Bug 82466

An additional information:
downgrading ffmpeg to an older version 2.2.x does not produce this error.
Bye

One other additional information.

No crash downgrading to:

libva info: VA-API version 0.35.1
libva info: va_getDriverName() returns 0
libva info: Trying to open /usr/lib/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_0_35
libva info: va_openDriver() returns 0
vainfo: VA-API version: 0.35 (libva 1.3.1)
vainfo: Driver version: Intel i965 driver - 1.3.1
vainfo: Supported profile and entrypoints
      VAProfileMPEG2Simple            :	VAEntrypointVLD
      VAProfileMPEG2Main              :	VAEntrypointVLD
      VAProfileH264ConstrainedBaseline:	VAEntrypointVLD
      VAProfileH264ConstrainedBaseline:	VAEntrypointEncSlice
      VAProfileH264Main               :	VAEntrypointVLD
      VAProfileH264Main               :	VAEntrypointEncSlice
      VAProfileH264High               :	VAEntrypointVLD
      VAProfileH264High               :	VAEntrypointEncSlice
      VAProfileVC1Simple              :	VAEntrypointVLD
      VAProfileVC1Main                :	VAEntrypointVLD
      VAProfileVC1Advanced            :	VAEntrypointVLD
      VAProfileNone                   :	VAEntrypointVideoProc

Can you try to bisect between 1.3.1 and 1.3.2?

checkout master branch and choose 1.3.1 commit as good - from there it should only be max 7 steps.

I've got tried.
This is the result:
git bisect start
# Bad: [Commit:82d2ed8] Add more check of H264 slice param to avoid GPU hang Caused by the incorrect parameter
git bisect bad Commit:82d2ed8
# Good: [Commit:cc40368] Intel driver 1.3.2
git bisect good Commit:cc40368
# Good: [Commit:da8a7e9] surface: drop SURFACE_DISPLAYED flag.
git bisect good Commit:da8a7e9
# Bad: [Commit:107274f] H264_Encoding: Add the support of packed slice header to be flexible
git bisect bad Commit:107274f
# Bad: [Commit:772e942] H264_Encoding: Parse the packed header data from user to fix the hacked code of HW skip bytes
git bisect bad Commit:772e942
# Bad: [Commit:143c539] decoder: h264: fix frame store logic for MVC.
git bisect bad Commit:143c539
# Good: [Commit:d2262e3] decoder: h264: Improve AVC_REF_IDX_STATE for MVC.
git bisect good Commit:d2262e3
# First bad commit: [Commit:143c539] decoder: h264: fix frame store logic for MVC.

reverting from the master "first bad commit: [Commit:143c539] decoder: h264: fix frame store for MVC logic." crash does not occur.
Unfortunately,the code of the regression is quite complex for my knowledge ...
Bye

Thanks you very much. I will subscribe the committer of this code into that bugreport.

http://cgit.freedesktop.org/vaapi/intel-driver/commit/?id=143c53900943c660390122f7fa4a1c5705798fdd

Created attachment 104490 [details] [review]
decoder: h264: fix RefPicList0/1 without frame in DPB

Here is one patch hanging in my local tree and was not pushed for some reason. Could you please give it a try? Thanks.

BTW, if it works for you with the patch, then please try to provide the video somewhere. That's surely a bug in there, but the driver should not crash for sure either.

Patch applied.
It works!
The problem was only present on encrypted satellite streams from channels in HD (Italian national TV). Presumably you're right that there is something non-standard. I will try to capture a few seconds of the stream to provide it as an example. I agree with you that this condition must be provided for in the code, it may not be an isolated case.

Thanks very much to all
Ciao.

Sample video:

https://drive.google.com/file/d/0B-ddyRHhx23pTFlSN3RtRllxdXc/edit?usp=sharing

Bye

(In reply to comment #9)
> Sample video:
> 
> https://drive.google.com/file/d/0B-ddyRHhx23pTFlSN3RtRllxdXc/edit?usp=sharing

Thanks. Tested with gstreamer-vaapi, and without the previously attached patch, it works. It is so, because gst will try to decode from the first valid I-frame, whereas FFmpeg will attempt to decode whatever it has at any point. So, since previous frames are missing (streaming, seek), you can't correctly decode the stream, unless you tolerate artifacts.

Anyway, I have now pushed the patch to both "master" and "staging" branches.

commit 8387e32247822af8366f93c683ed59bb2198283e
Author: Gwenole Beauchesne <gwenole.beauchesne@intel.com>
Date:   Wed Jun 18 13:11:48 2014 +0200

    decoder: h264: fix RefPicList0/1 without frame in DPB.
    
    Some bitstreams (e.g. truncated, or non conformant), or bugs in codec
    layers, would incorrectly make decoders to fill in the RefPicList0/1
    lists with surfaces that have not received any content yet.
    
    There is no reason for the driver to crash in such cases.
    
    https://bugs.freedesktop.org/show_bug.cgi?id=82466
    
    Signed-off-by: Gwenole Beauchesne <gwenole.beauchesne@intel.com>