[Gap-dev-discuss] Another crasher with AO

[Sebastian Reitenbach]

Hi,

with the patch I just sent, I get this on OpenBSD macppc, when I do the 
following:

Start Cynthiune
Double click a MP3
let it play for some seconds
Stop playing
Double click the same MP3 again

At least in this case, dev is not NULL, but parts of it, are already freed 
before.
Not sure whether this is a problem in Cynthiune, or in libao.

Program received signal SIGSEGV, Segmentation fault.
0x86c6d370 in ao_close (device=0x86e78100)
    at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
1421                    result = device->funcs->close(device);
(gdb) bt
#0  0x86c6d370 in ao_close (device=0x86e78100)
    at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
#1  0x8dd14e2c in -[AO prepareDeviceWithChannels:andRate:] (self=0x86efd008, 
    _cmd=0x185b16c, numberOfChannels=2, sampleRate=44100) at ao.m:97
#2  0x018152c0 in -[Player _reInitOutputIfNeeded:] (self=0x8d9c7308, 
    _cmd=0x185b17c, newStream=0x86f00008) at Player.m:281
#3  0x018153e4 in -[Player setStream:] (self=0x8d9c7308, _cmd=0x185e550, 
    newStream=0x86f00008) at Player.m:302
#4  0x0181e180 in -[PlaylistController _updatePlayerSong:] (self=0x86092408, 
    _cmd=0x185e618, song=0x86d86b88) at PlaylistController.m:429
#5  0x0182138c in -[PlaylistController tableDoubleClick:] (self=0x86092408, 
    _cmd=0x1860414, row=10) at PlaylistController.m:876
#6  0x018262c0 in -[PlaylistViewController doubleClick:] (self=0x860b8ac8, 
    _cmd=0x18603dc, sender=0x85fdf408) at PlaylistViewController.m:253
#7  0x82243da4 in -[NSApplication sendAction:to:from:] (self=0x84d15f88, 
    _cmd=0x825fbed8, aSelector=0x18603dc, aTarget=0x860b8ac8, 
    sender=0x85fdf408) at NSApplication.m:2232
#8  0x822d7040 in -[NSControl sendAction:to:] (self=0x85fdf408, 
    _cmd=0x82660f10, theAction=0x18603dc, theTarget=0x860b8ac8)
    at NSControl.m:759
#9  0x82434b24 in -[NSTableView mouseDown:] (self=0x85fdf408, _cmd=0x826829a4, 
    theEvent=0x86e9c288) at NSTableView.m:3562
#10 0x824c8828 in -[NSWindow sendEvent:] (self=0x8606e908, _cmd=0x825d95d8, 
---Type <return> to continue, or q <return> to quit---
    theEvent=0x86e9c288) at NSWindow.m:3729
#11 0x8224360c in -[NSApplication sendEvent:] (self=0x84d15f88, 
    _cmd=0x825d9510, theEvent=0x86e9c288) at NSApplication.m:2107
#12 0x82241584 in -[NSApplication run] (self=0x84d15f88, _cmd=0x825cef38)
    at NSApplication.m:1564
#13 0x82213e20 in NSApplicationMain (argc=1, argv=0xfffddb5c) at Functions.m:91
#14 0x01802b40 in gnustep_base_user_main (argc=1, argv=0xfffddb5c) at main.m:27
#15 0x81c2b720 in main (argc=1, argv=0xfffddb5c, env=0xfffddb64)
    at NSProcessInfo.m:989
#16 0x01802924 in ___start ()
#17 0x00000000 in ?? ()
(gdb) frame 0
#0  0x86c6d370 in ao_close (device=0x86e78100)
    at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
1421                    result = device->funcs->close(device);
(gdb) list
1416            int result;
1417
1418            if (device == NULL)
1419                    result = 0;
1420            else {
1421                    result = device->funcs->close(device);
1422                    device->funcs->device_clear(device);
1423
1424                    if (device->file) {
1425                            fclose(device->file);
(gdb) print device->funcs->close(device)
Cannot access memory at address 0xdeadfae6
(gdb) frame 1
#1  0x8dd14e2c in -[AO prepareDeviceWithChannels:andRate:] (self=0x86efd008, 
    _cmd=0x185b16c, numberOfChannels=2, sampleRate=44100) at ao.m:97
97          ao_close(dev);
Current language:  auto; currently minimal
(gdb) list
92        /* FIXME : this should somehow come from the input bundle */
93        format.bits = 16;
94        format.byte_format = AO_FMT_LITTLE;
95        [devlock lock];
96        if (dev) {
97          ao_close(dev);
98          dev = ao_open_live(driver, &format, NULL);
99          result = (dev == NULL) ? NO : YES;
100       }
101       [devlock unlock];
(gdb) frame 0
#0  0x86c6d370 in ao_close (device=0x86e78100)
    at /home/ports/pobj/libao-1.1.0/libao-1.1.0/src/audio_out.c:1421
1421                    result = device->funcs->close(device);
Current language:  auto; currently c
(gdb) print device
$1 = (ao_device *) 0x86e78100
(gdb) print device->funcs
$2 = (ao_functions *) 0xdeadface

So, device->funcs was already freed at some point in time before.

Sebastian