segmentation fault when quit at hdr output

hooke007 commented 1 year ago

Important Information

Provide following Information:

mpv version master https://github.com/mpv-player/mpv/commit/02d009bc5c2dca3326c1a2551093c4bc3a67a6f7
macOS Version Sonoma
Source of the mpv binary or bundle build by the toolchain of https://github.com/deus0ww/homebrew-tap
If known which version of mpv introduced the problem N/a
Possible screenshot or video of visual glitches No

Reproduction steps

mpv --config=no --force-window=yes --idle=yes --vo=gpu-next --gpu-context=macvk --target-colorspace-hint=yes --log-file=test.log

Expected behavior

No error

Actual behavior

segmentation fault

seg.txt

Log file

test.log

Sample files

Any hdr video

Akemi commented 12 months ago

i can reproduce this, though no idea what exactly happens there. just to make things clear, it only happens with --target-colorspace-hint=yes.

[edit] used this as test file https://4kmedia.org/lg-new-york-hdr-uhd-4k-demo/

bigipalabom commented 11 months ago

i can reproduce this, though no idea what exactly happens there. just to make things clear, it only happens with --target-colorspace-hint=yes.

[edit] used this as test file https://4kmedia.org/lg-new-york-hdr-uhd-4k-demo/

Same finds here, mpv crashes. but how can I achieve HDR passthrough without using target-colorspace-hint?

bigipalabom commented 11 months ago

new founds hope it's helpful to locate the glitch. certain hdr video will keep on flashing less adjust mpv window size

below are my settings:

vo=gpu-next gpu-context=macvk gpu-api=vulkan hwdec=videotoolbox target-colorspace-hint=yes

[HDR pq] profile-cond=p[ "video-params/gamma"]=="pq" target-prim=bt.2020 target-trc=pq

[HDR hlg] profile-cond=p["video-params/gamma"]=="hlg" target-prim=bt.2020 target-trc=hlg

Akemi commented 8 months ago

the minimum settings to reproduce this mpv --no-config --vo=gpu-next --target-colorspace-hint.

crash report: crash.txt log: log.log

terminal also outputs a zsh: bus error

akemi@Mac-Studio mpv % build/mpv --no-config --vo=gpu-next --target-colorspace-hint /Users/Akemi/Downloads/LG\ New\ York\ HDR\ UHD\ 4K\ Demo.ts --log-file=/Users/Akemi/Desktop/log.log   
[ffmpeg/demuxer] mpegts: start time for stream 1 is not set in estimate_timings_from_pts
[ffmpeg/demuxer] mpegts: stream 1 : no TS found at start of file, duration not set
[ffmpeg/demuxer] mpegts: Could not find codec parameters for stream 1 (Audio: aac ([15][0][0][0] / 0x000F), 0 channels): unspecified sample format
[ffmpeg/demuxer] Consider increasing the value for the 'analyzeduration' (0) and 'probesize' (5000000) options
 (+) Video --vid=1 (hevc 3840x2160 25.000fps)
 (+) Audio --aid=1 (aac)
AO: [coreaudio] 48000Hz stereo 2ch floatp
VO: [gpu-next] 3840x2160 yuv420p10
AV: 00:00:01 / 00:01:12 (1%) A-V: -0.008 ct: -0.072 Dropped: 1 
Exiting... (Quit)
AV: 00:00:01 / 00:01:12 (1%) A-V: -0.008 ct: -0.072 Dropped: 1zsh: bus error  build/mpv --no-config --vo=gpu-next --target-colorspace-hint

