Interactive TV crash

[Stuart Auchterlonie]

It's been reported on the -users list that there are crashes after a few keypresses in interactive tv broadcasts from the UK.

Potentially affecting fixes/0.29 and master.

It does *not* occur on dvb-s2 broadcasts. It does occur on dvb-t broadcasts.

Backtrace:

Thread 40 "MHEG" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffe893c6700 (LWP 9977)]
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in  ()
#1  0x00007ffff2666765 in MHEngine::TransitionToScene(MHObjectRef const&) (this=0x5465ca0, target=...) at Engine.cpp:498
#2  0x00007ffff26733b9 in MHTransitionTo::Perform(MHEngine*) (this=0x7ffe74038c20, engine=0x5465ca0) at Groups.cpp:1045
#3  0x00007ffff266732f in MHEngine::RunActions() (this=0x5465ca0) at Engine.cpp:645
#4  0x00007ffff2665141 in MHEngine::RunAll() (this=0x5465ca0) at Engine.cpp:143
#5  0x00007ffff4999e7c in MHIContext::run() (this=0x55486f0) at mhi.cpp:273
#6  0x00007ffff3bc3e08 in MThread::run() (this=0x551c200) at mthread.cpp:319
#7  0x00007ffff3bc4743 in MThreadInternal::run() (this=0x551c1e0) at mthread.cpp:79
#8  0x00007fffea0c2c72 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#9  0x00007fffee48336d in start_thread () at /lib64/libpthread.so.0
#10 0x00007fffe94a3e1f in clone () at /lib64/libc.so.6

Backtrace full:

(gdb) bt full
#0  0x0000000000000000 in  ()
#1  0x00007ffff2666765 in MHEngine::TransitionToScene(MHObjectRef const&) (this=0x5465ca0, target=...) at Engine.cpp:498
        i = 0
        csPath = {static null = {<No data fields>}, d = 0x7ffe740f0dc0}
        text = {d = 0x7ffe7418a070}
        pProgram = 0x7ffe746e60d0
        pApp = 0x7ffe740fc370
        pEvent = 0x7ffe740a9a60
        it = {i = 0x7ffe741a78e0}
#2  0x00007ffff26733b9 in MHTransitionTo::Perform(MHEngine*) (this=0x7ffe74038c20, engine=0x5465ca0) at Groups.cpp:1045
        target = 
            {static Null = {static Null = <same as static member of an already seen type>, m_nObjectNo = 0, m_GroupId = {_vptr.MHOctetString = 0x7ffff28b76a8 <vtable for MHOctetString+16>, m_nLength = 0, m_pChars = 0x0}}, m_nObjectNo = 0, m_GroupId = {_vptr.MHOctetString = 0x7ffff28b76a8 <vtable for MHOctetString+16>, m_nLength = 13, m_pChars = 0x7ffe7427c620 "/d/s/mn1q.mhg"}}
#3  0x00007ffff266732f in MHEngine::RunActions() (this=0x5465ca0) at Engine.cpp:645
        pAction = 0x7ffe74038c20
#4  0x00007ffff2665141 in MHEngine::RunAll() (this=0x5465ca0) at Engine.cpp:143
        nNextTime = 4793
#5  0x00007ffff4999e7c in MHIContext::run() (this=0x55486f0) at mhi.cpp:273
        toWait = 1000
        key = 15
        locker = {val = 89425929}
        t = {mds = 82402276}
#6  0x00007ffff3bc3e08 in MThread::run() (this=0x551c200) at mthread.cpp:319
#7  0x00007ffff3bc4743 in MThreadInternal::run() (this=0x551c1e0) at mthread.cpp:79
#8  0x00007fffea0c2c72 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#9  0x00007fffee48336d in start_thread () at /lib64/libpthread.so.0
#10 0x00007fffe94a3e1f in clone () at /lib64/libc.so.6

This is with the patches from #13186 applied. Building now without them to double check

[Stuart Auchterlonie]

Same issue without the patches applied.

