[MPlayer-users] crash in filter_video with lavdopts=threads=2

[William Brana]

Hello,

MPlayer is crashing with avi files

MPlayer 37423-4.8.5 (C) 2000-2015 MPlayer Team

Playing test.avi.
Cache fill: 0.00% (0 bytes)

libavformat version 56.40.100 (internal)
AVI file format detected.
ID_VIDEO_ID=0
[aviheader] Video stream found, -vid 0
ID_AUDIO_ID=1
[aviheader] Audio stream found, -aid 1
VIDEO: [XVID] 720x400 12bpp 29.970 fps 3062.7 kbps (373.9 kbyte/s)
Clip info:
Software: VirtualDubMod 1.5.10.2 (build 2540/release)
ID_CLIP_INFO_NAME0=Software
ID_CLIP_INFO_VALUE0=VirtualDubMod 1.5.10.2 (build 2540/release)
ID_CLIP_INFO_N=1
Load subtitles in ./
ID_FILENAME=test.avi
ID_DEMUXER=avi
ID_VIDEO_FORMAT=XVID
ID_VIDEO_BITRATE=3062664
ID_VIDEO_WIDTH=720
ID_VIDEO_HEIGHT=400
ID_VIDEO_FPS=29.970
ID_VIDEO_ASPECT=0.0000
ID_AUDIO_FORMAT=85
ID_AUDIO_BITRATE=192000
ID_AUDIO_RATE=0
ID_AUDIO_NCH=0
ID_START_TIME=0.00
ID_LENGTH=230.30
ID_SEEKABLE=1
ID_CHAPTERS=0
[gl] using extended formats. Use -vo gl:nomanyfmts if playback fails.
==========================================================================
Opening video decoder: [ffmpeg] FFmpeg's libavcodec codec family
libavcodec version 56.46.100 (internal)
Selected video codec: [ffodivx] vfm: ffmpeg (FFmpeg MPEG-4)
==========================================================================
ID_VIDEO_CODEC=ffodivx
==========================================================================
Requested audio codec family [mpg123] (afm=mpg123) not available.
Enable it at compilation.
Opening audio decoder: [ffmpeg] FFmpeg/libavcodec audio decoders
AUDIO: 48000 Hz, 2 ch, floatle, 192.0 kbit/6.25% (ratio: 24000->384000)
ID_AUDIO_BITRATE=192000
ID_AUDIO_RATE=48000
ID_AUDIO_NCH=2
Selected audio codec: [ffmp3float] afm: ffmpeg (FFmpeg MPEG layer-3 audio)
==========================================================================
[New Thread 0x3ffe8edc700 (LWP 104964)]
[New Thread 0x3ffe96dd700 (LWP 104963)]
AO: [alsa] 48000Hz 2ch s32le (4 bytes per sample)
ID_AUDIO_CODEC=ffmp3float
Starting playback...
Movie-Aspect is undefined - no prescaling applied.
VO: [gl] 720x400 => 720x400 Planar YV12
ATTENTION: default value of option vblank_mode overridden by environment.
ATTENTION: default value of option vblank_mode overridden by environment.
[mpeg4 @ 0x2aaaba4e3a0]Video uses a non-standard and wasteful way to
store B-frames ('packed B-frames'). Consider using the
mpeg4_unpack_bframes bitstream filter to fix it.
Movie-Aspect is 1.80:1 - prescaling to correct movie aspect.
ID_VIDEO_ASPECT=1.8000
VO: [gl] 720x400 => 720x400 Planar YV12
A: 0.4 V: 0.1 A-V: 0.316 ct: 0.000 3/ 3 ??% ??% ??,?% 2 0 99%
[VD_FFMPEG] DRI failure.

