Reproducible SEGV Crash in libavcodec using current trunk

[Derek Atkins <warlord@…>]

I've got a reproducible crash in libavcodec. I can supply the 43MB mpeg test-case file to a developer to track it down. This crash happens with SVN/trunk revision 14348, but it also happens around 13508 prior to the ffmpeg resync. The following log is running "mythtv" with my test case file. Please let me know if you need anything else from me.

Thanks!

2007-08-28 17:28:54.051 NVP: prebuffering pause
2007-08-28 17:28:54.051 NVP: Waiting for prebuffer.. 0 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2007-08-28 17:28:54.276 NVP: ClearAfterSeek(1)
2007-08-28 17:28:54.276 VideoOutputXv: ClearAfterSeek()
2007-08-28 17:28:54.276 VideoOutputXv: DiscardFrames(0)
2007-08-28 17:28:54.276 VideoBuffers::DiscardFrames(0): AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2007-08-28 17:28:54.276 VideoBuffers::DiscardFrames(0): AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -- done
2007-08-28 17:28:54.276 VideoOutputXv: DiscardFrames() 3: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -- done()
2007-08-28 17:28:54.276 detectInterlace(Detect Scan, Interlaced Scan, 1, 256) ->Interlaced Scan
2007-08-28 17:28:54.276 AFD: avFPS(29.97) != seqFPS(1)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1346380912 (LWP 13563)]
0x00e300f4 in put_pixels16_y2_mmx2 ()
   from /opt/mythtv-trunk/lib/libmythavcodec-0.20.so.0
(gdb) t a a bt

Thread 10 (Thread -1515267184 (LWP 13567)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x010b448c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
#2  0x02ed5009 in QWaitCondition::wait ()
   from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#3  0x00568b68 in NuppelVideoPlayer::PrebufferEnoughFrames ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#4  0x00589809 in NuppelVideoPlayer::DisplayNormalFrame ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#5  0x00589d6e in NuppelVideoPlayer::OutputVideoLoop ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#6  0x0058a344 in NuppelVideoPlayer::kickoffOutputVideoLoop ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#7  0x010b044b in start_thread () from /lib/libpthread.so.0
#8  0x01d7480e in clone () from /lib/libc.so.6

Thread 9 (Thread -1372591216 (LWP 13565)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x01d34116 in nanosleep () from /lib/libc.so.6
#2  0x01d6ddfc in usleep () from /lib/libc.so.6
#3  0x052f99fe in AudioOutputBase::OutputAudioLoop ()
   from /opt/mythtv-trunk/lib/libmyth-0.20.so.0
#4  0x052fbed4 in AudioOutputBase::kickoffOutputAudioLoop ()
   from /opt/mythtv-trunk/lib/libmyth-0.20.so.0
#5  0x010b044b in start_thread () from /lib/libpthread.so.0
#6  0x01d7480e in clone () from /lib/libc.so.6

Thread 8 (Thread -1356870768 (LWP 13564)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x01d34116 in nanosleep () from /lib/libc.so.6
#2  0x01d6ddfc in usleep () from /lib/libc.so.6
#3  0x0029bebf in RingBuffer::ReadAheadThread ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#4  0x0029c30b in RingBuffer::StartReader ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#5  0x010b044b in start_thread () from /lib/libpthread.so.0
#6  0x01d7480e in clone () from /lib/libc.so.6

Thread 7 (Thread -1346380912 (LWP 13563)):
#0  0x00e300f4 in put_pixels16_y2_mmx2 ()
   from /opt/mythtv-trunk/lib/libmythavcodec-0.20.so.0
#1  0x00000028 in ?? ()
#2  0x00000002 in ?? ()
#3  0x00000005 in ?? ()
#4  0xab92a200 in ?? ()
#5  0x099cf920 in ?? ()
#6  0x00000002 in ?? ()
#7  0x00b7f499 in MPV_motion ()
   from /opt/mythtv-trunk/lib/libmythavcodec-0.20.so.0
#8  0xafbfbb08 in ?? ()
#9  0x01df3ff4 in ?? () from /lib/libc.so.6
#10 0x01df5120 in ?? () from /lib/libc.so.6
#11 0x01df5150 in main_arena () from /lib/libc.so.6
#12 0x09897d10 in ?? ()
#13 0x00000040 in ?? ()
#14 0x01df5120 in ?? () from /lib/libc.so.6
#15 0x08d4d970 in ?? ()
#16 0x01df3ff4 in ?? () from /lib/libc.so.6
#17 0x01df5120 in ?? () from /lib/libc.so.6
#18 0x00000001 in ?? ()
#19 0xafbfbb18 in ?? ()
#20 0x01df3ff4 in ?? () from /lib/libc.so.6
#21 0x01df5120 in ?? () from /lib/libc.so.6
#22 0xafbfbc04 in ?? ()
#23 0xafbfbb28 in ?? ()
#24 0x01d0debe in malloc () from /lib/libc.so.6
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Thread 6 (Thread -1335891056 (LWP 13562)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x01d6d561 in select () from /lib/libc.so.6
#2  0x0532f2aa in MythSocket::readyReadThread ()
   from /opt/mythtv-trunk/lib/libmyth-0.20.so.0
#3  0x010b044b in start_thread () from /lib/libpthread.so.0
#4  0x01d7480e in clone () from /lib/libc.so.6