Backtrace:

Thread 40 "MHEG" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffe893c6700 (LWP 12163)]
(gdb) bt
#0  0x00007ffff28b96a8 in vtable for MHOctetString () at /usr/local/myth-git/lib/libmythfreemheg-30.so.30
#1  0x00007ffff2668765 in MHEngine::TransitionToScene(MHObjectRef const&) (this=0x5547910, target=...) at Engine.cpp:498
#2  0x00007ffff26753b9 in MHTransitionTo::Perform(MHEngine*) (this=0x7ffe744bb7a0, engine=0x5547910) at Groups.cpp:1045
#3  0x00007ffff266932f in MHEngine::RunActions() (this=0x5547910) at Engine.cpp:645
#4  0x00007ffff2667141 in MHEngine::RunAll() (this=0x5547910) at Engine.cpp:143
#5  0x00007ffff499a5c8 in MHIContext::run() (this=0x5503050) at mhi.cpp:269
#6  0x00007ffff3bc5e08 in MThread::run() (this=0x28340f0) at mthread.cpp:319
#7  0x00007ffff3bc6743 in MThreadInternal::run() (this=0x54fdda0) at mthread.cpp:79
#8  0x00007fffea0c4c72 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#9  0x00007fffee48536d in start_thread () at /lib64/libpthread.so.0
#10 0x00007fffe94a5e1f in clone () at /lib64/libc.so.6

This bit here is causing the problem

(gdb) up
#1  0x00007ffff2668765 in MHEngine::TransitionToScene (this=0x5547910, target=...) at Engine.cpp:498
498	        if (!pEvent->pEventSource->IsShared())

When IsShared?() is called it blows up as it is NULL as per the backtrace.

[Steve Goodey <steve@…>]

Pressing the red button on interactive broadcasts brings up a menu. Pressing up/down is ok it's pressing select that causes crash.

frontend log:- Dec 13 17:41:52 mythbuntu mythfrontend.real: mythfrontend[16066]: I CoreContext? mhi.cpp:623 (OfferKey?) [mhi] Adding MHEG key MENURED:100:0 Dec 13 17:41:55 mythbuntu mythfrontend.real: mythfrontend[16066]: I CoreContext? mhi.cpp:623 (OfferKey?) [mhi] Adding MHEG key DOWN:2:0 Dec 13 17:41:59 mythbuntu mythfrontend.real: mythfrontend[16066]: I CoreContext? mhi.cpp:623 (OfferKey?) [mhi] Adding MHEG key SELECT:15:0 Dec 13 17:41:59 mythbuntu mythfrontend.real: mythfrontend[16066]: C CoreContext? signalhandling.cpp:305 (handleSignal) Received Segmentation fault: Code 1, PID 0, UID 0, Value 0x7f5fe96a2d10 Dec 13 17:41:59 mythbuntu mythfrontend.real: mythfrontend[16066]: I CoreContext? tv_play.cpp:428 (StartTV) TV::StartTV(): Exiting main playback loop.

Not sure if this is relevant but a recording done on Jan 10 2016 and ones before are ok. A recording done on Feb 11 2016 fails as do those after.

[Steve Goodey <steve@…>]

Sample file that fails is at ​http://www.filedropper.com/mhegfail

[Stuart Auchterlonie]

The code in libs/libmythfreemheg is functionally unchanged since fixes/0.28, the only changes that have been made are those to remove various warnings from the build.

So I suspect this is something that has changed in the broadcast that is triggering this.

[Steve Goodey <steve@…>]

Peter,

Thanks for looking at this.

Steve.

[Peter Bennett]

Proposed fix

[Peter Bennett]

Attached patch to fix this. Please test the patch to make sure it does not cause problems on other channels or files.

What was happening is on a Scene Transition, left over events from a prior scene were invalid. Changed to delete all prior events on a Scene Transition. Since I have no experience with MHEG, this may or may not be the correct thing to do, but the patch is working well with the supplied file.

[Stuart Auchterlonie]

This patch appears to fix the crash I was observing.

I did note one oddity, however it occurs without the patch applied as well, so it is a different issue.

When watching one of the "red button" channels (ie. the channels changed to by an MHEG program) if you then use the guide to switch to another channel, you will be left with the guide, and a static image from the previous channel.

hitting 's' again to pop up the guide and once again to dismiss it, results in back to normal tv.

[Peter Bennett <pbennett@…>]

In 72a9c64c7f92b21bd9a0d230ed9a6c78e7f837de/mythtv:

Fix crash when invoking Interactive TV (MHEG) pages

Fixes #13194

(cherry picked from commit 5dea615d059984e52404c242d1af33ca97b19023)

[Peter Bennett <pbennett@…>]

In 5dea615d059984e52404c242d1af33ca97b19023/mythtv:

Fix crash when invoking Interactive TV (MHEG) pages

Fixes #13194