Bug 432482 - Crash in pa_stream_set_read_callback when closing popup
Summary: Crash in pa_stream_set_read_callback when closing popup
Status: RESOLVED FIXED
Alias: None
Product: plasma-pa
Classification: Plasma
Component: applet (show other bugs)
Version: unspecified
Platform: Other Linux
: VHI crash
Target Milestone: ---
Assignee: David Rosca
URL:
Keywords: regression
: 433159 433415 433465 (view as bug list)
Depends on:
Blocks:
 
Reported: 2021-02-03 21:18 UTC by Kai Uwe Broulik
Modified: 2021-05-18 21:21 UTC (History)
6 users (show)

See Also:
Latest Commit:
Version Fixed In: 5.21.1
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kai Uwe Broulik 2021-02-03 21:18:31 UTC
SUMMARY
I've just had plasma-pa randomly crash when closing it

STEPS TO REPRODUCE
1. plasmawindowed org.kde.plasma.volume
2. Go to applications tab
3. ???
4. Close plasmawindowed

OBSERVED RESULT
Boom.

Assertion 'pa_atomic_load(&(s)->_ref) >= 1' failed at pulse/stream.c:2083, function pa_stream_set_read_callback(). Aborting.

Thread 1 (Thread 0x7f44c187e8c0 (LWP 1626361)):
[KCrash Handler]
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5  0x00007f44c5846859 in __GI_abort () at abort.c:79
#6  0x00007f4496f52f3d in pa_stream_set_read_callback () at /usr/lib/x86_64-linux-gnu/libpulse.so.0
#7  0x00007f4496fce129 in QPulseAudio::VolumeMonitor::setTarget(QPulseAudio::VolumeObject*) (this=0x5644b4bf92c0, target=0x0) at /home/kaiuwe/Projekte/kf5/plasma-pa/src/volumemonitor.cpp:75
#8  0x00007f44c73a4b47 in QQmlPropertyData::writeProperty(QObject*, void*, QFlags<QQmlPropertyData::WriteFlag>) const (flags=..., value=0x7fff54c88bd8, target=<optimized out>, this=<optimized out>) at ../../include/QtQml/5.15.2/QtQml/private/../../../../../src/qml/qml/qqmlpropertydata_p.h:375
#9  QObjectPointerBinding::write(QV4::Value const&, bool, QFlags<QQmlPropertyData::WriteFlag>) (this=0x5644b4bff5b0, result=..., isUndefined=<optimized out>, flags=...) at qml/qqmlbinding.cpp:715
#10 0x00007f44c73a6333 in QQmlNonbindingBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlags<QQmlPropertyData::WriteFlag>, QV4::Scope&) (this=0x5644b4bff5b0, watcher=..., flags=..., scope=...) at ../../include/QtQml/5.15.2/QtQml/private/../../../../../src/qml/jsruntime/qv4scopedvalue_p.h:242
#11 0x00007f44c73a3102 in QQmlBinding::update(QFlags<QQmlPropertyData::WriteFlag>) (this=0x5644b4bff5b0, flags=...) at qml/qqmlbinding.cpp:194
#12 0x00007f44c737b64d in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) (endpoint=<optimized out>, a=a@entry=0x0) at qml/qqmlnotifier.cpp:104
#13 0x00007f44c731dfbf in QQmlData::signalEmitted(QAbstractDeclarativeData*, QObject*, int, void**) (object=0x5644b476f6a0, index=18, a=0x0) at qml/qqmlengine.cpp:834
#14 0x00007f44c5ede245 in doActivate<false>(QObject*, int, void**) (sender=0x5644b476f6a0, signal_index=18, argv=0x0) at kernel/qobject_p.h:110
#15 0x00007f44c77a7c9c in QQuickItemPrivate::setEffectiveVisibleRecur(bool) () at /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5
#16 0x00007f44c77a7c0f in QQuickItemPrivate::setEffectiveVisibleRecur(bool) () at /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5
#17 0x00007f44c77a7c0f in QQuickItemPrivate::setEffectiveVisibleRecur(bool) () at /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5
#18 0x00007f44c77a7d77 in QQuickItemPrivate::setVisible(bool) () at /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5
#19 0x00007f44c77b22c1 in  () at /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5
#20 0x00007f44c73a596f in QQmlPropertyData::writeProperty(QObject*, void*, QFlags<QQmlPropertyData::WriteFlag>) const (flags=..., value=0x7fff54c8aadf, target=<optimized out>, this=<optimized out>) at ../../include/QtQml/5.15.2/QtQml/private/../../../../../src/qml/qml/qqmlpropertydata_p.h:375
#21 GenericBinding<1>::doStore<bool>(bool, QQmlPropertyData const*, QFlags<QQmlPropertyData::WriteFlag>) const (flags=..., pd=<optimized out>, value=<optimized out>, this=<optimized out>) at qml/qqmlbinding.cpp:342
#22 GenericBinding<1>::write(QV4::Value const&, bool, QFlags<QQmlPropertyData::WriteFlag>) (this=0x5644b4513740, result=..., isUndefined=<optimized out>, flags=...) at qml/qqmlbinding.cpp:305
...

