View Issue Details

IDProjectCategoryView StatusLast Update
0001154ardourbugspublic2008-11-20 23:48
Reporterindigo Assigned Toessej  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Summary0001154: segfault while playing loop
DescriptionBuilt from the tarball on 2005-11-26:

indigo@thebe:~$ ardour --version
Ardour/GTK 0.99.1
   (built using 1.0.2 with libardour 0.902.0 and GCC version 4.0.2 20050808 (prerelease) (Ubuntu 4.0.1-4ubuntu9))
indigo@thebe:~$ uname -a
Linux thebe 2.6.12-9-amd64-k8 0000001 Mon Oct 10 13:13:36 BST 2005 x86_64 GNU/Linux

What I have is 2 tracks, one has about 1 minute of recorded stuff. I set a loop range, and hit the play loop button and let that loop away. It plays a few times and crashes after some variable number of iterations; i have seen it as little as 2 and as much as maybe 20, but it always crashes eventually.

gdb says:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1098918240 (LWP 14376)]
0x00000000008598b1 in ARDOUR::Session::click (this=0x139e590, start=476690, nframes=128, offset=0) at libs/ardour/session_click.cc:107
107 memcpy (buf + internal_offset, &clk->data[clk->offset], copy * sizeof (Sample));
(gdb) bt
#0 0x00000000008598b1 in ARDOUR::Session::click (this=0x139e590, start=476690, nframes=128, offset=0) at libs/ardour/session_click.cc:107
0000001 0x000000000086ae14 in ARDOUR::Session::process_with_events (this=0x139e590, nframes=128) at libs/ardour/session_process.cc:344
#2 0x000000000086901f in ARDOUR::Session::process (this=0x139e590, nframes=128) at libs/ardour/session_process.cc:62
#3 0x000000000076f6c2 in ARDOUR::AudioEngine::process_callback (this=0x10416b0, nframes=128) at libs/ardour/audioengine.cc:315
0000004 0x000000000076f85b in ARDOUR::AudioEngine::_process_callback (nframes=128, arg=0x10416b0) at libs/ardour/audioengine.cc:210
0000005 0x00002aaaacb342fd in jack_stop_freewheel () from /usr/lib/libjack-0.80.0.so.0
#6 0x00002aaaac9020fa in start_thread () from /lib/libpthread.so.0
#7 0x00002aaaad018383 in clone () from /lib/libc.so.6
0000008 0x0000000000000000 in ?? ()
0000009 0x0000000000000000 in ?? ()
0000010 0x0000000000000000 in ?? ()
...
0000214 0x0000000000000000 in ?? ()
0000215 0x0000000000000000 in ?? ()
---Type <return> to continue, or q <return> to quit---
0000216 0x00002aaaad1820e0 in __check_rhosts_file () from /lib/libc.so.6
0000217 0x0000000041802dc0 in ?? ()
0000218 0x0000000000000004 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(gdb)

I am trying to reproduce this more simply by making a new session and just looping it, but it's not working (or, it is working). The session was created with an older tarball build from a few months ago, i'd guess. Perhaps it is dependent on that. Tomorrow I will try to do the same thing again from a new session and see if it crashes.

The session is about 21 M uncompressed; I can send it on request.
TagsNo tags attached.

Activities

indigo

2005-11-27 05:09

reporter   ~0002385

another backtrace, with "thread apply all bt", on a different run:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1098918240 (LWP 14408)]
0x00000000008598b1 in ARDOUR::Session::click (this=0x13a0ec0, start=1032828, nframes=93, offset=35) at libs/ardour/session_click.cc:107
107 memcpy (buf + internal_offset, &clk->data[clk->offset], copy * sizeof (Sample));
(gdb) thread apply all bt

Thread 7 (Thread 1124096352 (LWP 14411)):
#0 0x00002aaaad00f5d2 in poll () from /lib/libc.so.6
0000001 0x000000000086016b in ARDOUR::Session::feedback_thread_work (this=0x13a0ec0) at libs/ardour/session_feedback.cc:137
#2 0x00000000008604bf in ARDOUR::Session::_feedback_thread_work (arg=0x13a0ec0) at libs/ardour/session_feedback.cc:112
#3 0x00002aaaac9020fa in start_thread () from /lib/libpthread.so.0
0000004 0x00002aaaad018383 in clone () from /lib/libc.so.6
0000005 0x0000000000000000 in ?? ()
#6 0x0000000000000000 in ?? ()
#7 0x0000000000000000 in ?? ()
...
0000214 0x0000000043005dc0 in ?? ()
0000215 0x000000000000000b in ?? ()
Previous frame inner to this frame (corrupt stack?)
0x00000000008598b1 107 memcpy (buf + internal_offset, &clk->data[clk->offset], copy * sizeof (Sample));
(gdb)

indigo

2005-11-27 05:31

reporter   ~0002386

I've gotten it to crash with a new session, using a method like this. I say "like" because now that i'm trying to write it down exactly, it's not crashing.

