Re: [Gap-dev-discuss] Another crasher with AO

[Philippe Roussel]

Le 07/05/2012 18:52, Sebastian Reitenbach a écrit :
> Hi,
> 
> with the patch I just sent, I get this on OpenBSD macppc, when I do the 
> following:
> 
> Start Cynthiune
> Double click a MP3
> let it play for some seconds
> Stop playing
> Double click the same MP3 again

Works here on linux/i386.

> At least in this case, dev is not NULL, but parts of it, are already freed 
> before.
> Not sure whether this is a problem in Cynthiune, or in libao.

What libao backend do you use, sndio ?

Could you try the patch I sent in the other thread ? I wonder if setting
dev to NULL in -closeDevice could fix your crash.

Thanks,
Philippe

> Program received signal SIGSEGV, Segmentation fault.
> 0x86c6d370 in ao_close (device=0x86e78100)
>     at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
> 1421                    result = device->funcs->close(device);
> (gdb) bt
> #0  0x86c6d370 in ao_close (device=0x86e78100)
>     at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
> #1  0x8dd14e2c in -[AO prepareDeviceWithChannels:andRate:] (self=0x86efd008, 
>     _cmd=0x185b16c, numberOfChannels=2, sampleRate=44100) at ao.m:97
> #2  0x018152c0 in -[Player _reInitOutputIfNeeded:] (self=0x8d9c7308, 
>     _cmd=0x185b17c, newStream=0x86f00008) at Player.m:281
> #3  0x018153e4 in -[Player setStream:] (self=0x8d9c7308, _cmd=0x185e550, 
>     newStream=0x86f00008) at Player.m:302
> #4  0x0181e180 in -[PlaylistController _updatePlayerSong:] (self=0x86092408, 
>     _cmd=0x185e618, song=0x86d86b88) at PlaylistController.m:429
> #5  0x0182138c in -[PlaylistController tableDoubleClick:] (self=0x86092408, 
>     _cmd=0x1860414, row=10) at PlaylistController.m:876
> #6  0x018262c0 in -[PlaylistViewController doubleClick:] (self=0x860b8ac8, 
>     _cmd=0x18603dc, sender=0x85fdf408) at PlaylistViewController.m:253
> #7  0x82243da4 in -[NSApplication sendAction:to:from:] (self=0x84d15f88, 
>     _cmd=0x825fbed8, aSelector=0x18603dc, aTarget=0x860b8ac8, 
>     sender=0x85fdf408) at NSApplication.m:2232
> #8  0x822d7040 in -[NSControl sendAction:to:] (self=0x85fdf408, 
>     _cmd=0x82660f10, theAction=0x18603dc, theTarget=0x860b8ac8)
>     at NSControl.m:759
> #9  0x82434b24 in -[NSTableView mouseDown:] (self=0x85fdf408, 
> _cmd=0x826829a4, 
>     theEvent=0x86e9c288) at NSTableView.m:3562
> #10 0x824c8828 in -[NSWindow sendEvent:] (self=0x8606e908, _cmd=0x825d95d8, 
> ---Type <return> to continue, or q <return> to quit---
>     theEvent=0x86e9c288) at NSWindow.m:3729
> #11 0x8224360c in -[NSApplication sendEvent:] (self=0x84d15f88, 
>     _cmd=0x825d9510, theEvent=0x86e9c288) at NSApplication.m:2107
> #12 0x82241584 in -[NSApplication run] (self=0x84d15f88, _cmd=0x825cef38)
>     at NSApplication.m:1564
> #13 0x82213e20 in NSApplicationMain (argc=1, argv=0xfffddb5c) at 
> Functions.m:91
> #14 0x01802b40 in gnustep_base_user_main (argc=1, argv=0xfffddb5c) at 
> main.m:27
> #15 0x81c2b720 in main (argc=1, argv=0xfffddb5c, env=0xfffddb64)
>     at NSProcessInfo.m:989
> #16 0x01802924 in ___start ()
> #17 0x00000000 in ?? ()
> (gdb) frame 0
> #0  0x86c6d370 in ao_close (device=0x86e78100)
>     at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
> 1421                    result = device->funcs->close(device);
> (gdb) list
> 1416            int result;
> 1417
> 1418            if (device == NULL)
> 1419                    result = 0;
> 1420            else {
> 1421                    result = device->funcs->close(device);
> 1422                    device->funcs->device_clear(device);
> 1423
> 1424                    if (device->file) {
> 1425                            fclose(device->file);
> (gdb) print device->funcs->close(device)
> Cannot access memory at address 0xdeadfae6
> (gdb) frame 1
> #1  0x8dd14e2c in -[AO prepareDeviceWithChannels:andRate:] (self=0x86efd008, 
>     _cmd=0x185b16c, numberOfChannels=2, sampleRate=44100) at ao.m:97
> 97          ao_close(dev);
> Current language:  auto; currently minimal
> (gdb) list
> 92        /* FIXME : this should somehow come from the input bundle */
> 93        format.bits = 16;
> 94        format.byte_format = AO_FMT_LITTLE;
> 95        [devlock lock];
> 96        if (dev) {
> 97          ao_close(dev);
> 98          dev = ao_open_live(driver, &format, NULL);
> 99          result = (dev == NULL) ? NO : YES;
> 100       }
> 101       [devlock unlock];
> (gdb) frame 0
> #0  0x86c6d370 in ao_close (device=0x86e78100)
>     at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
> 1421                    result = device->funcs->close(device);
> Current language:  auto; currently c
> (gdb) print device
> $1 = (ao_device *) 0x86e78100
> (gdb) print device->funcs
> $2 = (ao_functions *) 0xdeadface
> 
> So, device->funcs was already freed at some point in time before.
> 
> Sebastian
>