Segmentation Fault on MacOS arm

[tirlarim]

Hi! Got segmentation fault, then try to convert jpg image to avif lossless. Then convert it with default settings it works correctly. I use avifenc downloaded from brew (Version: 1.1.1 (aom [enc/dec]:3.9.1)) Image that I failed to convert applied as input.jpg. It is 80 mb, so I can't attach it here. I left a link to the Google drive with it https://drive.google.com/drive/folders/1ryzjPNWC4qsXEuS0IzTBpkRbnT9HpZc7?usp=sharing.

Also, this is LLDB backtrace:

➜  Desktop lldb avifenc                                 
(lldb) target create "avifenc"
Current executable set to '/opt/homebrew/bin/avifenc' (arm64).
(lldb) settings set  --  target.run-args --lossless input.jpg output.avif
(lldb) run
Process 45847 launched: '/opt/homebrew/bin/avifenc' (arm64)
Successfully loaded: input.jpg
AVIF to be written: (Lossless)
 * Resolution     : 16637x11603
 * Bit Depth      : 8
 * Format         : YUV444
 * Alpha          : Absent
 * Range          : Full
 * Color Primaries: 2
 * Transfer Char. : 2
 * Matrix Coeffs. : 0
 * ICC Profile    : Present (456 bytes)
 * XMP Metadata   : Absent
 * Exif Metadata  : Absent
 * Transformations: None
 * Progressive    : Unavailable
Encoding with codec 'aom' speed [6], color quality [100 (Lossless)], alpha quality [100 (Lossless)], tileRowsLog2 [0], tileColsLog2 [0], 16 worker thread(s), please wait...
Process 45847 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x14a3c8000)
    frame #0: 0x00000001845522c0 libsystem_platform.dylib`_platform_memmove + 288
libsystem_platform.dylib`_platform_memmove:
->  0x1845522c0 <+288>: ldp    q0, q1, [x1]
    0x1845522c4 <+292>: add    x1, x1, #0x20
    0x1845522c8 <+296>: subs   x2, x2, #0x20
    0x1845522cc <+300>: b.hi   0x1845522b8    ; <+280>
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x14a3c8000)
  * frame #0: 0x00000001845522c0 libsystem_platform.dylib`_platform_memmove + 288
    frame #1: 0x0000000100a2b4f4 libaom.3.dylib`remux_tiles + 920
    frame #2: 0x0000000100a24a28 libaom.3.dylib`av1_pack_bitstream + 3352
    frame #3: 0x0000000100a54f7c libaom.3.dylib`encode_with_recode_loop_and_filter + 8588
    frame #4: 0x0000000100a4d554 libaom.3.dylib`av1_encode + 3892
    frame #5: 0x0000000100a42838 libaom.3.dylib`av1_encode_strategy + 4968
    frame #6: 0x0000000100a4e9ec libaom.3.dylib`av1_get_compressed_data + 472
    frame #7: 0x0000000100a0cac4 libaom.3.dylib`encoder_encode + 3744
    frame #8: 0x00000001008af440 libaom.3.dylib`aom_codec_encode + 156
    frame #9: 0x00000001004bc614 libavif.16.dylib`aomCodecEncodeImage + 3560
    frame #10: 0x00000001004b4fb4 libavif.16.dylib`avifEncoderAddImageInternal + 1836
    frame #11: 0x00000001004b4874 libavif.16.dylib`avifEncoderAddImage + 72
    frame #12: 0x00000001000082e4 avifenc`avifEncodeImagesFixedQuality + 1060
    frame #13: 0x00000001000065c4 avifenc`main + 9700
    frame #14: 0x0000000184197154 dyld`start + 2476
(lldb) 

Also some hardware info here:

OS: macOS 14.6.1 23G93 arm64 
Host: Mac15,9 
Kernel: 23.6.0 
Shell: zsh 5.9 
CPU: Apple M3 Max (16 cores)
GPU: Apple M3 Max (40 cores)
RAM Memory: 48Gb 

[y-guyon]

Thank you for the bug report.