Program received signal SIGSEGV, Segmentation fault.
0x000003fff1ce4090 in __memcpy_sse2_unaligned () from /lib64/libc.so.6
(gdb) bt
#0 0x000003fff1ce4090 in __memcpy_sse2_unaligned () from /lib64/libc.so.6
#1 0x000003ffe3a32876 in memcpy_texture.isra () from /usr/lib64/dri/i965_dri.so
#2 0x000003ffe3a32ca6 in _mesa_texstore () from /usr/lib64/dri/i965_dri.so
#3 0x000003ffe3a336d5 in store_texsubimage () from /usr/lib64/dri/i965_dri.so
#4 0x000003ffe3a20d65 in _mesa_texture_sub_image () from
/usr/lib64/dri/i965_dri.so
#5 0x000003ffe3a21021 in texsubimage () from /usr/lib64/dri/i965_dri.so
#6 0x000003ffe3a2145b in _mesa_TexSubImage2D () from /usr/lib64/dri/i965_dri.so
#7 0x000002aaaabc63bc in glUploadTex (target=3553, format=6409,
type=5121, dataptr=<optimized out>, stride=<optimized out>, x=0,
y=<optimized out>, w=720, h=400, slice=400) at libvo/gl_common.c:822
#8 0x000002aaaabccba5 in draw_image (mpi=0x2aaac626050) at libvo/vo_gl.c:1110
#9 control (request=<optimized out>, data=<optimized out>) at
libvo/vo_gl.c:1424
#10 0x000002aaaac4a0fd in put_image (vf=0x2aaac0fd6a0,
mpi=0x2aaac626050, pts=<optimized out>) at libmpcodecs/vf_vo.c:168
#11 0x000002aaaac14883 in filter_video (sh_video=<optimized out>,
frame=0x2aaac626050, pts=0.10010010004043579) at
libmpcodecs/dec_video.c:486
#12 0x000002aaaabb6cd2 in update_video (blit_frame=0x3ffffffbd88) at
mplayer.c:2505
#13 0x000002aaaaba863a in main (argc=2, argv=0x3ffffffced8) at mplayer.c:3811

[William Brana]

It seems there is race condition because playback randomly works or
doesn't. This problem doesn't exist with all avi files. I can upload
that avi file if necessary.

[William Brana]

I have got some output from valgrind. Other applications don't crash.
Mesa is latest (10.6.1).

==470443== Invalid read of size 4
==470443== at 0x25C83B: mp_path_join (in /usr/bin/mplayer)
==470443== by 0x33D617: load_vob_subtitle (in /usr/bin/mplayer)
==470443== by 0x206A0F: main (in /usr/bin/mplayer)
==470443== Address 0x12467de4 is 20 bytes inside a block of size 23 alloc'd
==470443== at 0x4C2B0DF: malloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==470443== by 0x25C814: mp_path_join (in /usr/bin/mplayer)
==470443== by 0x33D617: load_vob_subtitle (in /usr/bin/mplayer)
==470443== by 0x206A0F: main (in /usr/bin/mplayer)
==470443==

many like these:
==470443== Invalid write of size 4
==470443== at 0x153D02AB: brw_emit_pipe_control_flush (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x153D0993: intel_emit_post_sync_nonzero_flush (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x153867C7: brw_init_state (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x152F9469: brwCreateContext (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x152DDFA4: driCreateContextAttribs (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x152DE0A5: driCreateNewContext (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0xA52AF39: dri2_create_context (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0xA4F7C0E: CreateContext (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0xA4F7F63: glXCreateContext (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0x2288AE: setGlWindow_x11 (in /usr/bin/mplayer)
==470443== by 0x23064D: config (in /usr/bin/mplayer)
==470443== by 0x222ABE: config_video_out (in /usr/bin/mplayer)
==470443== Address 0x2b491775000 is not stack'd, malloc'd or (recently) free'd
==470443==
==470443== Invalid write of size 4
==470443== at 0x153D0209: brw_emit_pipe_control_flush (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x153D0993: intel_emit_post_sync_nonzero_flush (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x153867C7: brw_init_state (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x152F9469: brwCreateContext (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x152DDFA4: driCreateContextAttribs (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x152DE0A5: driCreateNewContext (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0xA52AF39: dri2_create_context (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0xA4F7C0E: CreateContext (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0xA4F7F63: glXCreateContext (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0x2288AE: setGlWindow_x11 (in /usr/bin/mplayer)
==470443== by 0x23064D: config (in /usr/bin/mplayer)
==470443== by 0x222ABE: config_video_out (in /usr/bin/mplayer)
==470443== Address 0x2b491775004 is not stack'd, malloc'd or (recently) free'd
==470443==
==470443== Invalid write of size 4
==470443== at 0x153D012B: brw_emit_pipe_control_flush (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x153D0993: intel_emit_post_sync_nonzero_flush (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x153867C7: brw_init_state (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x152F9469: brwCreateContext (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x152DDFA4: driCreateContextAttribs (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x152DE0A5: driCreateNewContext (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0xA52AF39: dri2_create_context (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0xA4F7C0E: CreateContext (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0xA4F7F63: glXCreateContext (in /usr/lib64/libGL.so.1.2.0)
==470443== by 0x2288AE: setGlWindow_x11 (in /usr/bin/mplayer)
==470443== by 0x23064D: config (in /usr/bin/mplayer)
==470443== by 0x222ABE: config_video_out (in /usr/bin/mplayer)
==470443== Address 0x2b491775008 is not stack'd, malloc'd or (recently) free'd

