1759596 - FFmpeg 5.0: Tab crash in [@ mozalloc_abort | abort | libavcodec.so.59@0x33bcda ] when page contains video (no VAAPI bug, it's disabled)

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: Playback, defect, P3)

Description

[abonnements]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0

Steps to reproduce:

lad page which contains video

Actual results:

tabs crash

Expected results:

video plays

Comment 1

[abonnements]

Firefox nightly (trunk) 100.0a1 (2022-03-13) (64-bit) (but previous version too) is crashing the tab if the page contains video content.
It happens also in "Troubleshoot Mode".
It doesn't happen in 98.0 (64-bit)

System is Kubuntu 21.10 with wayland or X11 and PipeWire.

When firefox-trunk is launched from terminal, I get loads of these errors:
Assertion src->f->buf[0] failed at libavcodec/h264_picture.c:105
Redirecting call to abort() to mozalloc_abort

There is NO crash report available. I repeat: Firefox is not making a crash report, about:crashes does not exist.

Comment 2

[abonnements]

As reported here:
https://support.mozilla.org/en-US/questions/1370789

Comment 3

[abonnements]

Also happens in a fresh profile.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video: Playback' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 5

[abonnements]

Ok, so the Nightly version from the PPA did not have the crash reporting. I've downloaded the Nightly from Mozilla and those are IDs:
bp-50c37452-9494-4706-bc35-7575e0220314
bp-2cda7aa0-10bb-4d79-907a-ecef70220314
bp-5ba10bb1-2140-4557-b5b2-811620220314
bp-9a0d844d-74f1-4455-8c3b-b7c340220314
bp-fb6e8adc-b39b-4213-8b23-9f9a30220314

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

So far you are the only user with this crash. Could you test with mozregression if it identifies as a build as the first one with issue, please?

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1750760

Comment 8

[Dianna Smith [:diannaS]]

:stransky can you take a look and see if this is sandbox related? 18k+ crashes seems a little odd even on one install

Comment 9

[Martin Stránský [:stransky] (ni? me)]

This is a dupe of Bug 1759137. I'm going to look at it next week.

Comment 10

[abonnements]

Nightly 101.0a1 (2022-04-04) (64-bit) is still affected:

bp-57841fef-1c33-4db0-b798-cc0120220405
bp-f1ba9b85-be30-40a6-acce-eb7ad0220405
bp-73b59cc1-bfbb-4ce7-8e15-ac35f0220405
bp-063e656e-3802-473c-9be5-f97e70220405
bp-cc497878-b372-45e6-8e82-500510220405

Comment 11

[Martin Stránský [:stransky] (ni? me)]

Please install debuginfo packages for libavcodec.so.59 library and try to get backtrace of the crash:
https://fedoraproject.org/wiki/Debugging_guidelines_for_Mozilla_products#Using_local_debugging
Thanks.

Comment 12

[Martin Stránský [:stransky] (ni? me)]

(In reply to abonnements from comment #1)

There is NO crash report available. I repeat: Firefox is not making a crash report, about:crashes does not exist.

Yes, crashes in RDD process is not tracked in about:crashes. But it should be visible in coredumpctl.

Comment 13

[Martin Stránský [:stransky] (ni? me)]

Also which ffmpeg version do you have? Is that reproducible with h264 only or also VP8/9 is affected?

Comment 14

[abonnements]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #12)

(In reply to abonnements from comment #1)

There is NO crash report available. I repeat: Firefox is not making a crash report, about:crashes does not exist.

Yes, crashes in RDD process is not tracked in about:crashes. But it should be visible in coredumpctl.

No, this was due to having the nightly PPA version installed which has all the crash reporting removed.

Comment 15

[abonnements]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #13)

Also which ffmpeg version do you have? Is that reproducible with h264 only or also VP8/9 is affected?

ffmpeg --version
ffmpeg version 4.4-6ubuntu5 Copyright (c) 2000-2021 the FFmpeg developers
built with gcc 11 (Ubuntu 11.2.0-7ubuntu1)
configuration: --prefix=/usr --extra-version=6ubuntu5 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-nvenc --enable-chromaprint --enable-frei0r --enable-libx264 --enable-shared
WARNING: library configuration mismatch
avcodec configuration: --prefix=/usr --extra-version=6ubuntu5 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-nvenc --enable-chromaprint --enable-frei0r --enable-libx264 --enable-shared --enable-version3 --disable-doc --disable-programs --enable-libaribb24 --enable-libopencore_amrnb --enable-libopencore_amrwb --enable-libtesseract --enable-libvo_amrwbenc --enable-libsmbclient
libavutil 56. 70.100 / 56. 70.100
libavcodec 58.134.100 / 58.134.100
libavformat 58. 76.100 / 58. 76.100
libavdevice 58. 13.100 / 58. 13.100
libavfilter 7.110.100 / 7.110.100
libswscale 5. 9.100 / 5. 9.100
libswresample 3. 9.100 / 3. 9.100
libpostproc 55. 9.100 / 55. 9.100

Comment 16

[abonnements]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #13)

Is that reproducible with h264 only or also VP8/9 is affected?

