Bug 277590 - A threading issue that was introduced into the base of FreeBSD 15 will cause a segmentation fault when mpv plays a file with --hwdec=vaapi passed to it
Summary: A threading issue that was introduced into the base of FreeBSD 15 will cause ...
Status: Closed Not A Bug
Alias: None
Product: Base System
Classification: Unclassified
Component: threads (show other bugs)
Version: 15.0-CURRENT
Hardware: amd64 Any
: --- Affects Many People
Assignee: freebsd-threads (Nobody)
URL:
Keywords: regression
Depends on:
Blocks:
 
Reported: 2024-03-09 06:41 UTC by Oleg
Modified: 2024-03-09 15:09 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Oleg 2024-03-09 06:41:10 UTC 
On FreeBSD 15, if I pass the --hwdec=vaapi option to mpv and attempt to play a file, a segmentation fault will happen. It will only happen under wayland, but not under X11 or on the bare console. On FreeBSD 14, this type of crash won't happen under wayland either. This is the backtrace from the crash:

(gdb) bt full
#0  0x0000000833ff1db1 in VA_DRM_GetDriverNames (ctx=0x10aff9829000, drivers=0x87397da80, num_drivers=0x87397da7c) at ../va/drm/va_drm_utils.c:74
        map = {{drm_driver = 0x833fef7b6 "i915", va_driver = {0x833fef6c0 "iHD", 0x833fef580 "i965"}}, {drm_driver = 0x833fef78c "pvrsrvkm", va_driver = {
              0x833fef5f7 "pvr", 0x0}}, {drm_driver = 0x833fef5fb "radeon", va_driver = {0x833fef6d1 "r600", 0x833fef65f "radeonsi"}}, {
            drm_driver = 0x833fef610 "amdgpu", va_driver = {0x833fef65f "radeonsi", 0x0}}, {drm_driver = 0x833fef6a5 "WSL", va_driver = {0x833fef668 "d3d12", 
              0x0}}, {drm_driver = 0x833fef617 "nvidia-drm", va_driver = {0x833fef724 "nvidia", 0x0}}}
        drm_state = 0x0
        drm_driver = 0x10aff5411408 "z\270", <incomplete sequence \325>
        count = 0
        sysinfo = {
          sysname = "\001\000\000\000\000\000\000\000\224n\201\365\257\020\000\000\002\000\000\000\000\000\000\000\000\325\227s\b\000\000\000\274F\3644\b\000\000\000\001\000\000\000\000\000\000\000\000m\201\365\257\020\000\000\020\000\000\0000\000\000\000\262\f\3644\b\000\000\000`\325\227s\b\000\000\000q\374\3634\b\000\000\000P\n\3644\b\000\000\000\b\024A\365\257\020\000\000\300o\201\365\257\020\000\000\000m\201\365\257\020\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\bm\201\365\257\020\000\000\000m\201\365\257\020\000\000\300\325\227s\b\000\000\000s\2771\000\000\000\000\000\310\004\000\000\000\000\000\000\001\000\000\000\004\000\000\000\030X\312h?8\000\000\000m\201\365\257\020\000\000\006\000\000"..., 
          nodename = "\340\2771", '\000' <repeats 13 times>, "\006", '\000' <repeats 15 times>, "P\300\206\365\257\020\000\000\320 \202\371\257\020\000\000\001\000\000\000\004\000\000\000 ֗s\b\000\000\000\336\3111\000\000\000\000\000\006\000\000\000\006\000\000\000\320 \202\371\257\020\000\000\300֗s\b\000\000\000\346\3051\000\000\000\000\000\017\204\035\346\000\000\000\000h\301B\365\257\020\000\000\001\000\000\000\000\000\000\000\b\030A\365\257\020\000\000\000m\201\365\257\020\000\000\001\000\000\000\000\000\000\000N\227r5\306\f<O\000\002\000\000\000\000\000\000 ٗs\b\000\000\0008d\0375\b\000\000\000\000ٗs\b\000\000\000٨@3\b\000\000\000\020ؗs\b\000"..., 
          release = "%\3441", '\000' <repeats 29 times>, " ٗs\b\000\000\000\250֗s\b\000\000\000\377\377\377\377", '\000' <repeats 132 times>, "\b\fA\365\257\020\000\000Qj@3\b\000\000\000\304I"..., 
