XBMC suddenly started crashing (segfault)

[parena]

Well, XBMC was working fine, but suddenly I'm getting crashes. It's 100% reproducable for me. It happens when I'm watching something and I press the loudspeaker button, the one that triggers the panel with subtitles. This happens for movies without subtitles as well. Running strace, I get this part when it crashes:

--- SIGSEGV (Segmentation fault) @ 0 (0) ---
rt_sigaction(SIGSEGV, {SIG_DFL, [SEGV], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, {0x7f450a7a9e90, [], SA_RESTORER, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, {SIG_DFL, [], SA_RESTORER, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, {SIG_DFL, [INT], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, {0x7f450a7b1300, [TERM], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, 8) = 0
select(11, [10], [10], NULL, NULL) = 1 (out [10])
writev(10, [{"_\0\2\0\v\0\340\5+\0\1\0", 12}], 1) = 12
select(11, [10], [], NULL, NULL) = 1 (in [10])
read(10, "\1\1\351\0\0\0\0\0\3\0\340\5\0\0\0\0\20o\263\1\0\0 \0\0\0\0\0\0\0\0\0\0", 4096) = 32
read(10, 0x118a9a4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
select(12, [11], [11], NULL, NULL) = 1 (out [11])
writev(11, [{"+\3\1\0", 4}], 1) = 4
select(12, [11], [], NULL, NULL) = 1 (in [11])
read(11, "\1\1\23\0\0\0\0\0\3\0\340\5\0\0\0\0\20^\356\3\0\0\ 0\0\0\0\0\0\0\0\0\0", 4096) = 32
read(11, 0x1191ed4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
select(11, [10], [10], NULL, NULL) = 1 (out [10])
writev(10, [{"\224\2\2\0\24\0\340\5+\2\1\0", 12}], 1) = 12
select(11, [10], [], NULL, NULL) = 1 (in [10])
read(10, "\1\1\353\0\0\0\0\0\3\0\340\5\0\0\0\0\20o\263\1\0\0 \0\0\0\0\0\0\0\0\0\0", 4096) = 32
read(10, 0x118a9a4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
shmdt(0x7f45029b1000) = 0
select(11, [10], [10], NULL, NULL) = 1 (out [10])
writev(10, [{"\n\2\2\0\3\0\340\5\4\2\2\0\21\0\340\5<\2\2\0\22\0\340\5O\2\2\0\20\0\340\5"..., 36}], 1) = 36
select(11, [10], [], NULL, NULL) = 1 (in [10])
read(10, "\22F\354\0\3\0\340\5\3\0\340\5\0\0\0\0`;\265\0\0\0 \0\0\260\305}\0\0\0\0\0"..., 4096) = 192
read(10, 0x118a9a4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
select(11, [10], [10], NULL, NULL) = 1 (out [10])
writev(10, [{"k\2\3\0006\1d\0\1\0\0\0\213\4\1\0_\4\2\0\7\0\340\5 +\4\1\0", 28}], 1) = 28
select(11, [10], [], NULL, NULL) = 1 (in [10])
read(10, "\1\1\364\0\0\0\0\0\1\0\0\0\0\0\0\0\20o\263\1\0\0\0 \0\0\0\0\0\0\0\0\0", 4096) = 32
read(10, 0x118a9a4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
select(12, [11], [11], NULL, NULL) = 1 (out [11])
writev(11, [{"<\3\2\0\0\0\0\6+\3\1\0", 12}], 1) = 12
select(12, [11], [], NULL, NULL) = 1 (in [11])
read(11, "\1\1\25\0\0\0\0\0\2\0\0\3\0\0\0\0\20^\356\3\0\0\0\ 0\0\0\0\0\0\0\0\0", 4096) = 32
read(11, 0x1191ed4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
close(11) = 0
select(11, [10], [10], NULL, NULL) = 2 (in [10], out [10])
read(10, "\34\0\364\0\3\0\340\5\363\0\0\0\"\5V\10\1\263}\0\0\0\0\0\23\0\0\0\0\0\0\0"..., 4096) = 224
writev(10, [{"<\4\2\0\0\0\340\5+\4\1\0", 12}], 1) = 12
select(11, [10], [], NULL, NULL) = 1 (in [10])
read(10, "\1\1\366\0\0\0\0\0\2\0\0\3\0\0\0\0\20o\263\1\0\0\0 \0\0\0\0\0\0\0\0\0", 4096) = 32
read(10, 0x118a9a4, 4096) = -1 EAGAIN (Resource temporarily unavailable)
close(10) = 0
rt_sigaction(SIGSEGV, NULL, {SIG_DFL, [SEGV], SA_RESTORER|SA_RESTART, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGBUS, NULL, {0x7f450a7a9e90, [], SA_RESTORER, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGBUS, {SIG_DFL, [], SA_RESTORER, 0x7f4508bec6e0}, NULL, 8) = 0
rt_sigaction(SIGFPE, NULL, {0x7f450a7a9e90, [], SA_RESTORER, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGFPE, {SIG_DFL, [], SA_RESTORER, 0x7f4508bec6e0}, NULL, 8) = 0
rt_sigaction(SIGQUIT, NULL, {0x7f450a7a9e90, [], SA_RESTORER, 0x7f4508bec6e0}, 8) = 0
rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x7f4508bec6e0}, NULL, 8) = 0
tgkill(21233, 21233, SIGSEGV) = 0
rt_sigreturn(0x52f1) = 4071938384
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