Thread 5 (Thread -1325401200 (LWP 13561)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x01d34116 in nanosleep () from /lib/libc.so.6
#2  0x01d6ddfc in usleep () from /lib/libc.so.6
#3  0x0054151b in TV::RunTV () from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#4  0x00543ccb in TV::EventThread ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#5  0x010b044b in start_thread () from /lib/libpthread.so.0
#6  0x01d7480e in clone () from /lib/libc.so.6

Thread 4 (Thread -1313346672 (LWP 13560)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x01d34116 in nanosleep () from /lib/libc.so.6
#2  0x01d6ddfc in usleep () from /lib/libc.so.6
#3  0x0054151b in TV::RunTV () from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#4  0x00543ccb in TV::EventThread ()
   from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#5  0x010b044b in start_thread () from /lib/libpthread.so.0
#6  0x01d7480e in clone () from /lib/libc.so.6

Thread 2 (Thread -1211163760 (LWP 13558)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x010b4206 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x02ed505d in QWaitCondition::wait ()
   from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#3  0x051e0145 in MythContext::waitPrivRequest ()
   from /opt/mythtv-trunk/lib/libmyth-0.20.so.0
#4  0x0804a7fb in run_priv_thread ()
#5  0x010b044b in start_thread () from /lib/libpthread.so.0
#6  0x01d7480e in clone () from /lib/libc.so.6

Thread 1 (Thread -1208936224 (LWP 13531)):
#0  0x00110402 in __kernel_vsyscall ()
#1  0x01d34116 in nanosleep () from /lib/libc.so.6
#2  0x01d6ddfc in usleep () from /lib/libc.so.6
#3  0x004f2d6f in TV::StartTV () from /opt/mythtv-trunk/lib/libmythtv-0.20.so.0
#4  0x0804f24a in main ()
#0  0x00e300f4 in put_pixels16_y2_mmx2 ()
   from /opt/mythtv-trunk/lib/libmythavcodec-0.20.so.0
(gdb) 

[Janne Grunau]

The backtrace is useless.

Is there anything special with that file?

Is it a DVB/ATSC or ivtv recording?

If the former is your signal noisy?

Does it crash ffplay too? If yes, please report it to ffmpeg.

[Derek Atkins <warlord@…>]

Nothing special at all. It's just an HD recording of David Letterman recorded off an PCHD3000. Yes, the signal is a little noisy, but it's still above 90%. And the final answer is no, it does NOT crash ffplay too.

Why is the backtrace useless? Because thread 7 has a corrupted stack? Here's the backtrace from that thread using my r13508 build on a different machine (my main myth box). Is that any better?

#0  0x00002aaaabd3ca61 in put_pixels16_y2_mmx2 ()
   from /usr/local/lib/libmythavcodec-0.20.so.0
#1  0x00002aaaabaea59e in MPV_motion ()
   from /usr/local/lib/libmythavcodec-0.20.so.0
#2  0x00002aaaabaecff8 in MPV_decode_mb ()
---Type <return> to continue, or q <return> to quit---
   from /usr/local/lib/libmythavcodec-0.20.so.0
#3  0x00002aaaabbcf904 in mpeg_decode_slice ()
   from /usr/local/lib/libmythavcodec-0.20.so.0
#4  0x00002aaaabbd147e in mpeg_decode_frame ()
   from /usr/local/lib/libmythavcodec-0.20.so.0
#5  0x00002aaaabad3bb3 in avcodec_decode_video ()
   from /usr/local/lib/libmythavcodec-0.20.so.0
#6  0x00002aaaaafa3e96 in AvFormatDecoder::GetFrame ()
   from /usr/local/lib/libmythtv-0.20.so.0
#7  0x00002aaaaaf52310 in NuppelVideoPlayer::GetFrameNormal ()
   from /usr/local/lib/libmythtv-0.20.so.0
#8  0x00002aaaaaf527dc in NuppelVideoPlayer::GetFrame ()
   from /usr/local/lib/libmythtv-0.20.so.0
#9  0x00002aaaaaf63313 in NuppelVideoPlayer::StartPlaying ()
   from /usr/local/lib/libmythtv-0.20.so.0
#10 0x00002aaaaaebffd9 in SpawnDecode ()
   from /usr/local/lib/libmythtv-0.20.so.0
#11 0x00002aaaaeb66305 in start_thread () from /lib64/libpthread.so.0
#12 0x00000036376cd50d in clone () from /lib64/libc.so.6
#13 0x0000000000000000 in ?? ()

[Dibblah]

Can you please create a full backtrace with variable state, as documented in: http://www.mythtv.org/docs/mythtv-HOWTO-22.html#ss22.2

[Derek Atkins <warlord@…>]

Unfortunately no, I cannot create a full backtrace at this time. I'm currently 3000 miles away from my myth box, and wont be near it again for several months. Since this bug was reported there have been a few changes made that do help with the problem. Generally instead of crashing the frontend will now just reset itself. It's certainly better, but it would be nice to let the decoder keep going.

When I have the chance I'll certainly try to produce something for you, but it wont be for a while I'm afraid.

[danielk]

Need full backtrace, submitter unable to provide due to geographic challenge.