[edit] output with/from ASan

==7992==ERROR: AddressSanitizer: BUS on unknown address (pc 0x000180b9fed8 bp 0x00016fec6ed0 sp 0x00016fec6e90 T16)
==7992==The signal is caused by a READ memory access.
==7992==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x180b9fed8 in objc_release+0x10 (libobjc.A.dylib:arm64e+0x7ed8)
    #1 0x180ba3aec in objc_autoreleasePoolPop+0x100 (libobjc.A.dylib:arm64e+0xbaec)
    #2 0x180bd420c in objc_tls_direct_base<AutoreleasePoolPage*, (tls_key)3, AutoreleasePoolPage::HotPageDealloc>::dtor_(void*)+0xa4 (libobjc.A.dylib:arm64e+0x3c20c)
    #3 0x180f669f8 in _pthread_tsd_cleanup+0x268 (libsystem_pthread.dylib:arm64e+0x49f8)
    #4 0x180f69720 in _pthread_exit+0x50 (libsystem_pthread.dylib:arm64e+0x7720)
    #5 0x180f6903c in _pthread_start+0x90 (libsystem_pthread.dylib:arm64e+0x703c)
    #6 0x180f63e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38)

==7992==Register values:
 x[0] = 0x0000000123d35710   x[1] = 0x04000001d76a7981   x[2] = 0x0000001000016578   x[3] = 0x0000000000000367  
 x[4] = 0x0000000000000048   x[5] = 0x0000000000000001   x[6] = 0x000000016fe44000   x[7] = 0x0000000000000001  
 x[8] = 0x0000000000000000   x[9] = 0x0000000123d35710  x[10] = 0x0000000116fed508  x[11] = 0x0000000000000003  
x[12] = 0x000000010e2fd8e0  x[13] = 0x000000010e2fd8f0  x[14] = 0x00000001d711d038  x[15] = 0x00000001d711d038  
x[16] = 0x000000100001657d  x[17] = 0x00000001daf3da18  x[18] = 0x0000000000000000  x[19] = 0x0000000121e26000  
x[20] = 0x0000000121e26038  x[21] = 0x0000000123d35710  x[22] = 0x000000016fec70e0  x[23] = 0x00000000a1a1a1a1  
x[24] = 0xa3a3a3a3a3a3a3a3  x[25] = 0x0000000000000001  x[26] = 0x0000000000000021  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016fec6ed0     lr = 0x0000000180ba7418     sp = 0x000000016fec6e90  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS (libobjc.A.dylib:arm64e+0x7ed8) in objc_release+0x10
Thread T16 created by T3 here:
    #0 0x1057681b0 in wrap_pthread_create+0x54 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4c1b0)
    #1 0x1012f0828 in vo_create vo.c:317
    #2 0x1012ede94 in init_best_video_out vo.c:342
    #3 0x100f7b50c in reinit_video_chain_src video.c:234
    #4 0x100f7ad10 in reinit_video_chain video.c:210
    #5 0x100eedcbc in play_current_file loadfile.c:1741
    #6 0x100ee4258 in mp_play_files loadfile.c:1998
    #7 0x100f0c5d0 in mpv_main main.c:432
    #8 0x10144fb20 in playback_thread macosx_application.m:278
    #9 0x180f69030 in _pthread_start+0x84 (libsystem_pthread.dylib:arm64e+0x7030)
    #10 0x180f63e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38)

Thread T3 created by T0 here:
    #0 0x1057681b0 in wrap_pthread_create+0x54 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4c1b0)
    #1 0x10144f104 in cocoa_main macosx_application.m:363
    #2 0x101468530 in main main-fn-cocoa.c:9
    #3 0x180bed0dc  (<unknown module>)

==7992==ABORTING
zsh: trace trap  build/mpv --no-config --vo=gpu-next --target-colorspace-hint

Akemi commented 8 months ago

coming from this call in mpv https://github.com/mpv-player/mpv/blob/6ecdedabe5cff2c3ec58354e4e999d2f3b3f3827/video/out/vo_gpu_next.c#L980 in libplacebo https://github.com/haasn/libplacebo/blob/e987124b516507f4eb71a29b53e288d3c590aa75/src/swapchain.c#L65-L67

some problem with the pointer to pl_color_space and inappropriate freeing?

