segmetation fault when running with osc=no on intel-media-driver

[ces42]

mpv Information

mpv 0.39.0 Copyright © 2000-2024 mpv/MPlayer/mplayer2 projects
libplacebo version: v7.349.0
FFmpeg version: 7.0.2
FFmpeg library versions:
   libavcodec      61.3.100
   libavdevice     61.1.100
   libavfilter     10.1.100
   libavformat     61.1.100
   libavutil       59.8.100
   libswresample   5.1.100
   libswscale      8.1.100

Other Information

- Linux version: Fedora Linux 41 Workstation
- Kernel Version: 6.11
- GPU Model: [0300]: Intel Corporation Meteor Lake-P [Intel Arc Graphics]
- Mesa/GPU Driver Version: 4.6 (Compatibility Profile) Mesa 24.2.8
- Window Manager and Version: Gnome 47
- Source of mpv: package manager
- Latest known working version: none

Reproduction Steps

If I using the intel-media-driver Fedora package, mpv --no-config --osc=no --hwdec=vaapi mov_bbb.mp4 leads to a segfault. The video file does not seem to be relevant, e.g. https://www.w3schools.com/tags/mov_bbb.mp4 triggers the crash.

Expected Behavior

No crash happens I don't pass the osc=no argument -- see log file output-nocrash.txt
Uninstalling the intel-media-driver package also prevents mpv from crashing.

Actual Behavior

segmentation fault

Log File

output.txt
output-nocrash.txt

backtrace, obtained by running gdb --args mpv --no-config --osc=no --hwdec=vaapi mov_bbb.mp4

#0  0x00007ffff43d4947 in __memmove_avx_unaligned_erms () at /lib64/libc.so.6
#1  0x00007fffcc262890 in MosUtilities::MosSecureMemcpy(void*, unsigned long, void const*, unsigned long) () at /usr/lib64/dri-nonfree/iHD_drv_video.so
#2  0x00007fffcc41f728 in MediaLibvaInterface::PutImage(VADriverContext*, unsigned int, unsigned int, int, int, unsigned int, unsigned int, int, int, unsigned int, unsigned int)
    () at /usr/lib64/dri-nonfree/iHD_drv_video.so
#3  0x00007ffff44d70de in vaPutImage () at /lib64/libva.so.2
#4  0x00007ffff50280ae in vaapi_unmap_frame () at /lib64/libavutil.so.59
#5  0x00007ffff50247ab in ff_hwframe_unmap () at /lib64/libavutil.so.59
#6  0x00007ffff50113f5 in buffer_replace () at /lib64/libavutil.so.59
#7  0x00007ffff501cdac in av_frame_unref () at /lib64/libavutil.so.59
#8  0x00007ffff501cf12 in av_frame_free () at /lib64/libavutil.so.59
#9  0x00007ffff502d342 in vaapi_transfer_data_to.lto_priv () at /lib64/libavutil.so.59
#10 0x00007ffff50248ca in av_hwframe_transfer_data () at /lib64/libavutil.so.59
#11 0x000055555562675e in mp_av_pool_image_hw_upload ()
#12 0x00005555556aa14e in try_format_upload ()
#13 0x00005555556aabac in init.lto_priv ()
#14 0x0000555555627737 in load_add_hwdec ()
#15 0x000055555562a222 in ra_hwdec_ctx_load_fmt ()
#16 0x0000555555648bc5 in control.lto_priv ()
#17 0x000055555563621e in run_control.lto_priv ()
#18 0x00005555555b5421 in mp_dispatch_queue_process ()
#19 0x000055555563669e in vo_thread ()
#20 0x00007ffff42fdcd7 in start_thread () at /lib64/libc.so.6
#21 0x00007ffff4381c8c in __clone3 () at /lib64/libc.so.6

Sample Files

No response

I carefully read all instruction and confirm that I did the following:

• I tested with the latest mpv version to validate that the issue is not already fixed.
• I provided all required information including system and mpv version.
• I produced the log file with the exact same set of files, parameters, and conditions used in "Reproduction Steps", with the addition of --log-file=output.txt.
• I produced the log file while the behaviors described in "Actual Behavior" were actively observed.
• I attached the full, untruncated log file.
• I attached the backtrace in the case of a crash.

[Dudemanguy]

Does this work on git master? osc=no shouldn't matter regardless...

[kasper93]

Likely "fixed" by #15055 It turns out drivers are really bad at supporting formats that they say they would.

Please try latest version from git.

EDIT:

Duplicate of #15030 (the same stacktrace)

[ces42]

I haven't managed to compile mpv since Fedora's libavcodec-devel conflicts with the media packages from the rpmfusion repositories. If anyone knows how to cirucmvent this I'd appreciate a pointer -- otherwise I suppose I will swap out the packages and report back.

[kasper93]

You can use https://github.com/mpv-player/mpv-build to help you build also ffmpeg and link it statically with mpv.

[ces42]

In any case, the fact that the crash only happens for osc=no makes it sound like there is a bug somewhere, regardless of whether #15030 fixes the symptoms.

[kasper93]

try_format_upload is fully standalone test, it creates new image, uploads it and try to export. There is nothing dependent on other modules. No matter how/why this code were executed, it is still a crash in intel-media-driver probably doing some format that they do not support properly. osc=no is not relevant, because while it may trigger this for you, it is not a factor that causes the crash itself.

Also intel-media-driver is know to have buggy conversions, see #15439 which in turn doesn't crash, but is doing conversion wrong. try_format_upload previously was testing all formats, so it is not surprising that it hit some bugs in this code...

[ces42]

The current master branch does not reproduce the issue.

[kasper93]

For reference upstream bug reports:

intel/media-driver#1887
intel/media-driver#1879