Doesn't look very helpful to me. Can the cause be a package on my openSUSE 11.1 that was updated or something? And why doesn't it crash when I press the 'movie reel' button?

I tested this with avi, mp4, mkv and a dvd iso. The dvd iso does not crash, it shows the panel. The avi, mp4 and mkv all make it crash.

[tslayer]

gdb backtrace on the core will be much more useful.

Thanks,

[parena]

I type start, no debugging symbols found, nothing much happens. Then I type continue. I start a movie, press the loudspeaker icon and this is the result (this starts with the first continue, after the no debuggin symbols found message):

(gdb) continue
Continuing.
[New Thread 0x7fffeb84f950 (LWP 22366)]
[New Thread 0x7fffeaee6950 (LWP 22367)]
[New Thread 0x7fffea0b6950 (LWP 22368)]
[New Thread 0x7fffe98b5950 (LWP 22369)]
[Thread 0x7fffe98b5950 (LWP 22369) exited]
[New Thread 0x7fffe90b4950 (LWP 22370)]
[Thread 0x7fffe90b4950 (LWP 22370) exited]
[New Thread 0x7fffe88b3950 (LWP 22371)]
[Thread 0x7fffe88b3950 (LWP 22371) exited]
[New Thread 0x7fffe88b3950 (LWP 22372)]
[Thread 0x7fffe88b3950 (LWP 22372) exited]
[Thread 0x7fffeaee6950 (LWP 22367) exited]
[New Thread 0x7fffe90b4950 (LWP 22373)]
[New Thread 0x7fffe388f950 (LWP 22374)]
[New Thread 0x7fffe308e950 (LWP 22375)]
[New Thread 0x7fffe288d950 (LWP 22396)]
[Thread 0x7fffe90b4950 (LWP 22373) exited]
[Thread 0x7fffe288d950 (LWP 22396) exited]
[New Thread 0x7fffe90b4950 (LWP 22397)]
[Thread 0x7fffe90b4950 (LWP 22397) exited]
[New Thread 0x7fffe90b4950 (LWP 22398)]
[New Thread 0x7fffe208c950 (LWP 22399)]
[Thread 0x7fffe90b4950 (LWP 22398) exited]
[Thread 0x7fffe208c950 (LWP 22399) exited]
[New Thread 0x7fffe208c950 (LWP 22400)]
[New Thread 0x7fffe90b4950 (LWP 22401)]
[New Thread 0x7fffe188b950 (LWP 22402)]
[Thread 0x7fffe208c950 (LWP 22400) exited]
[Thread 0x7fffe188b950 (LWP 22402) exited]
[Thread 0x7fffe90b4950 (LWP 22401) exited]
[New Thread 0x7fffe188b950 (LWP 22403)]
[New Thread 0x7fffe90b4950 (LWP 22404)]
[Thread 0x7fffe90b4950 (LWP 22404) exited]
[Thread 0x7fffe188b950 (LWP 22403) exited]
[New Thread 0x7fffe208c950 (LWP 22405)]
[New Thread 0x7fffe108a950 (LWP 22406)]
[New Thread 0x7fffde452950 (LWP 22407)]
[New Thread 0x7fffddc51950 (LWP 22408)]
[New Thread 0x7fffdd450950 (LWP 22409)]
[New Thread 0x7fffdca2b950 (LWP 22410)]
[Thread 0x7fffe208c950 (LWP 22405) exited]
[Thread 0x7fffea0b6950 (LWP 22368) exited]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff1d77f50 in pthread_getcpuclockid () from /lib64/libpthread.so.0
(gdb) continue
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff1d77f50 in pthread_getcpuclockid () from /lib64/libpthread.so.0
(gdb) continue
Continuing.
[Thread 0x7fffdca2b950 (LWP 22410) exited]
[Thread 0x7fffdd450950 (LWP 22409) exited]
[Thread 0x7fffddc51950 (LWP 22408) exited]
[Thread 0x7fffe108a950 (LWP 22406) exited]
[Thread 0x7fffe308e950 (LWP 22375) exited]
[Thread 0x7fffe388f950 (LWP 22374) exited]
[Thread 0x7fffeb84f950 (LWP 22366) exited]
[Thread 0x7fffde452950 (LWP 22407) exited]

