HEVC crash on iOS

[skrew]

mpv version and platform

Libmpv (head), ffmpeg-mpv (head) Tested on iOS 10 (no HW Accel) and iOS 11 (HEVC HW Accel)

Reproduction steps

Playing a HEVC video (works with non-hevc videos)

Expected behavior

Video play

Actual behavior

Crashing

Log file

Crash in file vd_lavc.c Function: static bool do_send_packet(struct dec_video *vd, struct demux_packet *pkt) Line: int ret = avcodec_send_packet(avctx, pkt ? &avpkt : NULL); Error: mpv/mpv core (8): EXC_BAD_ACCESS (code=1, address=0x1000016c9)

Log file

[ghost]

Seems like it'd crash in FFmpeg, CC @tmm1

[tmm1]

Can you get a full backtrace?

[skrew]

Just tested with latest commits of mpv and ffmpeg-mpv and it works now.

just got a link error, don't know if it come from my build script or a problem in ffmpeg:

Undefined symbols for architecture x86_64:
  "_ff_mpeg12_find_best_frame_rate", referenced from:
      _mpeg2_metadata_update_fragment in libavcodec.a(mpeg2_metadata_bsf.o)

I have commented out the call of ff_mpeg12_find_best_frame_rate for this test.

EDIT: It don't crash but don't seem to uses hardware decoding anymore, for H264 and HEVC... I will look if it don't come from my latest work.

[skrew]

Ok, hardware decoder seem to be not working anymore.

[ 15.557][v][vd] Hardware decoding of this stream is unsupported?

Complete log

[ghost]

This was temporarily broken by the switch to the frame_params API. I fixed it in mpv/ffmpeg-mpv master, at least on OSX.

[skrew]

Ok, acceleration are back for H264 but the crash of HEVC too...

At least i can give the callstack now (for @tmm1 )

And the crash log in case you will need it (even if it's not a mpv error)

[tmm1]

Please get a full backtrace by typing "bt" into the debugger console

[skrew]

* thread #9, name = 'mpv/mpv core', stop reason = EXC_BAD_ACCESS (code=1, address=0x10000000016c9)
    frame #0: 0x000000010306782c`ff_videotoolbox_hvcc_extradata_create + 144
    frame #1: 0x0000000103068264`videotoolbox_default_init + 452
    frame #2: 0x0000000103067dac`videotoolbox_common_init + 156
    frame #3: 0x0000000102c0c210`ff_get_format + 488
    frame #4: 0x0000000102d80aa4`decode_nal_unit + 920
    frame #5: 0x0000000102d7f964`hevc_decode_frame + 364
    frame #6: 0x0000000102c0a9d4`decode_receive_frame_internal + 284
    frame #7: 0x0000000102c0a65c`avcodec_send_packet + 188
  * frame #8: 0x00000001029adae8`do_send_packet(vd=0x0000000113f685c0, pkt=0x00000001c0756510) at vd_lavc.c:979 [opt]
    frame #9: 0x00000001029ab758`video_work [inlined] send_packet(d_video=<unavailable>, packet=<unavailable>) at dec_video.c:280 [opt]
    frame #10: 0x00000001029ab6f8`video_work(d_video=<unavailable>) at dec_video.c:436 [opt]
    frame #11: 0x0000000102994830`video_decode_and_filter at video.c:495 [opt]
    frame #12: 0x0000000102994744`video_decode_and_filter(mpctx=0x000000013480e840) at video.c:590 [opt]
    frame #13: 0x0000000102992fb8`write_video at video.c:757 [opt]
    frame #14: 0x0000000102992eb0`write_video(mpctx=0x000000013480e840) at video.c:1245 [opt]
    frame #15: 0x000000010298f6f4`run_playloop(mpctx=0x000000013480e840) at playloop.c:1085 [opt]
    frame #16: 0x0000000102988e58`mp_play_files [inlined] play_current_file(mpctx=<unavailable>) at loadfile.c:1358 [opt]
    frame #17: 0x000000010298861c`mp_play_files(mpctx=0x000000013480e840) at loadfile.c:1519 [opt]
    frame #18: 0x0000000102975df4`core_thread(tag=0x000000016dabc60f) at client.c:468 [opt]
    frame #19: 0x00000001839a832c libsystem_pthread.dylib`_pthread_body + 308
    frame #20: 0x00000001839a81f8 libsystem_pthread.dylib`_pthread_start + 312
    frame #21: 0x00000001839a6c38 libsystem_pthread.dylib`thread_start + 4

[tmm1]

Thanks. I was hoping for line numbers.. can you compile ffmpeg with --disable-stripping --enable-debug

Maybe also with --disable-optimizations

[skrew]

Results with --enable-cross-compile --disable-programs --disable-doc --enable-pic --disable-stripping --enable-debug --disable-optimizations:

* thread #8, name = 'mpv/mpv core', stop reason = EXC_BAD_ACCESS (code=1, address=0x10000000016c9)
  * frame #0: 0x00000001059f9740 xxx`ff_videotoolbox_hvcc_extradata_create(avctx=0x000000010e8d1800) at videotoolbox.c:142
    frame #1: 0x00000001059fb06c xxx`videotoolbox_decoder_config_create(codec_type='hvc1', avctx=0x000000010e8d1800) at videotoolbox.c:681
    frame #2: 0x00000001059fa740 ccc`videotoolbox_default_init(avctx=0x000000010e8d1800) at videotoolbox.c:800
    frame #3: 0x00000001059fa294 xxx`videotoolbox_common_init(avctx=0x000000010e8d1800) at videotoolbox.c:944
    frame #4: 0x00000001052a53d0 xxx`setup_hwaccel(avctx=0x000000010e8d1800, fmt=AV_PIX_FMT_VIDEOTOOLBOX, name="videotoolbox_vld") at decode.c:1224
    frame #5: 0x00000001052a50f0 xxx`ff_get_format(avctx=0x000000010e8d1800, fmt=0x000000016bbc645c) at decode.c:1284
    frame #6: 0x00000001058226ac xxx`ff_thread_get_format(avctx=0x000000010e8d1800, fmt=0x000000016bbc645c) at pthread_frame.c:951
    frame #7: 0x0000000105580be8 xxx`get_format(s=0x000000010a8b3000, sps=0x0000000131048000) at hevcdec.c:409
    frame #8: 0x000000010557e888 xxx`hls_slice_header(s=0x000000010a8b3000) at hevcdec.c:517
    frame #9: 0x000000010557df88 xxx`decode_nal_unit(s=0x000000010a8b3000, nal=0x00000001c0cc5a20) at hevcdec.c:2864
    frame #10: 0x000000010557d9a8 xxx`decode_nal_units(s=0x000000010a8b3000, buf="", length=610) at hevcdec.c:2991
    frame #11: 0x000000010557c40c xxx`hevc_decode_frame(avctx=0x000000010e8d1800, data=0x000000012fe94290, got_output=0x000000016bbc6704, avpkt=0x000000012fe24f40) at hevcdec.c:3127
    frame #12: 0x00000001052a721c xxx`decode_simple_internal(avctx=0x000000010e8d1800, frame=0x000000012fe94290) at decode.c:397
    frame #13: 0x00000001052a70b0 xxx`decode_simple_receive_frame(avctx=0x000000010e8d1800, frame=0x000000012fe94290) at decode.c:593
    frame #14: 0x00000001052a36f8 xxx`decode_receive_frame_internal(avctx=0x000000010e8d1800, frame=0x000000012fe94290) at decode.c:611
    frame #15: 0x00000001052a324c xxx`avcodec_send_packet(avctx=0x000000010e8d1800, avpkt=0x000000016bbc6848) at decode.c:679
    frame #16: 0x0000000104df72ac xxx`do_send_packet(vd=0x000000012fe937d0, pkt=0x00000001c07479f0) at vd_lavc.c:979 [opt]
    frame #17: 0x0000000104df4f1c xxx`video_work [inlined] send_packet(d_video=<unavailable>, packet=<unavailable>) at dec_video.c:280 [opt]
    frame #18: 0x0000000104df4ebc xxx`video_work(d_video=<unavailable>) at dec_video.c:436 [opt]
    frame #19: 0x0000000104dddff4 xxx`video_decode_and_filter at video.c:495 [opt]
    frame #20: 0x0000000104dddf08 xxx`video_decode_and_filter(mpctx=0x000000010a826c40) at video.c:590 [opt]
    frame #21: 0x0000000104ddc77c xxx`write_video at video.c:757 [opt]
    frame #22: 0x0000000104ddc674 xxx`write_video(mpctx=0x000000010a826c40) at video.c:1245 [opt]
    frame #23: 0x0000000104dd8eb8 xxx`run_playloop(mpctx=0x000000010a826c40) at playloop.c:1085 [opt]
    frame #24: 0x0000000104dd261c xxx`mp_play_files [inlined] play_current_file(mpctx=<unavailable>) at loadfile.c:1358 [opt]
    frame #25: 0x0000000104dd1de0 xxx`mp_play_files(mpctx=0x000000010a826c40) at loadfile.c:1519 [opt]
    frame #26: 0x0000000104dbf5b8 xxx`core_thread(tag=0x000000016b88060f) at client.c:468 [opt]
    frame #27: 0x00000001839a832c libsystem_pthread.dylib`_pthread_body + 308
    frame #28: 0x00000001839a81f8 libsystem_pthread.dylib`_pthread_start + 312
    frame #29: 0x00000001839a6c38 libsystem_pthread.dylib`thread_start + 4

[tmm1]

Huh that's strange. What's on that line?

[skrew]

You mean at videotoolbox.c:142 ?

[tmm1]

Yea, like in the debugger what is the value of i and pps on that line when the crash occurs.

