Sporadic crashes when Kinect is unplugged

[smokris]

I'm trying to build an app that robustly handles Kinects being plugged in and unplugged.

Currently, if I unplug the Kinect:

1. Sometimes, freenect_process_events_timeout() will return -1. That's good — I can clean up and then periodically probe to see whether another Kinect has been plugged in.
2. Sometimes, libfreenect crashes inside freenect_process_events_timeout().

I haven't found a way to prevent the crash from my client code.

Here's the backtrace:

Thread 4 Crashed:: Dispatch queue: com.apple.root.default-priority
0   libsystem_kernel.dylib          0x00007fff8b7f0212 __pthread_kill + 10
1   libsystem_c.dylib               0x00007fff8c03ab24 pthread_kill + 90
2   libsystem_c.dylib               0x00007fff8c07ef61 abort + 143
3   libsystem_c.dylib               0x00007fff8c05a8d5 szone_error + 580
4   libsystem_c.dylib               0x00007fff8c05b3a4 small_free_list_remove_ptr + 156
5   libsystem_c.dylib               0x00007fff8c0590df szone_free_definite_size + 4278
6   libsystem_c.dylib               0x00007fff8c0528c8 free + 199
7   libfreenect.dylib               0x00000001006d8763 fnusb_stop_iso + 275
8   libfreenect.dylib               0x00000001006d3b79 freenect_stop_video + 121
9   libfreenect.dylib               0x00000001006d1d84 freenect_process_events_timeout + 132

And the console output:

USB device disappeared, cancelling stream 81 :(
USB camera marked dead, stopping streams
send_cmd: Output control transfer failed (-99)
kinect(52293,0x100f87000) malloc: *** error for object 0x10102f608: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug

Could libfreenect improve its handling of this condition?

[piedar]

When I unplug while running glview, I do not get a segfault, but I do get

send_cmd: Output control transfer failed (-4)

Maybe the difference in meaning between my error code (-4) and yours (-99) could help pinpoint the cause. As a result, freenect sends the command to stop the stream after the device is already disconnected. Somehow this is corrupting some memory so that malloc fails. This is a subtle bug to fix and requires further investigation!

[piedar]

Scratch that, it's a simple bug. In usb_libusb.c, there's a memset() after a free(). Linux doesn't seem to mind (or maybe I just can't get the timing right to reproduce the bug). Should be fixed by f6cb19e, please confirm.

[piedar]

@smokris Any chance you can see if the fix worked? I never managed to reproduce the crash.