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.

The first "Program received signal SIGSEGV,..." appears at the very moment I click the icon.

Doesn't help me, hope it helps you. :)

[parena]

wow, after using gdb, everything I play runs at twice or 4 times the speed it should and I can't change it. o_O

update: a reboot fixed the speed problem (what the heck happened there?). segfault still happening, though.

[at0m13]

I had the same problem and I figured out what was wrong.

The segfault occurs in linux/XThreadUtils.cpp in GetThreadTimes().
The problem is that SDL_GetThreadID() returns a truncated pthread_t (it's only a Uint32 while pthread_t is a 64-bit value on 64-bit Linux). The code then passes the bad pthread_t to pthread_getcpuclockid(), which proceeds to segfault (even though the docs imply it should just return an error given a bad thread_id).

I fixed my own copy by doing the following

--- XBMC.orig/xbmc/linux/XThreadUtils.cpp 2008-11-09 22:58:15.000000000 -0500
+++ XBMC/xbmc/linux/XThreadUtils.cpp 2009-02-14 15:21:37.000000000 -0500
@@ -276,7 +276,7 @@
lpUserTime->dwLowDateTime = 0;
lpUserTime->dwHighDateTime = 0;
pthread_t thread = (pthread_t)SDL_GetThreadID(hThread->m_hThread);
- if(thread)
+ if(sizeof(pthread_t) == sizeof(Uint32) && thread)
{
clockid_t clock;
if(pthread_getcpuclockid(thread, &clock) == 0)


Obviously a hack. The right fix would probably be in SDL to return a correct pthread_t.

[parena]

Okay, so that fix is not for me, since I'm using pre-compiled XBMC packages. Does make me wonder, though, why it just suddenly started out of nothing (and still does)? It used to work fine.

edit: taking the plunge. Following the instructions for opensuse and applied your patch to the latest svn version of XBMC. Let's see how long this takes (AMD 1800 X2) :)

edit 2: okay, compile error somewhere in ffmpeg. Back to a binary install I go. Maybe I'll try another time, thanks for pointing out the problem!

edit 3: heh, couldn't help myself. I fetched the version of 8 weeks ago, patched it and it compiled fine this time. And I have my audio settings screen back. Hack or not, it makes me happy. Thanks. :)

[bjoneson]

Having the same issue with SuSE 11.1 x86_64 on SVN 17875. I will try to compile logs / backtrace and open a trac ticket.

