Skip to content

Regressions in decoders: fmt_in becomes invalid before the end of the decoders and race against decoder update

The assertion is triggered:

int decoder_UpdateVideoOutput( decoder_t *dec, vlc_video_context *vctx_out )
{
    vlc_assert( dec->fmt_in->i_cat == VIDEO_ES && dec->cbs != NULL );

The format is unknown:

fmt_in	        const es_format_t *	0x13a0e0f58	0x000000013a0e0f58
|-> i_cat       es_format_category_e	UNKNOWN_ES

The stacktraces shows that it raced

vlc-input (3944)#0	0x000000019c8f6484 in __psynch_cvwait ()
#1	0x000000019c988f9c in _pthread_cond_wait ()
#2	0x0000000106b3bfdc in park_frame_worker_threads at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/pthread_frame.c:700
#3	0x0000000106b3bc3c in ff_frame_thread_free at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/pthread_frame.c:768
#4	0x0000000106b3b17c in ff_thread_free at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/pthread.c:85
#5	0x0000000106d97dec in avcodec_close at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/avcodec.c:583
#6	0x0000000106b20538 in avcodec_free_context at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/options.c:195
#7	0x0000000106629f84 in EndVideoDec at /Users/unidan/Workspace/test_skbuild/framework/vlc/modules/codec/avcodec/video.c:1345
#8	0x000000010218b194 in module_unneed at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/modules/modules.c:305
#9	0x00000001021b66e8 in decoder_Clean at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/decoder_helpers.c:58
#10	0x00000001021aed90 in DeleteDecoder at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/decoder.c:2120
#11	0x00000001021ae98c in vlc_input_decoder_Delete at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/decoder.c:2374
#12	0x00000001021beb04 in EsOutDestroyDecoder at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.c:2592
#13	0x00000001021be5cc in EsOutUnselectEs at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.c:2761
#14	0x00000001021c5edc in EsOutVaPrivControlLocked at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.c:3957
#15	0x00000001021babbc in EsOutPrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.c:4252
#16	0x00000001021cdbc0 in es_out_vaPrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.h:105
#17	0x00000001021cdc14 in es_out_PrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.h:112
#18	0x00000001021cd5d8 in CmdExecutePrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out_timeshift.c:1811
#19	0x00000001021cd074 in PrivControlLocked at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out_timeshift.c:801
#20	0x00000001021ca564 in PrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out_timeshift.c:860
#21	0x00000001021d60f4 in es_out_vaPrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.h:105
#22	0x00000001021d603c in es_out_PrivControl at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.h:112
#23	0x00000001021d3b68 in es_out_SetMode at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/es_out.h:119
#24	0x00000001021d15bc in End at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/input.c:1403
#25	0x00000001021cea54 in Run at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/input.c:434
#26	0x000000019c98585c in _pthread_start ()
Thread 3949#0	0x000000019c8f66b4 in __pthread_kill ()
#1	0x000000019c9866c0 in pthread_kill ()
#2	0x000000019c85c0e8 in abort ()
#3	0x000000019c85b608 in __assert_rtn ()
#4	0x00000001021b6828 in decoder_UpdateVideoOutput at /Users/unidan/Workspace/test_skbuild/framework/vlc/src/input/decoder_helpers.c:87
#5	0x00000001066295e8 in lavc_GetFrame at /Users/unidan/Workspace/test_skbuild/framework/vlc/modules/codec/avcodec/video.c:1572
#6	0x000000010684d9e8 in ff_get_buffer at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/decode.c:1944
#7	0x0000000106b3c4ec in thread_get_buffer_internal [inlined] at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/pthread_frame.c:1062
#8	0x0000000106b3c490 in ff_thread_get_buffer at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/pthread_frame.c:1122
#9	0x0000000106916988 in alloc_picture [inlined] at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/h264_slice.c:194
#10	0x0000000106916960 in h264_frame_start at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/h264_slice.c:510
#11	0x0000000106913c64 in h264_field_start [inlined] at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/h264_slice.c:1665
#12	0x00000001069132d4 in ff_h264_queue_decode_slice at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/h264_slice.c:2191
#13	0x000000010691b534 in decode_nal_units [inlined] at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/h264dec.c:622
#14	0x000000010691b070 in h264_decode_frame at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/h264dec.c:995
#15	0x0000000106b3c930 in frame_worker_thread at /Users/unidan/Workspace/test_skbuild/framework/vlc/contrib/contrib-arm64-apple-tvOS_11.0/ffmpeg/vlc_build/src/libavcodec/pthread_frame.c:225
#16	0x000000019c98585c in _pthread_start ()

Indeed, the input format is cleaned before the decoder is destroyed:

static void DeleteDecoder( vlc_input_decoder_t *p_owner, enum es_format_category_e i_cat )
{
    decoder_t *p_dec = &p_owner->dec;
    msg_Dbg( p_dec, "killing decoder fourcc `%4.4s'",
             (char*)&p_dec->fmt_in->i_codec );

    es_format_Clean( &p_owner->dec_fmt_in );
    es_format_Clean( &p_owner->pktz_fmt_in );
    decoder_Clean( p_dec );

The fix is to at least inverse the es_format_Cleans and the decoder_Clean, but maybe it makes more sense to move the format clean down even further.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

VideoLAN code repository instance