last:
==470443== Invalid read of size 8
==470443== at 0x4C307F3: memcpy@@GLIBC_2.14 (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==470443== by 0x150F35D5: memcpy_texture.isra.0 (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x150F3A05: _mesa_texstore (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x150F4434: store_texsubimage (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x150E1DD4: _mesa_texture_sub_image (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x150E20A5: texsubimage (in /usr/lib64/mesa/i965_dri.so)
==470443== by 0x150E24D6: _mesa_TexSubImage2D (in
/usr/lib64/mesa/i965_dri.so)
==470443== by 0x229934: glUploadTex (in /usr/bin/mplayer)
==470443== by 0x2309D5: control (in /usr/bin/mplayer)
==470443== by 0x2C52AC: put_image (in /usr/bin/mplayer)
==470443== by 0x281662: filter_video (in /usr/bin/mplayer)
==470443== by 0x2184EF: update_video (in /usr/bin/mplayer)
==470443== Address 0x2b4916e5000 is not stack'd, malloc'd or (recently) free'd
==470443==


MPlayer interrupted by signal 11 in module: filter_video
ID_SIGNAL=11
- MPlayer crashed by bad usage of CPU/FPU/RAM.
Recompile MPlayer with --enable-debug and make a 'gdb' backtrace and
disassembly. Details in DOCS/HTML/en/bugreports_what.html#bugreports_crash.
- MPlayer crashed. This shouldn't happen.
It can be a bug in the MPlayer code _or_ in your drivers _or_ in your
gcc version. If you think it's MPlayer's fault, please read
DOCS/HTML/en/bugreports.html and follow the instructions there. We can't and
won't help unless you provide this information when reporting a possible bug.

[William Brana]

I ran valgrind on crashing and non-crashing avi file and found some
errors which are present only with crashing file. I'm not aware of
easy comparison of valgrind outputs.

==136168== Thread 2:
==136168== Invalid write of size 8
==136168== at 0x86BFEB: ??? (fpel.asm:106)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x3141709e000 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFEF: ??? (fpel.asm:106)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x3141709e2e0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFF4: ??? (fpel.asm:106)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x3141709e5c0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFF9: ??? (fpel.asm:106)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x3141709e8a0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC57: ??? (fpel.asm:95)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e8c00 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC5A: ??? (fpel.asm:95)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e8d70 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC5E: ??? (fpel.asm:95)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e8ee0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC62: ??? (fpel.asm:95)
==136168== by 0x5211C6: decode_slice (h263dec.c:297)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e9050 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC57: ??? (fpel.asm:95)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fb700 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC5A: ??? (fpel.asm:95)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fb870 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC5E: ??? (fpel.asm:95)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fb9e0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC62: ??? (fpel.asm:95)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fbb50 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFEB: ??? (fpel.asm:106)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e32c0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFEF: ??? (fpel.asm:106)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e35a0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFF4: ??? (fpel.asm:106)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e3880 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BFF9: ??? (fpel.asm:106)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170e3b60 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC57: ??? (fpel.asm:95)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fa160 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC5A: ??? (fpel.asm:95)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fa2d0 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC5E: ??? (fpel.asm:95)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fa440 is not stack'd, malloc'd or (recently) free'd
==136168==
==136168== Invalid write of size 8
==136168== at 0x86BC62: ??? (fpel.asm:95)
==136168== by 0x5214CE: decode_slice (h263dec.c:264)
==136168== by 0x521D9E: ff_h263_decode_frame (h263dec.c:635)
==136168== by 0x6D479A: frame_worker_thread (pthread_frame.c:159)
==136168== by 0x66454CB: start_thread (in /lib64/libpthread-2.20.so)
==136168== by 0xAD10E3C: clone (in /lib64/libc-2.20.so)
==136168== Address 0x314170fa5b0 is not stack'd, malloc'd or (recently) free'd
==136168==