[patstew]

I'm having the same problem with svn r18783. If anyone needs a full backtrace, here you go, but I think the problem is fully described above anyway.
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu"...

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libXrandr.so.2...done.
Loaded symbols for /usr/lib/libXrandr.so.2
...

x1000 (Had to cut these to fit in the post)

...
Reading symbols from /opt/xbmc/share/xbmc/system/players/dvdplayer/avutil-49-x86_64-linux.so...done.
Loaded symbols for /opt/xbmc/share/xbmc/system/players/dvdplayer/avutil-49-x86_64-linux.so
Reading symbols from /opt/xbmc/share/xbmc/system/players/dvdplayer/avcodec-52-x86_64-linux.so...done.
Loaded symbols for /opt/xbmc/share/xbmc/system/players/dvdplayer/avcodec-52-x86_64-linux.so
Reading symbols from /opt/xbmc/share/xbmc/system/players/dvdplayer/avformat-52-x86_64-linux.so...done.
Loaded symbols for /opt/xbmc/share/xbmc/system/players/dvdplayer/avformat-52-x86_64-linux.so
Reading symbols from /opt/xbmc/share/xbmc/system/players/dvdplayer/swscale-0.6.1-x86_64-linux.so...done.
Loaded symbols for /opt/xbmc/share/xbmc/system/players/dvdplayer/swscale-0.6.1-x86_64-linux.so
Reading symbols from /opt/xbmc/share/xbmc/system/players/dvdplayer/liba52-x86_64-linux.so...done.
Loaded symbols for /opt/xbmc/share/xbmc/system/players/dvdplayer/liba52-x86_64-linux.so
Core was generated by `/opt/xbmc/share/xbmc/xbmc.bin'.
Program terminated with signal 11, Segmentation fault.
[New process 4991]
[New process 5030]
[New process 5049]
[New process 5031]
[New process 5047]
[New process 5048]
[New process 5050]
[New process 5054]
[New process 5015]
[New process 5051]
[New process 5029]
[New process 5052]
[New process 5053]
#0 0x00007f11676dcf60 in pthread_getcpuclockid () from /lib/libpthread.so.0
(gdb) bt full
#0 0x00007f11676dcf60 in pthread_getcpuclockid () from /lib/libpthread.so.0
No symbol table info available.
#1 0x0000000000bcb57a in GetThreadTimes ()
No locals.
#2 0x0000000000c346c3 in CThread::GetRelativeUsage ()
No locals.
#3 0x00000000009864ac in CDVDPlayerAudio::GetPlayerInfo ()
No locals.
#4 0x000000000098ba81 in CDVDPlayer::GetAudioInfo ()
No locals.
#5 0x00000000007010ff in CGUIDialogAudioSubtitleSettings::AddAudioStreams ()
No locals.
#6 0x00000000007016a4 in CGUIDialogAudioSubtitleSettings::CreateSettings ()
No locals.
#7 0x000000000073774d in CGUIDialogSettings::OnInitWindow ()
No locals.
#8 0x000000000066666e in CGUIWindow::OnMessage ()
No locals.
#9 0x00000000006097eb in CGUIDialog::OnMessage ()
No locals.
#10 0x00000000006095d1 in CGUIDialog::DoModal_Internal ()
No locals.
#11 0x00000000006c2977 in CApplicationMessenger::ProcessMessage ()
No locals.
#12 0x00000000006c359b in CApplicationMessenger::SendMessage ()
No locals.
#13 0x00000000006c3a14 in CApplicationMessenger::DoModal ()
No locals.
#14 0x000000000066e62b in CGUIWindowManager::ActivateWindow_Internal ()
No locals.
#15 0x00000000008def28 in CUtil::ExecBuiltIn ()
No locals.
#16 0x00000000006b75df in CApplication::OnMessage ()
No locals.
#17 0x000000000066c0f1 in CGUIWindowManager::SendMessage ()
No locals.
#18 0x00000000005e860f in CGUIButtonControl::OnClick ()
---Type <return> to continue, or q <return> to quit---
No locals.
#19 0x00000000005e7341 in CGUIButtonControl::OnAction ()
No locals.
#20 0x00000000005e7b13 in CGUIButtonControl::OnMouseClick ()
No locals.
#21 0x000000000066447b in CGUIWindow::HandleMouse ()
No locals.
#22 0x000000000066474a in CGUIWindow::OnMouseAction ()
No locals.
#23 0x0000000000663e99 in CGUIWindow::OnAction ()
No locals.
#24 0x000000000066b36d in CGUIWindowManager::OnAction ()
No locals.
#25 0x00000000006ab3c8 in CApplication::ProcessMouse ()
No locals.
#26 0x00000000006b5445 in CApplication::FrameMove ()
No locals.
#27 0x000000000066b528 in CGUIWindowManager::Process_Internal ()
No locals.
#28 0x000000000060960d in CGUIDialog::DoModal_Internal ()
No locals.
#29 0x00000000006c2977 in CApplicationMessenger::ProcessMessage ()
No locals.
#30 0x00000000006c359b in CApplicationMessenger::SendMessage ()
No locals.
#31 0x00000000006c3a14 in CApplicationMessenger::DoModal ()
No locals.
#32 0x000000000079acba in CGUIWindowFullScreen::OnMouse ()
No locals.
#33 0x0000000000664769 in CGUIWindow::OnMouseAction ()
No locals.
#34 0x0000000000663e99 in CGUIWindow::OnAction ()
No locals.
#35 0x000000000079a637 in CGUIWindowFullScreen::OnAction ()
No locals.
#36 0x00000000006ab3c8 in CApplication::ProcessMouse ()
No locals.
---Type <return> to continue, or q <return> to quit---
#37 0x00000000006b5445 in CApplication::FrameMove ()
No locals.
#38 0x000000000092fb3f in CXBApplicationEx::Run ()
No locals.
#39 0x000000000093288a in main ()
No locals.

