[vlc-devel] Segfault when closing "Toolbars Editor" while media is open

[Fabian Keil]

Using vlc built from git (currently ad09e6fbfb12153) with Qt 4.8.2 on
FreeBSD 10-CURRENT amd64, I reproducible get a segfault like the following
upon closing the "Toolbars Editor" while media is open (playing or paused)
and provided the "Toolsbars Editor" was opened through the tooltip menu that
appears after right-clicking the viewport:

fk at r500 ~/git/vlc $gdb741 bin/vlc-static vlc-static.core
[GDB will not be able to debug user-mode threads: Undefined symbol "td_thr_getxmmregs"]
GNU gdb (GDB) 7.4.1 [GDB v7.4.1 for FreeBSD]
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd10.0".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/fk/git/vlc/bin/vlc-static...done.
[New process 100796]
[New process 101718]
[New process 101717]
[New process 101716]
[New process 101715]
[New process 101714]
[New process 101713]
[New process 100794]
[New process 100790]
[New process 100862]
Core was generated by `vlc-static'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000808f6dcba in QFlags<Qt::WindowType>::operator& (this=0x800000a76, f=Qt::WindowType_Mask) at ../../include/QtCore/../../src/corelib/global/qglobal.h:2309
2309        Q_DECL_CONSTEXPR inline QFlags operator&(Enum f) const { return QFlags(Enum(i & f)); }
(gdb) where
#0  0x0000000808f6dcba in QFlags<Qt::WindowType>::operator& (this=0x800000a76, f=Qt::WindowType_Mask) at ../../include/QtCore/../../src/corelib/global/qglobal.h:2309
#1  0x0000000808f6dd06 in QWidget::windowType (this=0x8042bc8e0) at ../../include/QtGui/../../src/gui/kernel/qwidget.h:935
#2  0x0000000809020f40 in QETWidget::translateMouseEvent (this=0x8042bc8e0, event=0x7fffff8fa800) at kernel/qapplication_x11.cpp:4453
#3  0x000000080901e720 in QApplication::x11ProcessEvent (this=0x7fffff8fae60, event=0x7fffff8fa800) at kernel/qapplication_x11.cpp:3503
#4  0x0000000809056e17 in x11EventSourceDispatch (s=0x804029700, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#5  0x000000080a5f9c1d in g_main_dispatch (context=0x80404d240) at gmain.c:2441
#6  0x000000080a5fb525 in g_main_context_dispatch (context=0x80404d240) at gmain.c:3014
#7  0x000000080a5fbaf6 in g_main_context_iterate (context=0x80404d240, block=1, dispatch=1, self=0x804012140) at gmain.c:3092
#8  0x000000080a5fbd69 in g_main_context_iteration (context=0x80404d240, may_block=1) at gmain.c:3155
#9  0x000000080a01ccc5 in QEventDispatcherGlib::processEvents (this=0x804010080, flags=...) at kernel/qeventdispatcher_glib.cpp:424
#10 0x0000000809056487 in QGuiEventDispatcherGlib::processEvents (this=0x804010080, flags=...) at kernel/qguieventdispatcher_glib.cpp:204
#11 0x0000000809fd69a0 in QEventLoop::processEvents (this=0x7fffff8fad40, flags=...) at kernel/qeventloop.cpp:149
#12 0x0000000809fd6bfd in QEventLoop::exec (this=0x7fffff8fad40, flags=...) at kernel/qeventloop.cpp:204
#13 0x0000000809fdacb1 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1187
#14 0x0000000808f60906 in QApplication::exec () at kernel/qapplication.cpp:3812
#15 0x0000000806e34d93 in Thread (obj=<optimized out>) at qt4.cpp:535
#16 0x00000008016a99f9 in thread_start (curthread=0x80240a000) at /usr/src/lib/libthr/thread/thr_create.c:284
#17 0x0000000000000000 in ?? ()

Apparently the 'this' pointer in #0 is bogus.

The last messages before the crash:
[0x8158353d8] xcb_xv vout display debug: display is visible
[0x8158353d8] main vout display debug: VoutDisplayEvent 'mouse button' 2 t=8
[0x8158353d8] xcb_xv vout display debug: display is visible
[0x8158353d8] main vout display debug: VoutDisplayEvent 'mouse button' 2 t=9
[0x8158353d8] main vout display debug: auto hiding mouse cursor
[0x8158353d8] xcb_xv vout display debug: display is visible
[0x8158353d8] main vout display debug: VoutDisplayEvent 'resize' 192x144 window
[0x8158353d8] main vout display debug: VoutDisplayEvent 'resize' 435x144 window
[0x8158353d8] xcb_xv vout display debug: display is not visible
[0x8158353d8] xcb_xv vout display debug: display is visible
[0x8158353d8] main vout display debug: VoutDisplayEvent 'resize' 435x162 window
[0x8158353d8] xcb_xv vout display debug: display is visible
[0x8158353d8] main vout display debug: VoutDisplayEvent 'resize' 435x144 window

The media type doesn't seem to matter, I tested with Ogg Vorbis,
mp3, Mov and DVDs. Whether or not changes are actually made in the
"Toolbars Editor" doesn't make a difference either.

Closing the "Toolbars Editor" works as expected if no media is playing
or if the editor has been opened through the menu at the top of the window.

My configure options are --disable-lua --disable-mad --enable-debug,
I initially compiled with gcc 4.6.3 and later reproduced the problem
with the gcc 4.2.1 from FreeBSD's base system.

Is anyone else seeing this, or should I try bisecting the commit
responsible for this?

Fabian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL: <http://mailman.videolan.org/pipermail/vlc-devel/attachments/20120624/f5c6eb1d/attachment.sig>