vdpauinfo always crashes on my system (double free)

[Laurent Bonnaud]

Hi,

here is the problem:

$ vdpauinfo
[...]
Segmentation fault (core dumped)

ProblemType: Bug
DistroRelease: Ubuntu 20.10
Package: vdpauinfo 1.4-1
Uname: Linux 5.10.0-051000-lowlatency x86_64
ApportVersion: 2.20.11-0ubuntu50.3
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: KDE
Date: Mon Dec 21 10:20:20 2020
SourcePackage: vdpauinfo
UpgradeStatus: No upgrade log present (probably fresh install)
---
ProblemType: Bug
ApportVersion: 2.20.11-0ubuntu50.3
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: KDE
DistroRelease: Ubuntu 20.10
Package: vdpauinfo 1.4-1
PackageArchitecture: amd64
Tags: groovy third-party-packages
Uname: Linux 5.10.0-051000-lowlatency x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip fuse kvm libvirt libvirtd lpadmin plugdev sambashare staff sudo
_MarkForUpload: True

[Laurent Bonnaud (laurent-bonnaud)]

apport information

[Laurent Bonnaud (laurent-bonnaud)]

apport information

[Laurent Bonnaud (laurent-bonnaud)]

apport information

[Laurent Bonnaud (laurent-bonnaud)]

Here is the complete output of the command:

$ vdpauinfo
libva info: VA-API version 1.8.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: va_openDriver() returns -1
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_1_6
libva info: va_openDriver() returns 0
display: :0 screen: 0
API version: 1
Information string: OpenGL/VAAPI backend for VDPAU

Video surface:

name width height types
-------------------------------------------
420 4096 4096 NV12 YV12 UYVY YUYV Y8U8V8A8 V8U8Y8A8 NV24 YV24 P010 P016 Y_U_V_444_16
422 4096 4096 NV12 YV12 UYVY YUYV Y8U8V8A8 V8U8Y8A8 NV24 YV24 P010 P016 Y_U_V_444_16
444 4096 4096 NV12 YV12 UYVY YUYV Y8U8V8A8 V8U8Y8A8 NV24 YV24 P010 P016 Y_U_V_444_16
420_16 4096 4096 NV12 YV12 UYVY YUYV Y8U8V8A8 V8U8Y8A8 NV24 YV24 P010 P016 Y_U_V_444_16
422_16 4096 4096 NV12 YV12 UYVY YUYV Y8U8V8A8 V8U8Y8A8 NV24 YV24 P010 P016 Y_U_V_444_16
444_16 4096 4096 NV12 YV12 UYVY YUYV Y8U8V8A8 V8U8Y8A8 NV24 YV24 P010 P016 Y_U_V_444_16

Decoder capabilities:

name level macbs width height
----------------------------------------------------
MPEG1 --- not supported ---
MPEG2_SIMPLE --- not supported ---
MPEG2_MAIN --- not supported ---
H264_BASELINE 51 16384 2048 2048
H264_MAIN 51 16384 2048 2048
H264_HIGH 51 16384 2048 2048
VC1_SIMPLE --- not supported ---
VC1_MAIN --- not supported ---
VC1_ADVANCED --- not supported ---
MPEG4_PART2_SP --- not supported ---
MPEG4_PART2_ASP --- not supported ---
DIVX4_QMOBILE --- not supported ---
DIVX4_MOBILE --- not supported ---
DIVX4_HOME_THEATER --- not supported ---
DIVX4_HD_1080P --- not supported ---
DIVX5_QMOBILE --- not supported ---
DIVX5_MOBILE --- not supported ---
DIVX5_HOME_THEATER --- not supported ---
DIVX5_HD_1080P --- not supported ---
H264_CONSTRAINED_BASELINE 51 16384 2048 2048
H264_EXTENDED --- not supported ---
H264_PROGRESSIVE_HIGH --- not supported ---
H264_CONSTRAINED_HIGH --- not supported ---
H264_HIGH_444_PREDICTIVE --- not supported ---
VP9_PROFILE_0 --- not supported ---
VP9_PROFILE_1 --- not supported ---
VP9_PROFILE_2 --- not supported ---
VP9_PROFILE_3 --- not supported ---
HEVC_MAIN --- not supported ---
HEVC_MAIN_10 --- not supported ---
HEVC_MAIN_STILL --- not supported ---
HEVC_MAIN_12 --- not supported ---
HEVC_MAIN_444 --- not supported ---
HEVC_MAIN_444_10 --- not supported ---
HEVC_MAIN_444_12 --- not supported ---

Output surface:

name width height nat types
----------------------------------------------------
B8G8R8A8 ...