[althekiller]

Please configure with debugging enabled and optimizations disabled. Then replicate. And use pastebin.com! :)

[Haggy]

Glad to hear someone's on this. Thought i was the only one with segfaults on the audio screen :-) for me it happens on non-ac3 files, but absolutely reproducible. I'm also on x86_64.

[Tornhoof]

(...)
Obviously a hack. The right fix would probably be in SDL to return a correct pthread_t.
It's been awhile since I looked at libsdl, but afaik there should be still a SYS_ThreadHandle handle in that SDL_THREAD struct, which returns the system specific type of the thread handle.
Rather than using SDL_GetThreadID it might be wiser to use that one.

[patstew]

Ok heres a full debugging/no optimisation trace.
http://pastebin.com/f26fea769

It was built with this PKGBUILD (http://pastebin.com/m1f6e217d) on arch linux, except with debugging enabled. (Haggy also uses arch linux, could be related? Though I also get this problem on gentoo...)
It has some hacks to make it build on arch, because xbmc incorrectly decides that arch hasn't got realloc. It's a cut down version of Haggy's PKGBUILD, I'm not sure all of the stuff in the AUR one is needed anymore?
For those of you who don't use arch, the PKGBUILD is basically a bash script, it just means that the program gets installed by the package manager.

Also, the patch further up the thread prevents the segfault, but by the looks of it it does it at the expense of breaking the function, so I guess it's not ideal.

Edit: I've just noticed that the audio/subtitle menu works fine with a DVD, it's only while playing AVIs that it segfaults.

[Haggy]

patstew: DVD uses AC3 audio, so that confirms my assumption. Could you please have a look at the audio track in your .avi-File? What codec is used? Maybe it has something to do with xbmc using bitstream out or it internal decoders.

As for the PKGBUILD: I don't know if those hacks are still needed - but they don't hurt. I compile everyday using that PKGBUILD, only bumping pkgrev to the current HEAD in xbmc-vdpau and it never broke so far. However i tried removing the faad2 patch and it broke, so i guess i'll leave those patches in until they cause a failure.