Bug 67150

Summary: [HSW]JPEG decode would core dumped with loadjpeg
Product: libva Reporter: Yang Lianyue <lianyuex.yang>
Component: intelAssignee: haihao <haihao.xiang>
Status: REOPENED --- QA Contact: Sean V Kelley <seanvk>
Severity: normal    
Priority: medium CC: ouping.zhang, tienan.liu
Version: unspecified   
Hardware: Other   
OS: All   
See Also: https://bugs.freedesktop.org/show_bug.cgi?id=91626
https://bugzilla.gnome.org/show_bug.cgi?id=762500
Whiteboard:
i915 platform: i915 features:
Attachments: test file for crash

Description Yang Lianyue 2013-07-22 02:45:52 UTC 
System Environment:
----------------------------------------
Platform: HSW
libva:        (staging)6ba83cd306629e7579912627edab7a86d8c9ae1c
intel_driver: (staging)1caf179b1425b13cacaa421c688c6df8369668c6

Bug Info:
----------------------------------
Libva will be core dumped when jpeg decode.
There is some error in gen75_mfd.c:2220.

Steps:
---------------------------------
jpegdecode 2.jpg
libva info: VA-API version 0.34.0
libva info: va_getDriverName() returns 0
libva info: Trying to open /opt/X11R7/lib/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_0_34
libva info: va_openDriver() returns 0
jpegdecode: gen75_mfd.c:2220: gen75_mfd_jpeg_decode_init: Assertion `0' failed.
Aborted (core dumped)
Comment 1 haihao 2013-07-22 04:48:59 UTC 
Is this a HSW specific issue ? Where to get jpegdecode and 2.jpg ?
Comment 2 Ouping Zhang 2013-07-22 06:27:15 UTC 
jpegdecode is not used any more.
Comment 3 Víctor Jáquez 2016-02-26 09:01:22 UTC 
This problem still exist in Haswell, and most surely in further chipsets with jpeg decoding capabilities.

The steps to reproduce it:

./loadjpeg vaapi-assert.jpg
ERROR:We only support YUV images
WARNING:Height need to be a multiple of 16 (current height is 1417)
WARNING:Width need to be a multiple of 16 (current Width is 1429)
Decoding JPEG image 1429x1417...
libva info: VA-API version 0.38.1
libva info: va_getDriverName() returns 0
libva info: Trying to open /opt/gnome/jh/lib/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_0_38
libva info: va_openDriver() returns 0
lt-loadjpeg: gen75_mfd.c:2203: void gen75_mfd_jpeg_decode_init(VADriverContextP, struct decode_state *, struct gen7_mfd_context *): Assertion `0' failed.
Aborted

The problem is not that the driver doesn't support more than 3 components or sizes multiple of 16.  The problem is the error handling in libva-intel-driver: in my opinion an assert is not error handling. 

As this is a driver specific restriction, the client doesn't have to do the verification, the driver should notify the client that it is unable to process the data, without crashing.

Furthermore, asserts can be disabled at compilation time, making the behavior unpredictable.

This is very similar to bug 91626, where an assert is also used for error handling.
Comment 4 Víctor Jáquez 2016-02-26 09:02:08 UTC 
Created attachment 121978 [details]
test file for crash

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.