rtpbin: fix leak of elements requested by signals

When the signal returns a floating reference, as its return type
is transfer full, we need to sink it ourselves before passing
it to gst_bin_add (which is transfer floating).

This allows us to unref it in bin_remove_element later on, and
thus to also release the reference we now own if the signal
returns a non-floating reference as well.

As we now still hold a reference to the element when removing it,
we also need to lock its state and setting it to NULL before
unreffing it

Also update the request_aux_sender test.

https://bugzilla.gnome.org/show_bug.cgi?id=792543
This commit is contained in:
Mathieu Duponchelle 2018-01-15 18:13:37 +01:00
parent f7e280bf0d
commit 03dc22951b
2 changed files with 25 additions and 5 deletions

View file

@ -865,6 +865,10 @@ bin_manage_element (GstRtpBin * bin, GstElement * element)
GST_DEBUG_OBJECT (bin, "requested element %p already in bin", element);
} else {
GST_DEBUG_OBJECT (bin, "adding requested element %p", element);
if (g_object_is_floating (element))
element = gst_object_ref_sink (element);
if (!gst_bin_add (GST_BIN_CAST (bin), element))
goto add_failed;
if (!gst_element_sync_state_with_parent (element))
@ -880,6 +884,7 @@ bin_manage_element (GstRtpBin * bin, GstElement * element)
add_failed:
{
GST_WARNING_OBJECT (bin, "unable to add element");
gst_object_unref (element);
return FALSE;
}
}
@ -894,9 +899,12 @@ remove_bin_element (GstElement * element, GstRtpBin * bin)
if (find) {
priv->elements = g_list_delete_link (priv->elements, find);
if (!g_list_find (priv->elements, element))
if (!g_list_find (priv->elements, element)) {
gst_element_set_locked_state (element, TRUE);
gst_bin_remove (GST_BIN_CAST (bin), element);
else
gst_element_set_state (element, GST_STATE_NULL);
}
gst_object_unref (element);
}
}

View file

@ -576,7 +576,7 @@ aux_sender_cb (GstElement * rtpbin, guint sessid, gpointer user_data)
GstElement *bin;
GstPad *srcpad, *sinkpad;
bin = gst_bin_new (NULL);
bin = (GstElement *) user_data;
GST_DEBUG ("making AUX sender");
sinkpad = gst_ghost_pad_new_no_target ("sink_2", GST_PAD_SINK);
@ -597,11 +597,14 @@ GST_START_TEST (test_aux_sender)
GstElement *rtpbin;
GstPad *rtp_sink1, *rtp_src, *rtcp_src;
gulong id;
GstElement *aux_sender = gst_object_ref_sink (gst_bin_new ("aux-sender"));
gst_object_ref (aux_sender);
rtpbin = gst_element_factory_make ("rtpbin", "rtpbin");
id = g_signal_connect (rtpbin, "request-aux-sender",
(GCallback) aux_sender_cb, NULL);
(GCallback) aux_sender_cb, aux_sender);
rtp_sink1 = gst_element_get_request_pad (rtpbin, "send_rtp_sink_2");
fail_unless (rtp_sink1 != NULL);
@ -631,6 +634,15 @@ GST_START_TEST (test_aux_sender)
gst_element_release_request_pad (rtpbin, rtp_sink1);
gst_object_unref (rtp_sink1);
/* We have sinked the initial reference before returning it
* in the request callback, the ref count should now be 1 because
* the return of the signal is transfer full, and rtpbin should
* have released that reference by now, but we had taken an
* extra reference to perform this check
*/
ASSERT_OBJECT_REFCOUNT (aux_sender, "aux-sender", 1);
gst_object_unref (aux_sender);
gst_object_unref (rtpbin);
}