[r25958] crash in ff_er_add_slice()

[Christian.Kirbach@…]

AVI file format detected.
[aviheader] Video stream found, -vid 0
[aviheader] Audio stream found, -aid 1
VIDEO: [XVID] 640x272 12bpp 25.000 fps 1508.3 kbps (184.1 kbyte/s)
Clip info:

Software: VirtualDubMod 1.5.10.2 (build 2540/release)

==========================================================================
Opening video decoder: [ffmpeg] FFmpeg's libavcodec codec family
Selected video codec: [ffodivx] vfm: ffmpeg (FFmpeg MPEG-4)
==========================================================================
==========================================================================
Opening audio decoder: [mp3lib] MPEG layer-2, layer-3
AUDIO: 44100 Hz, 2 ch, s16le, 128.0 kbit/9.07% (ratio: 16000->176400)
Selected audio codec: [mp3] afm: mp3lib (mp3lib MPEG layer-2, layer-3)
==========================================================================
AO: [oss] 44100Hz 2ch s16le (2 bytes per sample)
Starting playback...
VDec: vo config request - 640 x 272 (preferred colorspace: Planar YV12)
VDec: using Planar YV12 as output csp (no 0)
Movie-Aspect is 2.35:1 - prescaling to correct movie aspect.
VO: [xv] 640x272 => 640x272 Planar YV12

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1221142864 (LWP 25651)]
0x085db3bc in ff_er_add_slice (s=0x89c6860, startx=0, starty=0, endx=39,

endy=16, status=112) at error_resilience.c:621

621 const int start_xy= s->mb_index2xy[start_i];
(gdb) bt full
#0 0x085db3bc in ff_er_add_slice (s=0x89c6860, startx=0, starty=0, endx=39,

endy=16, status=112) at error_resilience.c:621

start_i = 0
end_i = 679
start_xy = 4
end_xy = <value optimized out>
mask = <value optimized out>

#1 0x0846aee4 in decode_slice ()
No symbol table info available.
#2 0x00000000 in ?? ()
No symbol table info available.
(gdb) disass $pc-32 $pc+32
Dump of assembler code from 0x85db39c to 0x85db3dc:
0x085db39c <ff_er_add_slice+64>: add %al,(%eax)
0x085db39e <ff_er_add_slice+66>: add %al,(%eax)
0x085db3a0 <ff_er_add_slice+68>: add 0x14(%ebp),%eax
0x085db3a3 <ff_er_add_slice+71>: js 0x85db3ad <ff_er_add_slice+81>
0x085db3a5 <ff_er_add_slice+73>: cmp %ecx,%eax
0x085db3a7 <ff_er_add_slice+75>: cmovle %eax,%ecx
0x085db3aa <ff_er_add_slice+78>: mov %ecx,0xffffffec(%ebp)
0x085db3ad <ff_er_add_slice+81>: mov 0x1854(%esi),%eax
0x085db3b3 <ff_er_add_slice+87>: mov 0xffffffe8(%ebp),%edx
0x085db3b6 <ff_er_add_slice+90>: shl $0x2,%edx
0x085db3b9 <ff_er_add_slice+93>: mov %edx,0xffffffe4(%ebp)
0x085db3bc <ff_er_add_slice+96>: mov (%eax,%edx,1),%ecx
0x085db3bf <ff_er_add_slice+99>: mov %ecx,0xfffffff0(%ebp)
0x085db3c2 <ff_er_add_slice+102>: mov 0xffffffec(%ebp),%edx
0x085db3c5 <ff_er_add_slice+105>: mov (%eax,%edx,4),%ebx
0x085db3c8 <ff_er_add_slice+108>: mov 0xffffffe8(%ebp),%ecx
0x085db3cb <ff_er_add_slice+111>: cmp %ecx,%edx
0x085db3cd <ff_er_add_slice+113>: jl 0x85db3d4 <ff_er_add_slice+120>
0x085db3cf <ff_er_add_slice+115>: cmp %ebx,0xfffffff0(%ebp)
0x085db3d2 <ff_er_add_slice+118>: jle 0x85db3f3 <ff_er_add_slice+151>
0x085db3d4 <ff_er_add_slice+120>: movl $0x880191c,0x8(%esp)
End of assembler dump.
(gdb) info all-registers
eax 0xa6e 2670
ecx 0x2a7 679
edx 0x0 0
ebx 0x28 40
esp 0xbfbeea50 0xbfbeea50
ebp 0xbfbeea78 0xbfbeea78
esi 0x89c6860 144468064
edi 0x70 112
eip 0x85db3bc 0x85db3bc <ff_er_add_slice+96>
eflags 0x210256 [ PF AF ZF IF RF ID ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
st0 -nan(0x7d7d7d7d7d7d7d7d) (raw 0xffff7d7d7d7d7d7d7d7d)
st1 -nan(0x7d007d007d007d) (raw 0xffff007d007d007d007d)
st2 -nan(0x7e7e7e7e7e7e7e7e) (raw 0xffff7e7e7e7e7e7e7e7e)
st3 -nan(0x7e007e007e007e) (raw 0xffff007e007e007e007e)
st4 -nan(0x7e7e7d7d7d7d7e7e) (raw 0xffff7e7e7d7d7d7d7e7e)
st5 -nan(0x7e007e007d007d) (raw 0xffff007e007e007d007d)
st6 -nan(0x7f7e7e7d7d7e7e7f) (raw 0xffff7f7e7e7d7d7e7e7f)
---Type <return> to continue, or q <return> to quit---
st7 -nan(0x7f007e007e007d) (raw 0xffff007f007e007e007d)
fctrl 0x37f 895
fstat 0x120 288
ftag 0xaaaa 43690
fiseg 0x73 115
fioff 0x80b459a 134956442
foseg 0x7b 123
fooff 0x8853cf4 142949620
fop 0x11d 285
xmm0 {v4_float = {0x1e0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0},

