glupload: EGLImage cache is not thread safe
Submitted by Nicolas Dufresne @ndufresne
Link to original bug (#786051)
Description
When we receive a DMABuf, we create a cache associated EGLImage. While the wrapper is refcounted, the way we store that EGLImage is not thread safe. The problem is that we don't get and ref the EGLImage atomically when retrieving the qdata. So in between, sometimes the EGLImage get destroyed, and then we ended with use after free crashing GStreamer or Mesa.
The pipeline I use to reproduce currently:
gst-launch-1.0 v4l2src device=/dev/video1 io-mode=dmabuf ! tee name=t \
t. ! queue ! glsinkbin sink=gtkglsink \
t. ! queue ! glsinkbin sink=gtkglsink \
t. ! queue ! glsinkbin sink=gtkglsink \
t. ! queue ! glsinkbin sink=gtkglsink \
t. ! queue ! glsinkbin sink=gtkglsink
Version: 1.13.x