- start ardour
- make a new session
- add a mono track by right clicking in the margin
- enable rec for that track
- enable global rec
- hit play, record 0000009:0000005 measures
- change the tempo to 145 by right clicking the existing tempo of 120 on the tempo bar and editing it (this seems important)
- drag on the loop range bar above the waveform preview thingers to create a loop 2 bars long, starting on the 2nd bar (snap to measure was on by default)
- hit the play loop button
- turn click on in the middle of the first iteration of the loop (I think if click is on before starting playback it will crash, too)
- crashes at end of loop

sometimes, i would save the session and load it, and while it wouldn't crash before saving, it would crash easily after loading. However, i've gotten it to crash without loading a saved session.

indigo

2005-12-01 03:43

reporter   ~0002390

Some more observations:

- I have tried this with the jack provided with Ubuntu, as well as a jack from CVS that I built. The behaviour is the same either way.

- Crashing seems to happen only when playing a loop, and having click on seems to make it crash more frequently.

indigo

2005-12-03 15:32

reporter   ~0002393

Last edited: 2005-12-03 15:32

Having click on or playing a loop is not a requirement to get ardour to segfault, it just seems to help. I've had plenty of segfaults with click off, recording, just playing, whatever.

nmains

2005-12-03 16:33

developer   ~0002394

here's a bit of a hackish patch.
i tested it a bit, but as you know, the issue is hard to reproduce reliably.
hope it helps.

nmains

2005-12-04 06:28

developer   ~0002395

ok that wasn't it.. more soon (i hope)

nmains

2005-12-04 09:39

developer   ~0002396

ok the second patch ( clicktestfix2.diff ) seems to move the crash to somewhere else.
this, if not progress, is a clue :)

2005-12-04 14:48

 

clicktestfix3.diff (1,120 bytes)   
diff -ur ../ardour/libs/ardour/session_click.cc libs/ardour/session_click.cc
--- ../ardour/libs/ardour/session_click.cc	2005-09-09 11:57:57.000000000 +1000
+++ libs/ardour/session_click.cc	2005-12-05 01:45:37.000000000 +1100
@@ -95,15 +95,26 @@
 		clk = *i;
 		next = i;
 		++next;
-
+	
 		if (clk->start < start) {
 			internal_offset = 0;
 		} else {
 			internal_offset = clk->start - start;
 		}
-
-		copy = min (clk->duration - clk->offset, nframes - internal_offset);
-		
+		/*
+		cerr << "XXX internal offset is " << internal_offset << endl;
+		cerr << "XXX nframes is " << nframes << endl;
+		cerr << "XXX clk->duration is " << clk->duration << endl;
+		cerr << "XXX clk->offset is " << clk->offset << endl << endl;
+		*/
+		if (nframes < internal_offset) {
+		         /* we've just located or something.. 
+			    effectively going backwards.
+			    lets get the flock out of here */
+		        break;
+		} else {
+		        copy = min (clk->duration - clk->offset, nframes - internal_offset);
+		}
 		memcpy (buf + internal_offset, &clk->data[clk->offset], copy * sizeof (Sample));
 
 		clk->offset += copy;
clicktestfix3.diff (1,120 bytes)   

nmains

2005-12-04 14:53

developer   ~0002397

right. i'm pretty sure this fixes the crash.
(clicktestfix3.diff)
watch what happens to (nframes - internal_offset) when we locate backwards.
i think the best thing is to deliver the buffers and return,as the clicks are about to be deleted anyway by another thread.

essej

2005-12-06 04:03

manager   ~0002398

Committed fix by nick to ardour1 source tree.

Issue History

Date Modified Username Field Change
2005-11-27 05:00 indigo New Issue
2005-11-27 05:00 indigo E-mail => indigo@bitglue.com
2005-11-27 05:00 indigo Name => Phil Frost
2005-11-27 05:09 indigo Note Added: 0002385
2005-11-27 05:31 indigo Note Added: 0002386
2005-12-01 03:43 indigo Note Added: 0002390
2005-12-03 15:32 indigo Note Added: 0002393
2005-12-03 15:32 indigo Note Edited: 0002393
2005-12-03 16:32 nmains File Added: clicktestfix.diff
2005-12-03 16:33 nmains Note Added: 0002394
2005-12-04 06:28 nmains Note Added: 0002395
2005-12-04 09:37 nmains File Added: clicktestfix2.diff
2005-12-04 09:39 nmains Note Added: 0002396
2005-12-04 14:48 nmains File Added: clicktestfix3.diff
2005-12-04 14:53 nmains Note Added: 0002397
2005-12-04 14:53 nmains File Deleted: clicktestfix.diff
2005-12-04 14:54 nmains File Deleted: clicktestfix2.diff
2005-12-06 04:03 essej Status new => resolved
2005-12-06 04:03 essej Resolution open => fixed
2005-12-06 04:03 essej Assigned To => essej
2005-12-06 04:03 essej Note Added: 0002398
2008-11-20 23:48 seablade Status resolved => closed