pa_stream_set_read_callback

EXPECTED RESULT
No crash/assert :)

SOFTWARE/OS VERSIONS
KDE Plasma Version: 5.21 git master as of today
Comment 1 David Edmundson 2021-02-03 21:58:06 UTC
Do you have a self-built pulseaudio? It's an assert, I assume that's not on in debug builds.

Is it reproducible?


I think I have a potential patch, but it's written blind.

     if (m_stream) {
-        pa_stream_disconnect(m_stream);
-        pa_stream_unref(m_stream);
         pa_stream_set_read_callback(m_stream, nullptr, nullptr);
         pa_stream_set_suspended_callback(m_stream, nullptr, nullptr);
+        pa_stream_disconnect(m_stream);
+        pa_stream_unref(m_stream);
Comment 2 Kai Uwe Broulik 2021-02-04 09:56:58 UTC
Got another crash, though backtrace different:

Thread 1 (Thread 0x7f548e57c8c0 (LWP 1668584)):
[KCrash Handler]
#4  std::__atomic_base<QObjectPrivate::Connection*>::load(std::memory_order) const (__m=std::memory_order_acquire, this=0x51) at /usr/include/c++/9/bits/atomic_base.h:734
#5  std::atomic<QObjectPrivate::Connection*>::load(std::memory_order) const (__m=std::memory_order_acquire, this=0x51) at /usr/include/c++/9/atomic:519
#6  QAtomicOps<QObjectPrivate::Connection*>::loadAcquire<QObjectPrivate::Connection*>(std::atomic<QObjectPrivate::Connection*> const&) (_q_value=...) at ../../include/QtCore/../../src/corelib/thread/qatomic_cxx11.h:251
#7  QBasicAtomicPointer<QObjectPrivate::Connection>::loadAcquire() const (this=0x51) at ../../include/QtCore/../../src/corelib/thread/qbasicatomic.h:255
#8  QObjectPrivate::maybeSignalConnected(unsigned int) const (this=this@entry=0x55eebbf578f0, signalIndex=signalIndex@entry=3) at kernel/qobject.cpp:486
#9  0x00007f5492bdc274 in doActivate<false>(QObject*, int, void**) (sender=0x55eebbfe0330, signal_index=3, argv=0x7ffdc710a900) at kernel/qobject_p.h:110
#10 0x00007f5492bd5a87 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (sender=sender@entry=0x55eebbfe0330, m=m@entry=0x7f5463cad100 <QPulseAudio::VolumeMonitor::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x0) at kernel/qobject.cpp:3946
#11 0x00007f5463c41454 in QPulseAudio::VolumeMonitor::volumeChanged() (this=this@entry=0x55eebbfe0330) at /home/kaiuwe/Projekte/kf5/plasma-pa/build/src/plasma-volume-declarative_autogen/EWIEGA46WW/moc_volumemonitor.cpp:215
#12 0x00007f5463c7df92 in QPulseAudio::VolumeMonitor::updateVolume(double) (this=this@entry=0x55eebbfe0330, volume=<optimized out>) at /home/kaiuwe/Projekte/kf5/plasma-pa/src/volumemonitor.cpp:58
#13 0x00007f5463c7e055 in QPulseAudio::VolumeMonitor::read_callback(pa_stream*, unsigned long, void*) (s=0x55eebbf61550, length=<optimized out>, userdata=0x55eebbfe0330) at /home/kaiuwe/Projekte/kf5/plasma-pa/src/volumemonitor.cpp:173
#14 0x00007f5463be6361 in  () at /usr/lib/x86_64-linux-gnu/libpulse.so.0
#15 0x00007f5463952d15 in  () at /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-13.99.so
#16 0x00007f546395572b in  () at /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-13.99.so
#17 0x00007f5463955aea in  () at /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-13.99.so
#18 0x00007f546395637a in  () at /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-13.99.so
#19 0x00007f5478038556 in  () at /usr/lib/x86_64-linux-gnu/libpulse-mainloop-glib.so.0
#20 0x00007f5490e14f9d in g_main_context_dispatch () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#21 0x00007f5490e15220 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#22 0x00007f5490e152c3 in g_main_context_iteration () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#23 0x00007f5492bfffbb in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x55eebab2f630, flags=...) at kernel/qeventdispatcher_glib.cpp:425
#24 0x00007f5492ba41ab in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7ffdc710ad10, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:141
#25 0x00007f5492bac354 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#26 0x000055eeba53c8e6 in  ()
#27 0x00007f54925460b3 in __libc_start_main (main=0x55eeba53c4a0, argc=2, argv=0x7ffdc710af48, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffdc710af38) at ../csu/libc-start.c:308
#28 0x000055eeba53c9ae in  ()
[Inferior 1 (process 1668584) detached]
Comment 3 Kai Uwe Broulik 2021-02-04 10:01:26 UTC
The second crash isn't from your patch. But I can at least easily repoduce it using arecord.