v16_int8 = {0x0, 0x0, 0xf0, 0x43, 0x0 <repeats 12 times>}, v8_int16 = {0x0,

0x43f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x43f00000, 0x0, 0x0,
0x0}, v2_int64 = {0x43f00000, 0x0},

uint128 = 0x00000000000000000000000043f00000}

xmm1 {v4_float = {0xffffffe8, 0x18, 0xffffffae, 0xffffffdd},

v2_double = {0x2df11783, 0xfffffffc7cacc7ac}, v16_int8 = {0x8b, 0xf8, 0xc6,

0xc1, 0x8b, 0xf8, 0xc6, 0x41, 0x47, 0xef, 0xa5, 0xc2, 0x99, 0x1a, 0xc,
0xc2}, v8_int16 = {0xf88b, 0xc1c6, 0xf88b, 0x41c6, 0xef47, 0xc2a5, 0x1a99,
0xc20c}, v4_int32 = {0xc1c6f88b, 0x41c6f88b, 0xc2a5ef47, 0xc20c1a99},

v2_int64 = {0x41c6f88bc1c6f88b, 0xc20c1a99c2a5ef47},
uint128 = 0xc20c1a99c2a5ef4741c6f88bc1c6f88b}

xmm2 {v4_float = {0x1, 0x0, 0x1, 0x0}, v2_double = {0x0, 0x0},

v16_int8 = {0x0, 0x0, 0x80, 0x3f, 0xf3, 0x4, 0x35, 0x3f, 0x0, 0x0, 0x80,

---Type <return> to continue, or q <return> to quit---

0x3f, 0xf3, 0x4, 0x35, 0x3f}, v8_int16 = {0x0, 0x3f80, 0x4f3, 0x3f35, 0x0,
0x3f80, 0x4f3, 0x3f35}, v4_int32 = {0x3f800000, 0x3f3504f3, 0x3f800000,
0x3f3504f3}, v2_int64 = {0x3f3504f33f800000, 0x3f3504f33f800000},

uint128 = 0x3f3504f33f8000003f3504f33f800000}

xmm3 {v4_float = {0xffffff60, 0xffffffb2, 0xffffffd1, 0xffffffad},

v2_double = {0xfffff8ed9d4f37f0, 0xfffff490ed1ee01f}, v16_int8 = {0x27,

0x41, 0x20, 0xc3, 0x8a, 0x49, 0x9c, 0xc2, 0xf5, 0xc3, 0x3f, 0xc2, 0x25,
0xde, 0xa6, 0xc2}, v8_int16 = {0x4127, 0xc320, 0x498a, 0xc29c, 0xc3f5,
0xc23f, 0xde25, 0xc2a6}, v4_int32 = {0xc3204127, 0xc29c498a, 0xc23fc3f5,
0xc2a6de25}, v2_int64 = {0xc29c498ac3204127, 0xc2a6de25c23fc3f5},