          version = "\260ӗs\b\000\000\000z\000\000\000\037", '\000' <repeats 11 times>, "h\301B\365\257\020\000\000\001\000\000\000\000\000\000\000\b\fA\365\257\020\000\000\025\000\000\000\000\000\000\000\260ؗs\b\000\000\000\177#\311h?8\000\000Qj@3\b\000\000\000\304I<\a\000\000\000\0000\270\202\r\000\000\000\000h\301B\365\257\020\000\000\001\000\000\000\000\000\000\000\b\030A\365\257\020\000\000\000m\201\365\257\020\000\000\001\000\000\000\000\000\000\000\224n\201\365\257\020\000\000\002\000\000\000\000\000\000\000\200ؗs\b\000\000\000\274F\3644\b\000\000\000\001\000\000\000\000\000\000\000\000m\201\365\257\020\000\000\260ؗs\b\000\000\000R8\3644\b\000\000\000\300/\0275"..., 
          machine = "\001\000\000\000\257\020\000\000\356\037\311h?8\000\000\b\fA\365\257\020\000\000\270ؗs\b\000\000\000\220ٗs\b\000\000\000\340\001\000\000\000\000\000\000\001\000\000\000\000\000\000\000\030X\312h?8\000\000\000m\201\365\257\020\000\000\177\003\227s\b\000\000\000\001\000\000\000\000\000\000\000VA-API v\000\000\000\000on 1\b\030A\365\257\020\000\000\340\001\000\000\000\000\000\000\000P@3\b\000\000\000@\\\003\000\000\000\000\000\300/\0275\b\000\000\000p\254\0035\b\000\000\000\226\001\000\000\000\000\000\000\000m\201\365\257\020\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\bm\201\365\257\020\000\000\000m\201\365\257\020\000\0000ۗ"...}
#1  0x0000000833ff16c1 in va_DisplayContextGetDriverNames (pDisplayContext=0x10aff98b5a80, drivers=0x87397da80, num_drivers=0x87397da7c)
    at ../va/wayland/va_wayland_drm.c:136
        ctx = 0x10aff9829000
#2  0x000000083341872d in va_new_opendriver (dpy=0x10aff98b5a80) at ../va/va.c:681
        pDisplayContext = 0x10aff98b5a80
        drivers = {0x0 <repeats 20 times>}
        num_drivers = 20
        vaStatus = 0
        driver_name_env = 0x87397db00 ""
        ctx = 0x87397da28
--Type <RET> for more, q to quit, c to continue without paging--
#3  0x0000000833418642 in vaInitialize (dpy=0x10aff98b5a80, major_version=0x87397dbec, minor_version=0x87397dbe8) at ../va/va.c:743
        vaStatus = 8
#4  0x000000000049cbb6 in va_initialize (display=0x10aff98b5a80, plog=0x10aff9820e10, probing=true) at ../video/vaapi.c:116
        avref = 0x10aff99a12c0
        hwctx = 0x10aff99a13c0
        vactx = 0x10aff99a1340
        res = 0x10affa1e3dd0
        major = 0
        minor = 4842884
        status = 8
#5  0x000000000049d2ee in init (hw=0x10aff98053d0) at ../video/out/hwdec/hwdec_vaapi.c:160
        p = 0x10aff9805470
        vas = 4271
        config_id = 8
        hwconfig = 0x57397dca0
#6  0x000000000041e52c in ra_hwdec_load_driver (ra_ctx=0x10aff981d110, log=0x10aff5870e50, global=0x10aff582c0d0, devs=0x10affa1e6350, 
    drv=0x4d7d38 <ra_hwdec_vaapi>, is_auto=false) at ../video/out/gpu/hwdec.c:108
        hwdec = 0x10aff98053d0
#7  0x000000000041eee4 in load_add_hwdec (ctx=0x10affa245068, devs=0x10affa1e6350, drv=0x4d7d38 <ra_hwdec_vaapi>, is_auto=false)
    at ../video/out/gpu/hwdec.c:240
        hwdec = 0x10aff5870e50
#8  0x000000000041f1bc in ra_hwdec_ctx_load_fmt (ctx=0x10affa245068, devs=0x10affa1e6350, params=0x82097ff60) at ../video/out/gpu/hwdec.c:336
        matched_fmt = true
        drv = 0x4d7d38 <ra_hwdec_vaapi>
        i = 0
        imgfmt = 1052
#9  0x0000000000432632 in gl_video_load_hwdecs_for_img_fmt (p=0x10affa202ad0, devs=0x10affa1e6350, params=0x82097ff60) at ../video/out/gpu/video.c:4363
No locals.