Go to applications tab, do `arecord ~/foo.wav`, Ctrl+C, and do it again. It will crash.
Comment 4 David Redondo 2021-02-19 08:00:25 UTC
*** Bug 433159 has been marked as a duplicate of this bug. ***
Comment 5 David Edmundson 2021-02-19 10:27:16 UTC
https://invent.kde.org/plasma/plasma-pa/-/merge_requests/51

Can't reproduce with arecord, but maybe something else in plasma is ref'ing the stream for me, which is why it's not consistent.
Comment 6 David Edmundson 2021-02-19 14:07:38 UTC
Git commit f720efe73cb4bd31e916c8fb4e0268dcfdfac9d9 by David Edmundson.
Committed on 19/02/2021 at 10:23.
Pushed by davidedmundson into branch 'master'.

Unref stream after unsetting callbacks

M  +2    -2    src/volumemonitor.cpp

https://invent.kde.org/plasma/plasma-pa/commit/f720efe73cb4bd31e916c8fb4e0268dcfdfac9d9
Comment 7 David Edmundson 2021-02-19 14:18:20 UTC
Git commit 02c07a571651aaa22683dc9b6f08aee5ded8403b by David Edmundson.
Committed on 19/02/2021 at 14:18.
Pushed by davidedmundson into branch 'Plasma/5.21'.

Unref stream after unsetting callbacks


(cherry picked from commit f720efe73cb4bd31e916c8fb4e0268dcfdfac9d9)

M  +2    -2    src/volumemonitor.cpp

https://invent.kde.org/plasma/plasma-pa/commit/02c07a571651aaa22683dc9b6f08aee5ded8403b
Comment 8 Nate Graham 2021-02-22 21:23:49 UTC
*** Bug 433415 has been marked as a duplicate of this bug. ***
Comment 9 David Edmundson 2021-02-22 22:25:50 UTC
Lets assume that fixes it, until there is any information otherwise
Comment 10 Nate Graham 2021-02-23 06:35:08 UTC
*** Bug 433465 has been marked as a duplicate of this bug. ***