uint128 = 0xc2a6de25c23fc3f5c29c498ac3204127}

xmm4 {v4_float = {0xfffffff8, 0x8, 0xffffffd3, 0x4}, v2_double = {

0x3b494, 0x2a7}, v16_int8 = {0xa2, 0xa4, 0xd, 0xc1, 0xa2, 0xa4, 0xd, 0x41,
0x79, 0xf5, 0x34, 0xc2, 0xc8, 0x3e, 0x85, 0x40}, v8_int16 = {0xa4a2,
0xc10d, 0xa4a2, 0x410d, 0xf579, 0xc234, 0x3ec8, 0x4085}, v4_int32 = {
0xc10da4a2, 0x410da4a2, 0xc234f579, 0x40853ec8}, v2_int64 = {
0x410da4a2c10da4a2, 0x40853ec8c234f579},

uint128 = 0x40853ec8c234f579410da4a2c10da4a2}

xmm5 {v4_float = {0xffffffd2, 0xffffffec, 0xffffffcf, 0xffffffe3},

v2_double = {0xfffffffff75ae59f, 0xffffffff3d1f01ee}, v16_int8 = {0xe6,

0xde, 0x38, 0xc2, 0x34, 0x4a, 0xa1, 0xc1, 0x52, 0x9d, 0x45, 0xc2, 0x1f,
0x5c, 0xe8, 0xc1}, v8_int16 = {0xdee6, 0xc238, 0x4a34, 0xc1a1, 0x9d52,
0xc245, 0x5c1f, 0xc1e8}, v4_int32 = {0xc238dee6, 0xc1a14a34, 0xc2459d52,

---Type <return> to continue, or q <return> to quit---

0xc1e85c1f}, v2_int64 = {0xc1a14a34c238dee6, 0xc1e85c1fc2459d52},

uint128 = 0xc1e85c1fc2459d52c1a14a34c238dee6}

xmm6 {v4_float = {0xffffffdb, 0xfffffff8, 0xfffffffc, 0xffffffd3},

v2_double = {0xfffffffffffc4b6c, 0xffffffeb0a863f7b}, v16_int8 = {0xbe,

0x75, 0x15, 0xc2, 0xa2, 0xa4, 0xd, 0xc1, 0xc8, 0x3e, 0x85, 0xc0, 0x79,
0xf5, 0x34, 0xc2}, v8_int16 = {0x75be, 0xc215, 0xa4a2, 0xc10d, 0x3ec8,
0xc085, 0xf579, 0xc234}, v4_int32 = {0xc21575be, 0xc10da4a2, 0xc0853ec8,
0xc234f579}, v2_int64 = {0xc10da4a2c21575be, 0xc234f579c0853ec8},

uint128 = 0xc234f579c0853ec8c10da4a2c21575be}

xmm7 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0},

v16_int8 = {0xf3, 0x4, 0x35, 0x3f, 0xf3, 0x4, 0x35, 0x3f, 0x0, 0x0, 0x0,

0x0, 0x0, 0x0, 0x0, 0x0}, v8_int16 = {0x4f3, 0x3f35, 0x4f3, 0x3f35, 0x0,
0x0, 0x0, 0x0}, v4_int32 = {0x3f3504f3, 0x3f3504f3, 0x0, 0x0}, v2_int64 = {
0x3f3504f33f3504f3, 0x0}, uint128 = 0x00000000000000003f3504f33f3504f3}

mxcsr 0x1fa0 [ PE IM DM ZM OM UM PM ]
mm0 {uint64 = 0x7d7d7d7d7d7d7d7d, v2_int32 = {0x7d7d7d7d,

0x7d7d7d7d}, v4_int16 = {0x7d7d, 0x7d7d, 0x7d7d, 0x7d7d}, v8_int8 = {0x7d,
0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d}}

mm1 {uint64 = 0x7d007d007d007d, v2_int32 = {0x7d007d, 0x7d007d},

v4_int16 = {0x7d, 0x7d, 0x7d, 0x7d}, v8_int8 = {0x7d, 0x0, 0x7d, 0x0, 0x7d,

0x0, 0x7d, 0x0}}

mm2 {uint64 = 0x7e7e7e7e7e7e7e7e, v2_int32 = {0x7e7e7e7e,

0x7e7e7e7e}, v4_int16 = {0x7e7e, 0x7e7e, 0x7e7e, 0x7e7e}, v8_int8 = {0x7e,

---Type <return> to continue, or q <return> to quit---

0x7e, 0x7e, 0x7e, 0x7e, 0x7e, 0x7e, 0x7e}}

mm3 {uint64 = 0x7e007e007e007e, v2_int32 = {0x7e007e, 0x7e007e},

v4_int16 = {0x7e, 0x7e, 0x7e, 0x7e}, v8_int8 = {0x7e, 0x0, 0x7e, 0x0, 0x7e,

0x0, 0x7e, 0x0}}

mm4 {uint64 = 0x7e7e7d7d7d7d7e7e, v2_int32 = {0x7d7d7e7e,

0x7e7e7d7d}, v4_int16 = {0x7e7e, 0x7d7d, 0x7d7d, 0x7e7e}, v8_int8 = {0x7e,
0x7e, 0x7d, 0x7d, 0x7d, 0x7d, 0x7e, 0x7e}}