#10 0x0000000000447a75 in request_hwdec_api (vo=0x10aff58710d0, data=0x82097ff60) at ../video/out/vo_gpu.c:129
        p = 0x10aff59fabd0
#11 0x00000000004471b0 in control (vo=0x10aff58710d0, request=8, data=0x82097ff60) at ../video/out/vo_gpu.c:200
        p = 0x10aff59fabd0
        events = 4271
        r = 4271
#12 0x0000000000443507 in run_control (p=0x82097fe90) at ../video/out/vo.c:667
        pp = 0x82097fe90
        vo = 0x10aff58710d0
        request = 8
        data = 0x82097ff60
        ret = 4271
#13 0x00000000003839cc in mp_dispatch_queue_process (queue=0x10aff5867970, timeout=0) at ../misc/dispatch.c:300
--Type <RET> for more, q to quit, c to continue without paging--
        item = 0x82097fe28
#14 0x00000000004450c5 in vo_thread (ptr=0x10aff58710d0) at ../video/out/vo.c:1069
        working = false
        wait_until = 1000486921997
        send_reset = false
        now = 486921997
        redraw = false
        send_pause = false
        vo = 0x10aff58710d0
        in = 0x10aff586c350
        vo_paused = false
        r = 0
#15 0x0000000834f3bb55 in thread_start (curthread=0x10aff5816d00) at /usr/src/lib/libthr/thread/thr_create.c:290
        set = {__bits = {0, 0, 0, 0}}
#16 0x0000000000000000 in ?? ()
No symbol table info available.
Backtrace stopped: Cannot access memory at address 0x87397e000
Comment 1 Oleg 2024-03-09 06:44:25 UTC 
My gpu driver is i915kms, by the way.
Comment 2 Konstantin Belousov freebsd_committer freebsd_triage 2024-03-09 09:18:05 UTC 
Why do you claim that the issue is 'threading', and what does it mean BTW?
Comment 3 Oleg 2024-03-09 14:45:32 UTC 
I just realized something. FreeBSD 14 installed sway-devel-1.9 as a binary package, while FreeBSD 15 installed sway-devel-1.9.91 as a binary package. So it's possible I misrepresented the problem that's been happening because under sway-devel-1.9, this type of crash doesn't occur. It's often difficult for me to describe the correct nature of a bug because I am not that knowledgeable about software-related things. So, as I said, this "--hwdec=vaapi" crash will occur under sway-devel-1.9.91/wlroots-devel, but not under X11, and not on the bare console. It won't occur if I run sway-devel-1.9. So, I guess that means the base system of FreeBSD 15 doesn't have anything to do with this crash, but I am not sure.
Comment 4 Oleg 2024-03-09 15:09:03 UTC 
Okay, now I can clearly see it definitely doesn't have anything to do with the FreeBSD 15 base. sway-1.9.91 needs to be loaded with the -D legacy-wl-drm option, and doing it prevents this crash from happening. I am sorry to have wasted your time. Let me see if I can close this bug.