
g_type_create_instance (/build/buildd/glib2.0-2.40.0/./gobject/gtype.c:1873)
g_type_create_instance (/build/buildd/glib2.0-2.40.0/./gobject/gtype.c:1873)
g_object_new_internal (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1726)
g_object_new_internal (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1726)
g_object_newv (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1870)
g_object_newv (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1870)
gst_element_factory_create (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_element_factory_create (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
connect_pad (/build/buildd/gst-plugins-base0.10-0.10.36/gst/playback/gstdecodebin2.c:1882)
connect_pad (/build/buildd/gst-plugins-base0.10-0.10.36/gst/playback/gstdecodebin2.c:1882)
pad_added_cb (/build/buildd/gst-plugins-base0.10-0.10.36/gst/playback/gstdecodebin2.c:2334)
pad_added_cb (/build/buildd/gst-plugins-base0.10-0.10.36/gst/playback/gstdecodebin2.c:2334)
caps_notify_cb (/build/buildd/gst-plugins-base0.10-0.10.36/gst/playback/gstdecodebin2.c:2450 (discriminator 2))
caps_notify_cb (/build/buildd/gst-plugins-base0.10-0.10.36/gst/playback/gstdecodebin2.c:2450 (discriminator 2))
closure_invoke_notifiers (/build/buildd/glib2.0-2.40.0/./gobject/gclosure.c:272)
closure_invoke_notifiers (/build/buildd/glib2.0-2.40.0/./gobject/gclosure.c:272)
accumulate (/build/buildd/glib2.0-2.40.0/./gobject/gsignal.c:3056)
accumulate (/build/buildd/glib2.0-2.40.0/./gobject/gsignal.c:3056)
g_signal_emit_valist (/build/buildd/glib2.0-2.40.0/./gobject/gsignal.c:3335 (discriminator 1))
g_signal_emit_valist (/build/buildd/glib2.0-2.40.0/./gobject/gsignal.c:3335 (discriminator 1))
g_signal_emit (/build/buildd/glib2.0-2.40.0/./gobject/gsignal.c:3365)
g_signal_emit (/build/buildd/glib2.0-2.40.0/./gobject/gsignal.c:3365)
g_object_dispatch_properties_changed (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1052 (discriminator 2))
g_object_dispatch_properties_changed (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1052 (discriminator 2))
gst_object_get_parent (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_object_get_parent (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
g_object_notify_by_spec_internal (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1147)
g_object_notify_by_spec_internal (/build/buildd/glib2.0-2.40.0/./gobject/gobject.c:1147)
gst_pad_set_caps (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_pad_set_caps (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_mpeg_audio_parse_parse_frame (/build/buildd/gst-plugins-good0.10-0.10.31/gst/audioparsers/gstmpegaudioparse.c:994)
gst_mpeg_audio_parse_parse_frame (/build/buildd/gst-plugins-good0.10-0.10.31/gst/audioparsers/gstmpegaudioparse.c:994)
gst_base_parse_set_duration (/usr/lib/x86_64-linux-gnu/libgstbase-0.10.so.0)
gst_base_parse_set_duration (/usr/lib/x86_64-linux-gnu/libgstbase-0.10.so.0)
gst_base_parse_set_duration (/usr/lib/x86_64-linux-gnu/libgstbase-0.10.so.0)
gst_base_parse_set_duration (/usr/lib/x86_64-linux-gnu/libgstbase-0.10.so.0)
gst_tag_setter_get_tag_merge_mode (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_pad_get_pad_template_caps (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
g_thread_pool_thread_proxy (/build/buildd/glib2.0-2.40.0/./glib/gthreadpool.c:308)
gst_pad_push (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
g_thread_proxy (/build/buildd/glib2.0-2.40.0/./glib/gthread.c:764)
UNKNOWN  (/usr/lib/x86_64-linux-gnu/gstreamer-0.10/libgstcoreelements.so)
start_thread (/build/buildd/eglibc-2.19/nptl/pthread_create.c:312 (discriminator 2))
gst_pad_get_pad_template_caps (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
__clone (/build/buildd/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:113)
gst_pad_push (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
UNKNOWN (nil)
Sleeping for 300 seconds.
Type 'gdb /home/dbaron/bin/running-firefox/firefox 5351' to attach your debugger to this thread.
gst_pad_get_pad_template_caps (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_pad_push (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
gst_base_src_wait_playing (/usr/lib/x86_64-linux-gnu/libgstbase-0.10.so.0)
gst_tag_setter_get_tag_merge_mode (/usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0)
g_thread_pool_thread_proxy (/build/buildd/glib2.0-2.40.0/./glib/gthreadpool.c:308)
g_thread_proxy (/build/buildd/glib2.0-2.40.0/./glib/gthread.c:764)
start_thread (/build/buildd/eglibc-2.19/nptl/pthread_create.c:312 (discriminator 2))
__clone (/build/buildd/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:113)
UNKNOWN (nil)
Sleeping for 300 seconds.
Type 'gdb /home/dbaron/bin/running-firefox/firefox 5351' to attach your debugger to this thread.


I didn't notice that anything had happened until the 300 second timeout elapsed, since other threads were still happily running, so I don't have any further debugging information.

This seems vaguely similar to bug 935458, but that bug has no mention of this particular gstreamer assertion, so I thought this seemed better as a separate bug.

I'm running Ubuntu 14.04 LTS.

In the case of today's crash, I was running my own Linux 64 debug build based on https://hg.mozilla.org/mozilla-central/rev/37ac55a26014 plus my patch queue as of Sun Aug 17 21:21:41 2014 -0700.

Comment 1

[David Baron :dbaron: ⌚️UTC-7]

Though I managed to reproduce the:

** (firefox:661): CRITICAL **: gst_app_src_set_size: assertion 'GST_IS_APP_SRC (appsrc)' failed

without reproducing the crash, so I'm not sure they're related.

Comment 2

[David Baron :dbaron: ⌚️UTC-7]

Created attachment 8478016 [details]
stack for CRITICAL **: gst_app_src_set_size: assertion 'GST_IS_APP_SRC (appsrc)' failed

This makes me less likely to think the crash and the assertion are related.

Comment 3

[David Baron :dbaron: ⌚️UTC-7]

Is it relevant that I started seeing this soon after bug 1034957 landed?

Comment 4

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

flump3dec/liboil are known to be a problem combination, not limited to FF (see [1]). There's a patch in bug 981869 in need of some review love to blacklist this plugin.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=981869#c15