I can reproduce on my x86 linux machine:

git clone -b v1.1.1 https://github.com/AOMediaCodec/libavif.git 
cmake -S libavif -B libavif/build -DAVIF_BUILD_APPS=ON -DAVIF_CODEC_AOM=LOCAL -DAVIF_LIBYUV=LOCAL
cmake --build libavif/build --parallel
libavif/build/avifenc input.jpg output.avif # works
libavif/build/avifenc -q 100 input.jpg output.avif # works
libavif/build/avifenc -y 444 input.jpg output.avif # works
libavif/build/avifenc -q 100 -y 444 input.jpg output.avif # Segmentation fault
libavif/build/avifenc -q 100 -y 444 -j 0 input.jpg output.avif # Segmentation fault
libavif/build/avifenc --lossless input.jpg output.avif # Segmentation fault

The image dimensions are 16637×11603 pixels.

(note that I had to click on "Download all" in Google Drive, direct individual file download did not work)

[y-guyon]

Stack trace:

#0  __memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:540
#1  0x00005555558ae71d in aom_stop_encode (w=0x7fffffffc240) at libavif/ext/aom/aom_dsp/bitwriter.c:31
#2  0x000055555569f94e in av1_pack_tile_info (cpi=0x7ffff7562020, td=0x7ffff7577050, pack_bs_params=0x7fffffffc2e0)
    at libavif/ext/aom/av1/encoder/bitstream.c:3783