==136168== Invalid read of size 8
==136168== at 0x4C307F3: memcpy@@GLIBC_2.14 (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==136168== by 0x150F35D5: memcpy_texture.isra.0 (in
/usr/lib64/mesa/i965_dri.so)
==136168== by 0x150F3A05: _mesa_texstore (in /usr/lib64/mesa/i965_dri.so)
==136168== by 0x150F4434: store_texsubimage (in /usr/lib64/mesa/i965_dri.so)
==136168== by 0x150E1DD4: _mesa_texture_sub_image (in
/usr/lib64/mesa/i965_dri.so)
==136168== by 0x150E20A5: texsubimage (in /usr/lib64/mesa/i965_dri.so)
==136168== by 0x150E24D6: _mesa_TexSubImage2D (in
/usr/lib64/mesa/i965_dri.so)
==136168== by 0x22467B: glUploadTex (gl_common.c:822)
==136168== by 0x22AE64: draw_image (vo_gl.c:1110)
==136168== by 0x22AE64: control (vo_gl.c:1424)
==136168== by 0x2A83BC: put_image (vf_vo.c:168)
==136168== by 0x272B42: filter_video (dec_video.c:486)
==136168== by 0x214F91: update_video (mplayer.c:2505)
==136168== Address 0x3141709e000 is not stack'd, malloc'd or (recently) free'd
==136168==

[William Brana]

It seems crash is related to option -vo gl:yuv=4
-vo gl doesn't crash.

[William Brana]

Post by William Brana
It seems crash is related to option -vo gl:yuv=4
-vo gl doesn't crash.

With -vo gl, it is still crashing with valgrind, but doesn't crash
without valgrind. There is buffer corruption at start of playback. It
seems thread synchronization is broken.

[Reimar Döffinger]

Post by William Brana

Post by William Brana
It seems crash is related to option -vo gl:yuv=4
-vo gl doesn't crash.

With -vo gl, it is still crashing with valgrind, but doesn't crash
without valgrind. There is buffer corruption at start of playback. It
seems thread synchronization is broken.

Try with -noslices.
That feature has been broken in FFmpeg semi-frequently, it is
not unlikely multithreading breaks it even worse than normal.
It should only be files with older codecs that are affected then,
as slice rendering was only ever implemented for them (and on
modern machines the speed advantages of it are probably negligible).

[William Brana]

Post by Reimar Döffinger
Try with -noslices.

-noslices seems to have no effect
valgrind mplayer -noslices -vo gl ./.test.avi

==337033== Thread 2:
==337033== Invalid write of size 8
==337033== at 0x96BFFB: ??? (in /usr/bin/mplayer)
==337033== by 0x582E06: decode_slice (in /usr/bin/mplayer)
==337033== by 0x583CFD: ff_h263_decode_frame (in /usr/bin/mplayer)
==337033== by 0x78F44A: frame_worker_thread (in /usr/bin/mplayer)
==337033== by 0x66444CB: start_thread (in /lib64/libpthread-2.20.so)
==337033== by 0xAD1EE3C: clone (in /lib64/libc-2.20.so)
==337033== Address 0x36e88ec4000 is not stack'd, malloc'd or (recently) free'd

==337033== Invalid read of size 8
==337033== at 0x4C305CB: memcpy@@GLIBC_2.14 (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==337033== by 0x13D14BAD: memcpy_texture.isra.0 (in
/usr/lib64/mesa/i965_dri.so)
==337033== by 0x13D14FD1: _mesa_texstore (in /usr/lib64/mesa/i965_dri.so)
==337033== by 0x13D158E9: store_texsubimage (in /usr/lib64/mesa/i965_dri.so)
==337033== by 0x13D03521: _mesa_texture_sub_image (in
/usr/lib64/mesa/i965_dri.so)
==337033== by 0x13D037ED: texsubimage (in /usr/lib64/mesa/i965_dri.so)
==337033== by 0x13D03B96: _mesa_TexSubImage2D (in
/usr/lib64/mesa/i965_dri.so)
==337033== by 0x22844B: glUploadTex (in /usr/bin/mplayer)
==337033== by 0x22F6D2: control (in /usr/bin/mplayer)
==337033== by 0x2C541C: put_image (in /usr/bin/mplayer)
==337033== by 0x280E85: filter_video (in /usr/bin/mplayer)
==337033== by 0x216C9F: update_video (in /usr/bin/mplayer)
==337033== Address 0x36e88ec4000 is not stack'd, malloc'd or (recently) free'd
==337033==


MPlayer interrupted by signal 11 in module: filter_video

[William Brana]

found fix for crash: -nodr
which also fixed video corruption at start of playback