[MPlayer-dev-eng] Re: Recent regression in FreeMediaType

[Vladimir Voroshilov]

2007/3/15, Alan Nisota <alannisota at gmail.com>:
>
> Vladimir Voroshilov wrote:
> > Perhaps, trouble is in win32.c's expMoCopyMediaType,expMoFreeMediaType
> and
> > others. They are neither clears pUnk in Free nor copyes it in Copy.
> > Try to add "dest->pUnk=0" into expMoFreeMediaType and check if this will
> > help.
> >
>
> Nope.  I tried that (had to add pUnk in the right place in the
> definition of MY_MEDIA_TYPE of course), but to no avail.  Neither of
> those functions are called at all during shutdown (or any other time) by
> CoreAVC.
> The only places where CopyMediaType get called are in the Input and
> Output pin creation, as well as SetDestFmt (CreateMedia type never gets
> called)
> FreeMediaType gets called 4 times, in the 1st 2 cases, I'm not sure what
> allocated the memory (didn't come from a CreateMediaType or
> CopyMediaType), the second 2 cases were allocated by CopyMediaType.Only
> the second call to CloseMediaType (one where I haven't been able to
> track down the allocation yet) contains a 'pUnk' and at the point at
> which it is called, pUnk appears to be invalid.


i'm not sure that we are talking about the same thing.
We have two implementation of CopyMediaType now.
one in mediasample.c and one in win32.c

static HRESULT WINAPI expMoCopyMediaType(MY_MEDIA_TYPE* dest, const
MY_MEDIA_TYPE* src)
{
    if (!dest || !src)
    return E_POINTER;
    memcpy(dest, src, sizeof(MY_MEDIA_TYPE));
^^^^^^
here we will get to pointers to the same object
expMoCopyMediaType does neither "pfmt->punk=0" nor
"pfmt->pUnk->vt->AddRef(pfmt->pUnk)".

Assume:
pfmt1=malloc(AM_MEDIA_TYPE)
...
pfmt2=expMoCopyMediaType(pfmt1);

Code below will work:
expMoFreeMediaType(pfmt1);
expMoFreeMediaType(pfmt2);

Code below will crash:
FreeMediaType(pfmt1);
FreeMediaType(pfmt2);

Bu if we assume:
pfmt1=malloc(AM_MEDIA_TYPE)
...
pfmt2=CopyMediaType(pfmt1);
Code below will work:
expMoFreeMediaType(pfmt1);
expMoFreeMediaType(pfmt2);

Code below will also work:
FreeMediaType(pfmt1);
FreeMediaType(pfmt2);


Try attached patch.

-- 
Regards,
Vladimir Voroshilov     mailto:voroshil at gmail.com
JID: voroshil at jabber.ru
ICQ: 95587719
-------------- next part --------------
A non-text attachment was scrubbed...
Name: copy_fix.diff
Type: application/octet-stream
Size: 450 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/attachments/20070315/1eb8f3b8/attachment.obj>