[skrew]

Ok, it crash on line vt_extradata_size += 2 + pps->data_size;

(lldb) p i
(int) $0 = 64
(lldb) p pps
(const HEVCPPS *) $1 = 0x0001000000000001

[skrew]

content of pps:

sps_id  unsigned int    0
sign_data_hiding_flag   uint8_t '\x01'
cabac_init_present_flag uint8_t '\0'
num_ref_idx_l0_default_active   int 1
num_ref_idx_l1_default_active   int 1
pic_init_qp_minus26 int 0
constrained_intra_pred_flag uint8_t '\0'
transform_skip_enabled_flag uint8_t '\0'
cu_qp_delta_enabled_flag    uint8_t '\x01'
diff_cu_qp_delta_depth  int 1
cb_qp_offset    int 0
cr_qp_offset    int 0
pic_slice_level_chroma_qp_offsets_present_flag  uint8_t '\0'
weighted_pred_flag  uint8_t '\x01'
weighted_bipred_flag    uint8_t '\0'
output_flag_present_flag    uint8_t '\0'
transquant_bypass_enable_flag   uint8_t '\0'
dependent_slice_segments_enabled_flag   uint8_t '\0'
tiles_enabled_flag  uint8_t '\0'
entropy_coding_sync_enabled_flag    uint8_t '\x01'
num_tile_columns    int 1
num_tile_rows   int 1
uniform_spacing_flag    uint8_t '\x01'
loop_filter_across_tiles_enabled_flag   uint8_t '\x01'
seq_loop_filter_across_slices_enabled_flag  uint8_t '\x01'
deblocking_filter_control_present_flag  uint8_t '\0'
deblocking_filter_override_enabled_flag uint8_t '\0'
disable_dbf uint8_t '\0'
beta_offset int 0
tc_offset   int 0
scaling_list_data_present_flag  uint8_t '\0'
scaling_list    ScalingList 
lists_modification_present_flag uint8_t '\0'
log2_parallel_merge_level   int 2
num_extra_slice_header_bits int 0
slice_header_extension_present_flag uint8_t '\0'
log2_max_transform_skip_block_size  uint8_t '\x02'
cross_component_prediction_enabled_flag uint8_t '\0'
chroma_qp_offset_list_enabled_flag  uint8_t '\0'
diff_cu_chroma_qp_offset_depth  uint8_t '\0'
chroma_qp_offset_list_len_minus1    uint8_t '\0'
cb_qp_offset_list   int8_t [6]  
cr_qp_offset_list   int8_t [6]  
log2_sao_offset_scale_luma  uint8_t '\0'
log2_sao_offset_scale_chroma    uint8_t '\0'
column_width    unsigned int *  0x12f4205f0 0x000000012f4205f0
row_height  unsigned int *  0x1080a90d0 0x00000001080a90d0
col_bd  unsigned int *  0x10fe98150 0x000000010fe98150
row_bd  unsigned int *  0x1080a7a70 0x00000001080a7a70
col_idxX    int *   0x12f420570 0x000000012f420570
ctb_addr_rs_to_ts   int *   0x10906d400 0x000000010906d400
ctb_addr_ts_to_rs   int *   0x1091d7600 0x00000001091d7600
tile_id int *   0x12e546800 0x000000012e546800
tile_pos_rs int *   0x1080cc240 0x00000001080cc240
min_tb_addr_zs  int *   0x109191048 0x0000000109191048
min_tb_addr_zs_tab  int *   0x109191000 0x0000000109191000
data    uint8_t [4096]  
data_size   int 7

[tmm1]

Thanks, this looks like the bug:

diff --git a/libavcodec/videotoolbox.c b/libavcodec/videotoolbox.c
index c942a2d30f..50c9f31fbf 100644
--- a/libavcodec/videotoolbox.c
+++ b/libavcodec/videotoolbox.c
@@ -136,7 +136,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx)
     int vt_extradata_size = 23 + 5 + vps->data_size + 5 + sps->data_size + 3;
     uint8_t *vt_extradata;

-    for (i = 0; i < MAX_PPS_COUNT; i++) {
+    for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) {
         if (h->ps.pps_list[i]) {
             const HEVCPPS *pps = (const HEVCPPS *)h->ps.pps_list[i]->data;
             vt_extradata_size += 2 + pps->data_size;
@@ -263,7 +263,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx)
              HEVC_NAL_PPS & 0x3f);
     AV_WB16(p + 1, num_pps);
     p += 3;
-    for (i = 0; i < MAX_PPS_COUNT; i++) {
+    for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) {
         if (h->ps.pps_list[i]) {
             const HEVCPPS *pps = (const HEVCPPS *)h->ps.pps_list[i]->data;
             AV_WB16(p, pps->data_size);

[skrew]

Yeah it works again ! 👍🏻 Thanks !

[pxia]

I haven't sent https://github.com/pxia/FFmpeg/commit/10d7a29d7a413af539d33baa3312df74b2af85e0 to ffmpeg yet. I think you should send yours first since mine doesn't address #4736 anyway...

[tmm1]

I've pushed that fix to the ffmpeg repo.

[skrew]

I'd still have this link issue:

Undefined symbols for architecture x86_64:
  "_ff_mpeg12_find_best_frame_rate", referenced from:
      _mpeg2_metadata_update_fragment in libavcodec.a(mpeg2_metadata_bsf.o)

@wm4 It's look like mpeg12framerate.c are missing in the Makefile of Libavcodec.

[tmm1]

I believe this issue can be closed.