[Laurent Bonnaud (laurent-bonnaud)]

Here is a backtrace:

#0 0x00007ffff61f4e08 in unlink_block (info=0x555555612a00) at ../src/util/ralloc.c:274
#1 ralloc_free (ptr=0x555555612a30) at ../src/util/ralloc.c:265
#2 ralloc_free (ptr=0x555555612a30) at ../src/util/ralloc.c:257
#3 0x00007ffff6135f0c in (anonymous namespace)::builtin_builder::release (this=0x7ffff711feb0 <builtins>) at ../src/compiler/glsl/builtin_functions.cpp:7662
#4 _mesa_glsl_builtin_functions_decref () at ../src/compiler/glsl/builtin_functions.cpp:7662
#5 0x00007ffff5f0a48d in _mesa_free_context_data (ctx=ctx@entry=0x55555586eb40, destroy_debug_output=destroy_debug_output@entry=false) at ../src/mesa/main/context.c:1405
#6 0x00007ffff5e9c237 in st_destroy_context (st=0x555555609a60) at ../src/mesa/state_tracker/st_context.c:1115
#7 0x00007ffff5e7da12 in dri_destroy_context (cPriv=<optimized out>) at ../src/gallium/frontends/dri/dri_context.c:247
#8 0x00007ffff63173d7 in driDestroyContext (pcp=0x5555555e85a0) at ../src/mesa/drivers/dri/common/dri_util.c:528
#9 0x00007ffff7643fb3 in dri3_destroy_context (context=0x5555555e8410) at ../src/glx/dri3_glx.c:181
#10 0x00007ffff762e539 in glXDestroyContext (ctx=0x5555555e8410, dpy=0x55555558d960) at ../src/glx/glxcmds.c:511
#11 glXDestroyContext (dpy=0x55555558d960, ctx=0x5555555e8410) at ../src/glx/glxcmds.c:492
#12 0x00007ffff7fb1934 in vdp::GLXManagedContext::destroy (this=0x55555560e668) at ./src/x-display-ref.hh:70
#13 vdp::GLXManagedContext::destroy (this=0x55555560e668) at ./src/glx-context.cc:79
#14 0x00007ffff7fb212e in vdp::GLXManagedContext::~GLXManagedContext (this=0x55555560e668, __in_chrg=<optimized out>) at ./src/glx-context.hh:54
#15 std::pair<int const, vdp::GLXManagedContext>::~pair (this=0x55555560e660, __in_chrg=<optimized out>) at /usr/include/c++/9/bits/stl_pair.h:208
#16 __gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<int const, vdp::GLXManagedContext> > >::destroy<std::pair<int const, vdp::GLXManagedContext> > (this=0x7ffff7fc7700 <(anonymous namespace)::g_glc_map>, __p=0x55555560e660)
    at /usr/include/c++/9/ext/new_allocator.h:153
#17 std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<int const, vdp::GLXManagedContext> > > >::destroy<std::pair<int const, vdp::GLXManagedContext> > (__a=..., __p=0x55555560e660)
    at /usr/include/c++/9/bits/alloc_traits.h:497
#18 std::_Rb_tree<int, std::pair<int const, vdp::GLXManagedContext>, std::_Select1st<std::pair<int const, vdp::GLXManagedContext> >, std::less<int>, std::allocator<std::pair<int const, vdp::GLXManagedContext> > >::_M_destroy_node (
    this=0x7ffff7fc7700 <(anonymous namespace)::g_glc_map>, __p=0x55555560e640) at /usr/include/c++/9/bits/stl_tree.h:642
#19 std::_Rb_tree<int, std::pair<int const, vdp::GLXManagedContext>, std::_Select1st<std::pair<int const, vdp::GLXManagedContext> >, std::less<int>, std::allocator<std::pair<int const, vdp::GLXManagedContext> > >::_M_drop_node (
    this=0x7ffff7fc7700 <(anonymous namespace)::g_glc_map>, __p=0x55555560e640) at /usr/include/c++/9/bits/stl_tree.h:650
#20 std::_Rb_tree<int, std::pair<int const, vdp::GLXManagedContext>, std::_Select1st<std::pair<int const, vdp::GLXManagedContext> >, std::less<int>, std::allocator<std...

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Laurent Bonnaud (laurent-bonnaud)]

In kinetic I see the following error:

$ vdpauinfo
[...]
double free or corruption (!prev)
Aborted (core dumped)

[Laurent Bonnaud (laurent-bonnaud)]

In lunar I see the following error:

$ vdpauinfo
[...]
free(): double free detected in tcache 2
Aborted (core dumped)

[Laurent Bonnaud (laurent-bonnaud)]

The bug is fixed in noble.