etc.

```c #3 0x000055555569ff35 in write_tile_obu (cpi=0x7ffff7562020, dst=0x7fffe820001d "2\020\030", total_size=0x7fffffffc414, saved_wb=0x7fffffffc4b0, obu_extn_header=0 '\000', fh_info=0x7fffffffc4c0, largest_tile_id=0x7fffffffc724, max_tile_size=0x7fffffffc410, obu_header_size=0x7fffffffc40c, tile_data_start=0x7fffffffc400) at libavif/ext/aom/av1/encoder/bitstream.c:3928 #4 0x00005555556a0543 in pack_tiles_in_tg_obus (cpi=0x7ffff7562020, dst=0x7fffe820001d "2\020\030", saved_wb=0x7fffffffc4b0, obu_extension_header=0 '\000', fh_info=0x7fffffffc4c0, largest_tile_id=0x7fffffffc724) at libavif/ext/aom/av1/encoder/bitstream.c:4068 #5 0x00005555556a0685 in write_tiles_in_tg_obus (cpi=0x7ffff7562020, dst=0x7fffe820001d "2\020\030", saved_wb=0x7fffffffc4b0, obu_extension_header=0 '\000', fh_info=0x7fffffffc4c0, largest_tile_id=0x7fffffffc724) at libavif/ext/aom/av1/encoder/bitstream.c:4104 #6 0x00005555556a0c30 in av1_pack_bitstream (cpi=0x7ffff7562020, dst=0x7fffe8200010 "\n\v?\373`~Z\245\302\004\004\r 2\020\030", size=0x7fffffffc978, largest_tile_id=0x7fffffffc724) at libavif/ext/aom/av1/encoder/bitstream.c:4242 #7 0x00005555556f7237 in encode_with_recode_loop_and_filter (cpi=0x7ffff7562020, size=0x7fffffffc978, dest=0x7fffe8200010 "\n\v?\373`~Z\245\302\004\004\r 2\020\030", sse=0x0, rate=0x0, largest_tile_id=0x7fffffffc724) at libavif/ext/aom/av1/encoder/encoder.c:3273 #8 0x00005555556f8f19 in encode_frame_to_data_rate (cpi=0x7ffff7562020, size=0x7fffffffc978, dest=0x7fffe8200010 "\n\v?\373`~Z\245\302\004\004\r 2\020\030") at libavif/ext/aom/av1/encoder/encoder.c:3888 #9 0x00005555556f95d9 in av1_encode (cpi=0x7ffff7562020, dest=0x7fffe8200010 "\n\v?\373`~Z\245\302\004\004\r 2\020\030", frame_input=0x7fffffffc9d0, frame_params=0x7fffffffc980, frame_results=0x7fffffffc978) at libavif/ext/aom/av1/encoder/encoder.c:4039 #10 0x0000555555c6afbd in denoise_and_encode (cpi=0x7ffff7562020, dest=0x7fffe8200010 "\n\v?\373`~Z\245\302\004\004\r 2\020\030", frame_input=0x7fffffffc9d0, frame_params=0x7fffffffc980, frame_results=0x7fffffffc978) at libavif/ext/aom/av1/encoder/encode_strategy.c:917 #11 0x0000555555c6d047 in av1_encode_strategy (cpi=0x7ffff7562020, size=0x7fffffffcd30, dest=0x7fffe8200010 "\n\v?\373`~Z\245\302\004\004\r 2\020\030", frame_flags=0x7fffffffcd38, time_stamp=0x7fffffffcd40, time_end=0x7fffffffcd48, timestamp_ratio=0x5555567cf0a0, pop_lookahead=0x7fffffffcd60, flush=0) at libavif/ext/aom/av1/encoder/encode_strategy.c:1697 #12 0x00005555556fa5d8 in av1_get_compressed_data (cpi=0x7ffff7562020, cpi_data=0x7fffffffcd20) at libavif/ext/aom/av1/encoder/encoder.c:4764 #13 0x00005555556784ac in encoder_encode (ctx=0x5555567ce9f0, img=0x7fffffffcf20, pts=0, duration=1, enc_flags=0) at libavif/ext/aom/av1/av1_cx_iface.c:3318 #14 0x00005555556265d0 in aom_codec_encode (ctx=0x5555567c8cf8, img=0x7fffffffcf20, pts=0, duration=1, flags=0) at libavif/ext/aom/aom/src/aom_encoder.c:191 #15 0x00005555555c53eb in aomCodecEncodeImage (codec=0x5555567c8c50, encoder=0x5555567c7ee0, image=0x5555567c7770, alpha=0, tileRowsLog2=0, tileColsLog2=0, quantizer=0, encoderChanges=0, disableLaggedOutput=0, addImageFlags=2, output=0x5555567c8be0) at libavif/src/codec_aom.c:1128 #16 0x00005555555bbb12 in avifEncoderAddImageInternal (encoder=0x5555567c7ee0, gridCols=1, gridRows=1, cellImages=0x7fffffffd260, durationInTimescales=1, addImageFlags=2) at libavif/src/write.c:1958 #17 0x00005555555bbc6d in avifEncoderAddImage (encoder=0x5555567c7ee0, image=0x5555567c7770, durationInTimescales=1, addImageFlags=2) at libavif/src/write.c:2000 #18 0x000055555558c67c in avifEncodeImagesFixedQuality (settings=0x7fffffffd7d0, input=0x7fffffffd890, firstFile=0x5555567c72a0, firstImage=0x5555567c7770, gridCells=0x0, encoded=0x7fffffffd740, byteSizes=0x7fffffffd650) at libavif/apps/avifenc.c:1217 #19 0x000055555558c844 in avifEncodeImages (settings=0x7fffffffd7d0, input=0x7fffffffd890, firstFile=0x5555567c72a0, firstImage=0x5555567c7770, gridCells=0x0, encoded=0x7fffffffd740, byteSizes=0x7fffffffd650) at libavif/apps/avifenc.c:1267 #20 0x00005555555917e2 in main (argc=9, argv=0x7fffffffdb58) at libavif/apps/avifenc.c:2493 ```

So it fails at https://aomedia.googlesource.com/aom/+/refs/tags/v3.9.1/aom_dsp/bitwriter.c#31:

memcpy(w->buffer, data, bytes);

[y-guyon]

This does not seem related to libavif so I filed https://aomedia.g-issues.chromium.org/issues/361552711.