Akemi commented 8 months ago

after trying to fix a problem with rendering on the main queue (https://github.com/Akemi/mpv/commits/mac_vulkan_main/) the crash persists but already crashs when trying to load an HDR file.

crash.txt

V: 00:00:00 / 00:00:13 (5%) DS: 2.5/0AddressSanitizer:DEADLYSIGNAL
=================================================================
==6459==ERROR: AddressSanitizer: SEGV on unknown address 0x00000001ba80 (pc 0x000182827ed8 bp 0x00016b80de00 sp 0x00016b80ddc0 T0)
==6459==The signal is caused by a READ memory access.
    #0 0x182827ed8 in objc_release+0x10 (libobjc.A.dylib:arm64e+0x7ed8)
    #1 0x18282baec in objc_autoreleasePoolPop+0x100 (libobjc.A.dylib:arm64e+0xbaec)
    #2 0x182c8c5d0 in _CFAutoreleasePoolPop+0x1c (CoreFoundation:arm64e+0x3c5d0)
    #3 0x182d9f02c in __CFRunLoopPerCalloutARPEnd+0x2c (CoreFoundation:arm64e+0x14f02c)
    #4 0x182cccaa4 in __CFRunLoopRun+0x7f0 (CoreFoundation:arm64e+0x7caa4)
    #5 0x182ccbc58 in CFRunLoopRunSpecific+0x25c (CoreFoundation:arm64e+0x7bc58)
    #6 0x18d248444 in RunCurrentEventLoopInMode+0x120 (HIToolbox:arm64e+0x30444)
    #7 0x18d248280 in ReceiveNextEventCommon+0x284 (HIToolbox:arm64e+0x30280)
    #8 0x18d247fd8 in _BlockUntilNextEventMatchingListInModeWithFilter+0x48 (HIToolbox:arm64e+0x2ffd8)
    #9 0x1864a6c50 in _DPSNextEvent+0x290 (AppKit:arm64e+0x39c50)
    #10 0x186c7ceb8 in -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]+0x2c8 (AppKit:arm64e+0x80feb8)
    #11 0x18649a0fc in -[NSApplication run]+0x1d8 (AppKit:arm64e+0x2d0fc)
    #12 0x1052de838 in cocoa_run_runloop application.m:271
    #13 0x1052ddd88 in cocoa_main application.m:367
    #14 0x1052db0f4 in main main-fn-mac.c:9
    #15 0x1828750dc  (<unknown module>)

==6459==Register values:
 x[0] = 0x0000000134b6d8a0   x[1] = 0x02000001d932f981   x[2] = 0x000000000001ba60   x[3] = 0x000000016b80dfa0  
 x[4] = 0x0000000000003d03   x[5] = 0x0000000000000000   x[6] = 0x0000000000000000   x[7] = 0x0000000000000000  
 x[8] = 0x0000000000000000   x[9] = 0x0000000134b6d8a0  x[10] = 0x0000000000000000  x[11] = 0x0000000000000001  
x[12] = 0x0000000000000000  x[13] = 0x001ffe9e00000100  x[14] = 0x001ffe9e00000100  x[15] = 0x0000000000000000  
x[16] = 0x000000000001ba63  x[17] = 0x00000001dcbc5a18  x[18] = 0x0000000000000000  x[19] = 0x0000000113856000  
x[20] = 0x0000000113856d68  x[21] = 0x0000000134b6d8a0  x[22] = 0x00000001d8da1fa0  x[23] = 0x00000000a1a1a1a1  
x[24] = 0xa3a3a3a3a3a3a3a3  x[25] = 0x0000000000000001  x[26] = 0x0000000112502e50  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016b80de00     lr = 0x000000018282f418     sp = 0x000000016b80ddc0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (libobjc.A.dylib:arm64e+0x7ed8) in objc_release+0x10
==6459==ABORTING

mpv-player / mpv