Sporadic segmentation faults in fluid_voice_off()

Question

I'm experiencing sporadic segmentation faults with fluidsynth 1.1.2.

It seems macro fluid_sample_decr_ref() might decrement a sample's refcount (offset 0x50) while the sample's address being NULL.

siginfo: ExceptionCode=0xc0000005, reading address 0x00000050

Registers:

EAX=0x00000000, EBX=0x00000080, ECX=0x08e54898, EDX=0x00000006

ESP=0x1bdaf070, EBP=0x1bdaf088, ESI=0x1bdaf11c, EDI=0x038a9c00

EIP=0x6e027773, EFLAGS=0x00010202

Top of Stack: (sp=0x1bdaf070)

0x1bdaf070: 11f6b068 ffffffff 1bdaf0a8 686133f9

0x1bdaf080: 11f6b068 11f6b068 1bdaf0a8 6e01f664

0x1bdaf090: 11f6a118 00000022 140667e8 038a9d10

0x1bdaf0a0: 11f6b068 00000031 1bdaf0b8 6e023d78

0x1bdaf0b0: 08e54898 6da2ea98 1bdaf0d8 6e01b6b8

0x1bdaf0c0: 08e54898 038a9d10 1bdaf114 00000022

0x1bdaf0d0: 038a9c00 1bdaf11c 1bdaf0f8 6f081a9b

0x1bdaf0e0: 08e54898 00000002 00000038 282dd7c8

Instructions: (pc=0x6e027773)

0x6e027763: 94 0d 00 00 ff 48 50 8b 45 08 8b 80 94 0d 00 00

0x6e027773: 83 78 50 00 75 31 8b 45 08 8b 80 94 0d 00 00 83

Stack: [0x1bd60000,0x1bdb0000], sp=0x1bdaf070, free space=13c1bdaeba4k

Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)

C [libfluidsynth_debug.dll+0x27773] fluid_voice_off#1213

C [libfluidsynth_debug.dll+0x1f664] fluid_synth_check_finished_voices#3247

C [libfluidsynth_debug.dll+0x23d78] fluid_synth_api_enter#5826

C [libfluidsynth_debug.dll+0x1b6b8] fluid_synth_noteoff#1446

C [fluidsynthJNI.dll+0x1a9b]

A race condition possibly?

Reported by: svenmeier

Original Ticket: fluidsynth/tickets/84

该提问来源于开源项目：FluidSynth/fluidsynth

Answer 1

Thanks for reporting this issue Sven. I'm having a hard time understanding how this can happen though, since fluid_voice_off has an "if (voice->sample)" just before decrementing the refcount. If you think another thread is setting voice->sample to null simultaneously, that should only be possible if you have turned off thread safety (synth.threadsafe-api=false) but at the same time actually calls the API in parallel. Could this be the case?

Original comment by: diwic