[mythtv] segfault problem with current CVS.

[Matt Zimmerman]

On Sun, Feb 23, 2003 at 11:46:25AM -0500, Chris Pinkham wrote:

> I'm receiving a segfault running current CVS code and was wondering if
> anyone else was noticing or receiving this.  [...] In
> MC/libs/libavcodec/mpegvideo.c around line 363 you'll find a line like
> this:
> 
>     av_freep(&pic->mbskip_table);
> 
> That's the line it's segfaulting on.  If I comment out that line (just to
> test), then it just segfaults later so obviously something is seriously
> hosed.

I think I have seen the same bug before.  My stack traces looked like this:

#0  0x408ceeae in mallopt () from /lib/libc.so.6
#1  0x408cde81 in free () from /lib/libc.so.6
#2  0x080ea51c in av_free (ptr=0x8573ed0) at mem.c:76
#3  0x080e913c in __av_freep (ptr=0x85589c4) at utils.c:76
#4  0x080eb3d2 in free_picture (s=0x8558810, pic=0x8558970) at mpegvideo.c:338
#5  0x080ec23f in MPV_common_end (s=0x8558810) at mpegvideo.c:525
#6  0x0817d5e6 in ff_h263_decode_end (avctx=0x8553750) at h263dec.c:121
#7  0x080e9991 in avcodec_close (avctx=0x8553750) at utils.c:346
#8  0x08099eb4 in NuppelVideoPlayer::CloseAVCodec (this=0x40efe008) at NuppelVideoPlayer.cpp:787
#9  0x0809826e in NuppelVideoPlayer::~NuppelVideoPlayer (this=0x40efe008, __in_chrg=3) at NuppelVideoPlayer.cpp:187
#10 0x080ddd2a in TV::TeardownPlayer (this=0x41919228) at tv_play.cpp:525
#11 0x080dd565 in TV::HandleStateChange (this=0x41919228) at tv_play.cpp:449
#12 0x080ddea0 in TV::RunTV (this=0x41919228) at tv_play.cpp:597
#13 0x080ddde8 in TV::EventThread (param=0x41919228) at tv_play.cpp:571
#14 0x406e8048 in pthread_start_thread () from /lib/libpthread.so.0

I had some system stability problems at the time, though, so I wrote it off.
I have had at least one similar crash since the other problems were fixed,
though, but I haven't caught it in the debugger to verify that it is exactly
the same.

If you can get it to run under valgrind or another malloc debugger, it might
be able to track down a problem.  This could be free()ing an invalid
address, free()ing the same memory more than once, heap corruption, etc.

If you catch it in a debugger, also take a look inside the avctx and see if
anything looks bogus.

-- 
 - mdz