Is there a simple test page with media content somewhere?

Comment 17

[Martin Stránský [:stransky] (ni? me)]

If PPA has an issue please try Mozilla binaries:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries

Is there a simple test page with media content somewhere?

I use https://addons.mozilla.org/en-US/firefox/addon/enhanced-h264ify/ - you can select which codec is used on YT.

Comment 18

[abonnements]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #17)

If PPA has an issue please try Mozilla binaries:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries

Is there a simple test page with media content somewhere?

I use https://addons.mozilla.org/en-US/firefox/addon/enhanced-h264ify/ - you can select which codec is used on YT.

Only codec working on YouTube is VP9. Others are resulting in a message from YouTube: "This Video can't be played in your Browser" (translation)

Comment 19

[Martin Stránský [:stransky] (ni? me)]

You can use these clips: https://www.h264info.com/clips.html

Comment 20

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1750760

Comment 21

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Did you have a chance to check if the videos at https://www.h264info.com/clips.html cause the issue?

Comment 22

[Paul Menzel]

For me VAAPI stops working when navigating in a YouTube video, example crash.

There is also an entry in coredumpctl. With coredumpctl gdb the backtrace is:

Core was generated by `/opt/nightly/firefox-bin -contentproc -parentBuildID 20220412213655 -prefsLen 6'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f69d63bb439 in vaapi_buffer_free (opaque=0x7f69c4761b00, data=<optimized out>) at src/libavutil/hwcontext_vaapi.c:454
454	src/libavutil/hwcontext_vaapi.c: Datei oder Verzeichnis nicht gefunden.
--Type <RET> for more, q to quit, c to continue without paging--
[Current thread is 1 (Thread 0x7f69ce4cc640 (LWP 232421))]
(gdb) bt
#0  0x00007f69d63bb439 in vaapi_buffer_free (opaque=0x7f69c4761b00, data=<optimized out>) at src/libavutil/hwcontext_vaapi.c:454
#1  0x00007f69d63a10d7 in buffer_pool_flush (pool=0x7f69c4761c80) at src/libavutil/buffer.c:288
#2  buffer_pool_free (pool=<optimized out>) at src/libavutil/buffer.c:299
#3  pool_release_buffer (opaque=<optimized out>, data=<optimized out>) at src/libavutil/buffer.c:339
#4  0x00007f69d63a139e in buffer_replace (src=0x0, dst=<optimized out>) at src/libavutil/buffer.c:120
#5  av_buffer_unref (buf=<optimized out>) at src/libavutil/buffer.c:130
#6  0x00007f69dad6d209 in mozilla::VideoFrameSurface<58>::ReleaseVAAPIData(bool) () at /opt/nightly/libxul.so
#7  0x00007f69dad6c05d in mozilla::VideoFramePool<58>::ReleaseUnusedVAAPIFrames() () at /opt/nightly/libxul.so
#8  0x00007f69dad6bcc3 in mozilla::FFmpegVideoDecoder<58>::DoDecode(mozilla::MediaRawData*, unsigned char*, int, bool*, nsTArray<RefPtr<mozilla::MediaData> >&) () at /opt/nightly/libxul.so
#9  0x00007f69dad686c9 in mozilla::FFmpegDataDecoder<58>::DoDecode(mozilla::MediaRawData*, bool*, nsTArray<RefPtr<mozilla::MediaData> >&) ()
    at /opt/nightly/libxul.so
#10 0x00007f69dad6841d in mozilla::FFmpegDataDecoder<58>::ProcessDecode(mozilla::MediaRawData*) () at /opt/nightly/libxul.so
#11 0x00007f69dad6dd4f in mozilla::detail::ProxyRunnable<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>, RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> > (mozilla::FFmpegDataDecoder<58>::*)(mozilla::MediaRawData*), mozilla::FFmpegDataDecoder<58>, mozilla::MediaRawData*>::Run() () at /opt/nightly/libxul.so
#12 0x00007f69ddd5ff1e in mozilla::TaskQueue::Runner::Run() () at /opt/nightly/libxul.so
#13 0x00007f69ddd6b9da in nsThreadPool::Run() () at /opt/nightly/libxul.so
#14 0x00007f69dd32dba7 in nsThread::ProcessNextEvent(bool, bool*) () at /opt/nightly/libxul.so
#15 0x00007f69dd37e004 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) () at /opt/nightly/libxul.so
#16 0x00007f69ddf4388f in MessageLoop::Run() () at /opt/nightly/libxul.so
#17 0x00007f69ddd64bf1 in nsThread::ThreadFunc(void*) () at /opt/nightly/libxul.so
#18 0x00007f69e4662bd3 in _pt_root () at /opt/nightly/libnspr4.so
#19 0x0000561f36c1edee in set_alt_signal_stack_and_start(PthreadCreateParams*) ()
#20 0x00007f69e5685d80 in start_thread (arg=0x7f69ce4cc640) at pthread_create.c:481
#21 0x00007f69e521876f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 23

[Paul Menzel]

To clarify, the tab playing the YouTube video does not crash. There is only a interruption when navigating, and after that the core dump files are stored, and sudo intel_gpu_top shows, that the Video engine is not used anymore (before navigating it was).

