SIGSEGV in SSDPCache (Autodiscovery) affecting all new installs

[anonymous]

My frontend segfaults when it starts for the first time on a clean install when it prescales glass-wide.

Backtrace and myth.log are attached.

laga@001a4b6951f4:~$ mythfrontend --version
Please include all output in bug reports.
MythTV Version   : 16259
MythTV Branch    : branches/release-0-21-fixes
Library API      : 0.21.20080224-1
Network Protocol : 40
Options compiled in:
 linux profile using_oss using_alsa using_arts using_jack using_backend using_dbox2 using_dvb using_firewire using_frontend using_hdhomerun using_iptv using_ivtv using_joystick_menu using_libfftw3 using_lirc using_opengl_vsync using_opengl_video using_v4l using_x11 using_xrandr using_xv using_xvmc using_xvmcw using_bindings_perl using_bindings_python using_opengl using_ffmpeg_threads using_libavc_5_3 using_live
laga@001a4b6951f4:~$ 

[stuartm]

Related to auto-discovery, I can reproduce by forcing auto-discovery with -p. After selecting the backend it starts to load and then segfaults. This is a very recent regression, it was working fine this time last week.

[paulh]

Replying to stuartm:

Related to auto-discovery, I can reproduce by forcing auto-discovery with -p. After selecting the backend it starts to load and then segfaults. This is a very recent regression, it was working fine this time last week.

I think this problem has been around for a while now. It looks like a duplicate of #4651 and possibly #4301.

[stuartm]

You are right, the first one looks like the same issue. Which is odd, I've used autodiscovery frequently to switch between backends but I've only run into the issue today and it is 100% reproducible. It does explain why I can't find a likely cause in recent commits though.

[paulh]

I think I have this fixed. I just need to add some debugging to check my hypothesis is correct which I'll do tonight unless someone else beats me to it.

I think the problem is in backendselect.cpp where there is one too many RefCounted?.Release() calls on the DeviceLocation? objects it obtains which is causing them to be deleted prematurely. SSDPCacheEntries maintains a map of DeviceLocations? but when they are deleted outside of SSDPCacheEntries the map isn't updated so the pointers now point to the deleted objects. It's when it later iterates though the map in either SSDPCacheEntries::Clear() or SSDPCacheEntries::RemoveStale? that's when the crash happens because it is accessing the DeviceLocations? using stale pointers.

[Nigel]

FillListBox?(), backendselect.cpp, line 259 ? Removing that seems to fix it for me. Well spotted, Paul!

[Nigel]

(In [16444]) RefCounted? bug in BackendSelect::FillListBox?() discovered by Paul Harrison. Closes #4651, #4816 and #4873 (I hope).

[Nigel]

(In [16445]) RefCounted? bug in BackendSelect::FillListBox?() discovered by Paul Harrison. Closes #4651, #4816 and #4873 (I hope).