1767431 - [VA-API] Crash Report [@ av_opt_get ], and SIGSEGV in `vaapi_buffer_free()`

Status: RESOLVED DUPLICATE of bug 1762725

(Core :: Audio/Video: Playback, defect)

Description

[Paul Menzel]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Steps to reproduce:

On Debian sid/unstable with Nightly and currently ffmpeg (and related libraries) 7:4.4.2-1, since a while navigating in YouTube videos, the video stops, because a process is crashing. Afterwards, VA-API stops working until the video quality settings are changed.

Actual results:

https://crash-stats.mozilla.org/report/index/e6f02378-9eea-4039-b97c-2cad20220503 is an example crash. Sometimes a core dump is written (no idea if instead or additionally):

Core was generated by `/opt/nightly/firefox-bin -contentproc -parentBuildID 20220502213947 -prefsLen 1'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f8b5cba9439 in vaapi_buffer_free (opaque=0x7f8b6b837600, data=<optimized out>) at src/libavutil/hwcontext_vaapi.c:454
454	src/libavutil/hwcontext_vaapi.c: Datei oder Verzeichnis nicht gefunden.
[Current thread is 1 (Thread 0x7f8b549a1640 (LWP 1047774))]
(gdb) bt
#0  0x00007f8b5cba9439 in vaapi_buffer_free (opaque=0x7f8b6b837600, data=<optimized out>) at src/libavutil/hwcontext_vaapi.c:454
#1  0x00007f8b5cb8f0d7 in buffer_pool_flush (pool=0x7f8b6b837700) at src/libavutil/buffer.c:288
#2  buffer_pool_free (pool=<optimized out>) at src/libavutil/buffer.c:299
#3  pool_release_buffer (opaque=<optimized out>, data=<optimized out>) at src/libavutil/buffer.c:339
#4  0x00007f8b5cb8f39e in buffer_replace (src=0x0, dst=<optimized out>) at src/libavutil/buffer.c:120
#5  av_buffer_unref (buf=<optimized out>) at src/libavutil/buffer.c:130
#6  0x00007f8b615a774d in mozilla::VideoFrameSurface<58>::ReleaseVAAPIData(bool) () at /opt/nightly/libxul.so
#7  0x00007f8b615a656d in mozilla::VideoFramePool<58>::ReleaseUnusedVAAPIFrames() () at /opt/nightly/libxul.so
#8  0x00007f8b615a61e8 in mozilla::FFmpegVideoDecoder<58>::DoDecode(mozilla::MediaRawData*, unsigned char*, int, bool*, nsTArray<RefPtr<mozilla::MediaData> >&) () at /opt/nightly/libxul.so
#9  0x00007f8b615a2b95 in mozilla::FFmpegDataDecoder<58>::DoDecode(mozilla::MediaRawData*, bool*, nsTArray<RefPtr<mozilla::MediaData> >&) ()
    at /opt/nightly/libxul.so
#10 0x00007f8b615a28ed in mozilla::FFmpegDataDecoder<58>::ProcessDecode(mozilla::MediaRawData*) () at /opt/nightly/libxul.so
#11 0x00007f8b615a829f in mozilla::detail::ProxyRunnable<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>, RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> > (mozilla::FFmpegDataDecoder<58>::*)(mozilla::MediaRawData*), mozilla::FFmpegDataDecoder<58>, mozilla::MediaRawData*>::Run() () at /opt/nightly/libxul.so
#12 0x00007f8b645d693c in mozilla::TaskQueue::Runner::Run() () at /opt/nightly/libxul.so
#13 0x00007f8b645e1c60 in nsThreadPool::Run() () at /opt/nightly/libxul.so
#14 0x00007f8b63b93079 in nsThread::ProcessNextEvent(bool, bool*) () at /opt/nightly/libxul.so
#15 0x00007f8b63bdf354 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) () at /opt/nightly/libxul.so
#16 0x00007f8b647bfa5f in MessageLoop::Run() () at /opt/nightly/libxul.so
#17 0x00007f8b645db369 in nsThread::ThreadFunc(void*) () at /opt/nightly/libxul.so
#18 0x00007f8b6af61fa3 in _pt_root () at /opt/nightly/libnspr4.so
#19 0x0000562cbcc7104e in set_alt_signal_stack_and_start(PthreadCreateParams*) ()
#20 0x00007f8b6bf83d80 in start_thread (arg=0x7f8b549a1640) at pthread_create.c:481
#21 0x00007f8b6bb1876f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Expected results:

No crashes should happen.

Comment 1

[Paul Menzel]

Attachment: Output of `about:support`