mm5 {uint64 = 0x7e007e007d007d, v2_int32 = {0x7d007d, 0x7e007e},

v4_int16 = {0x7d, 0x7d, 0x7e, 0x7e}, v8_int8 = {0x7d, 0x0, 0x7d, 0x0, 0x7e,

0x0, 0x7e, 0x0}}

mm6 {uint64 = 0x7f7e7e7d7d7e7e7f, v2_int32 = {0x7d7e7e7f,

0x7f7e7e7d}, v4_int16 = {0x7e7f, 0x7d7e, 0x7e7d, 0x7f7e}, v8_int8 = {0x7f,
0x7e, 0x7e, 0x7d, 0x7d, 0x7e, 0x7e, 0x7f}}

mm7 {uint64 = 0x7f007e007e007d, v2_int32 = {0x7e007d, 0x7f007e},

v4_int16 = {0x7d, 0x7e, 0x7e, 0x7f}, v8_int8 = {0x7d, 0x0, 0x7e, 0x0, 0x7e,

0x0, 0x7f, 0x0}}

nazgul@dragonscale:~$ uname -a
Linux dragonscale 2.6.22-14-generic #1 SMP Fri Feb 1 04:59:50 UTC 2008 i686 GNU/Linux
nazgul@dragonscale:~$ ls -l /lib/libc[.-]*
-rwxr-xr-x 1 root root 1249520 2007-10-25 05:03 /lib/libc-2.6.1.so
lrwxrwxrwx 1 root root 13 2007-11-07 01:17 /lib/libc.so.6 -> libc-2.6.1.so
nazgul@dragonscale:~$ gcc -v
Es werden eingebaute Spezifikationen verwendet.
Ziel: i486-linux-gnu
Konfiguriert mit: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-mpfr --enable-targets=all --enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu --target=i486-linux-gnu
Thread-Modell: posix
gcc-Version 4.2.1 (Ubuntu 4.2.1-5ubuntu4)
nazgul@dragonscale:~$ ld -v
GNU ld (GNU Binutils for Ubuntu) 2.18
nazgul@dragonscale:~$ as --version
GNU assembler (GNU Binutils for Ubuntu) 2.18
Copyright 2007 Free Software Foundation, Inc.
This program is free software; you may redistribute it under the terms of
the GNU General Public License version 3 or later.
This program has absolutely no warranty.
This assembler was configured for a target of `i486-linux-gnu'.
nazgul@dragonscale:~$ xdpyinfo | grep "depth of root"

depth of root window: 24 planes

nazgul@dragonscale:~$ cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 13
model name : Intel(R) Pentium(R) M processor 1.73GHz
stepping : 8
cpu MHz : 800.000
cache size : 2048 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat clflush dts acpi mmx fxsr sse sse2 ss tm pbe nx up est tm2
bogomips : 1598.11
clflush size : 64

nazgul@dragonscale:~$ intel i915GM

nazgul@dragonscale:/svn/mplayer$ svn info
Pfad: .
URL: ​svn://svn.mplayerhq.hu/mplayer/trunk
Basis des Projektarchivs: ​svn://svn.mplayerhq.hu/mplayer
UUID des Projektarchivs: b3059339-0415-0410-9bf9-f77b7e298cf2
Revision: 25958
Knotentyp: Verzeichnis
Plan: normal
Letzter Autor: reimar
Letzte geänderte Rev: 25958
Letztes Änderungsdatum: 2008-02-06 16:39:59 +0400 (Mi, 06 Feb 2008)

[compn]

good report

can you also test it with ffplay and report to ffmpeg bug tracker?
​http://roundup.mplayerhq.hu

[Christian.Kirbach@…]

.avi files play fine with ffplay, same libavcodec revision
=> looks like a mplayer problem to me

[compn]

does it crash with mplayer -demuxer lavf file.avi ?

[Christian.Kirbach@…]

yes, also crashes with the same stack trace.

[compn]

-noslices maybe?
this happens on all avi files for you?
need sample in any case.