Comment 25

[Shmerl]

For search reference (since it was marked as a duplicate), this crash happens to me since upgrade to Firefox 100 (b2 at present). It shows up in dmesg and Firefox itself lists corresponding errors in about:crashes.

Errors in dmesg looks like this (and supposedly happen in libavutil.so.56.70.100):

[Tue Apr 5 23:49:32 2022] MediaPD~oder #3[719429]: segfault at 18 ip 00007f51908d4439 sp 00007f518a9fe490 error 4 in libavutil.so.56.70.100[7f51908ad000+6e000]
[Tue Apr 5 23:49:32 2022] Code: 00 55 48 89 fd ba 01 00 00 00 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 48 8b 47 18 89 74 24 04 48 8d 74 24 04 <48> 8b 40 18 48 8b 38 e8 fb 90 fd ff 85 c0 75 17 48 8b 44 24 08 64

OS: Debian testing.
Firefox: Mozilla build, 100.0b2.
libavutil56: 7:4.4.1-3+b2

VAAPI enabled with about:config and env:

media.ffmpeg.vaapi.enabled = true
export MOZ_DISABLE_RDD_SANDBOX=1

Somehow these crashes don't actually interrupt playing videos in some visible fashion.

Comment 27

[abonnements]

Well, maybe after updating to 22.04 this will be solved.

Comment 28

[abonnements]

Right now Firefox stable is affected and nightly too. I might have to use Chrome now to browse any site with video.

5c57e1e2-71c3-3781-e91d-c835f1929060
0d978dea-d6cc-2b2d-f83c-91583436ca67
4714eb39-fcfe-18f4-bea4-e551c53e207e
3675d8c8-5a5f-bce8-57ff-ad4a5f9ea734
2589132d-d3eb-adf1-25ab-ff20bfd46c50

Comment 29

[abonnements]

Crashes in nightly firefox102: still affected.

bp-d5213c63-7d04-4196-8af2-2cc730220516
bp-9c87bb15-3b75-4e92-8426-6879f0220516
bp-7d8ae912-3058-4f91-8b29-06c8b0220516
bp-a9fbe323-2ea6-4f89-bc05-eff8f0220516
bp-d28e5599-07c0-49b9-b5d5-3644a0220516

Comment 30

[Martin Stránský [:stransky] (ni? me)]

(In reply to abonnements from comment #29)

Crashes in nightly firefox102: still affected.

bp-d5213c63-7d04-4196-8af2-2cc730220516
bp-9c87bb15-3b75-4e92-8426-6879f0220516
bp-7d8ae912-3058-4f91-8b29-06c8b0220516
bp-a9fbe323-2ea6-4f89-bc05-eff8f0220516
bp-d28e5599-07c0-49b9-b5d5-3644a0220516

That's ffmeg 5.0 crashes during decode, please attach content of about:support page.

Unfortunately that misses debug symbols from libavcodec.so.59 and I wonder how to get them. Which distro is that?
Thanks.

Comment 31

[Martin Stránský [:stransky] (ni? me)]

Do I understand correctly that this is Ubuntu 22.04 ?

Comment 32

[abonnements]

Attachment: about:support content

Comment 33

[abonnements]

This is Kubuntu 21.10. Will upgrade to 22.04 this week.

Comment 34

[Pascal Chevrel:pascalc (PTO until Sept 2)]

Is that Firefox installed via snap packages? Thanks

Comment 35

[abonnements]

(In reply to Pascal Chevrel:pascalc from comment #34)

Is that Firefox installed via snap packages? Thanks

No, it's the binary download.

Comment 36

[Darkspirit]

Offtopic VAAPI signatures have been bug 1762725.

Comment 37

[Darkspirit]

Ubuntu doesn't seem to have a libavcodec.so.59 in any package in any release (only .so.58), from where do you have it?

Comment 38

[Martin Stránský [:stransky] (ni? me)]

Please try to get backtrace of RDD process. Install debuginfo packages for ffmpeg and use coredump utility to get the backtrace:
https://fedoraproject.org/wiki/Debugging_guidelines_for_Mozilla_products#Using_coredumpctl_to_get_backtrace
Thanks.

Comment 39

[abonnements]

Upgrading my system to 22.04 fixed the issue for me.

Comment 40

[Martin Stránský [:stransky] (ni? me)]

Okay, Thanks.