[MPlayer-users] Mplayer crashes again..

[David Kuehling]

libavcodec's MPEG4 (or the way mplayer uses it) seems to be extremely
unstable.  I just made it segfault with the following options:

mencoder -npp hb,vb,lb,al -vc mpeg12 -dvd 1 -o test.avi -ovc lavc
  -lavcopts vcodec=mpeg4:vhq:vbitrate=860:vme=5 -oac copy -pass 1 -sws 2
  -x 512 -y 288 -o divx.avi

It does work, however when using greater parameters for -x and -y (eg
640x360 worked fine).

Here's the backtrace:

Pos:   0.8s     19f ( 0%)  18fps Trem:   0min   0mb  A-V:0.015 [0:448]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 29529)]
0x080cc0f0 in pix_abs16x16_mmx2 (
    blk2=0x409d1bd0 ".0224557889;<=>>?<,#\"\"\"", '#' <repeats 18 times>, "$$$$$%%&&&''''''()*+++,----.-0000/'\037\036\035\035\035\035\035\035\035\035\035", '\036' <repeats 13 times>, "\035\035", '\036' <repeats 13 times>, "\037\037\037\037\036\035\037\034", '\032' <repeats 21 times>, '\e' <repeats 16 times>, "\032\032\032\e\034\035\037\037 \037\037\037\037\037", '\036' <repeats 17 times>, "\035\035\035\035\035\035\036\036\036"..., 
    blk1=0x40a0fe50 <Address 0x40a0fe50 out of bounds>, stride=544)
    at i386/motion_est_mmx.c:68
68          asm volatile(
(gdb) bt
#0  0x080cc0f0 in pix_abs16x16_mmx2 (
    blk2=0x409d1bd0 ".0224557889;<=>>?<,#\"\"\"", '#' <repeats 18 times>, "$$$$$%%&&&''''''()*+++,----.-0000/'\037\036\035\035\035\035\035\035\035\035\035", '\036' <repeats 13 times>, "\035\035", '\036' <repeats 13 times>, "\037\037\037\037\036\035\037\034", '\032' <repeats 21 times>, '\e' <repeats 16 times>, "\032\032\032\e\034\035\037\037 \037\037\037\037\037", '\036' <repeats 17 times>, "\035\035\035\035\035\035\036\036\036"..., 
    blk1=0x40a0fe50 <Address 0x40a0fe50 out of bounds>, stride=544)
    at i386/motion_est_mmx.c:68
#1  0x080b3959 in epzs_motion_search (s=0x82643c0, mx_ptr=0xbfffa5b4, 
    my_ptr=0xbfffa5b8, P=0xbfffa5bc, pred_x=0, pred_y=-3, xmin=-400, 
    ymin=-208, xmax=128, ymax=96) at motion_est.c:590
#2  0x080b4984 in estimate_motion (s=0x82643c0, mb_x=24, mb_y=12)
    at motion_est.c:910
#3  0x0809a742 in encode_picture (s=0x82643c0, picture_number=18)
    at mpegvideo.c:1304
#4  0x08097538 in MPV_encode_picture (avctx=0x8185e20, buf=0x406b4008 "", 
    buf_size=2097152, data=0x8185ef4) at mpegvideo.c:558
#5  0x08095ddc in avcodec_encode_video (avctx=0x8185e20, buf=0x406b4008 "", 
    buf_size=2097152, pict=0x8185ef4) at utils.c:100
#6  0x0804ecf4 in main (argc=25, argv=0xbffffd04, envp=0xbffffd6c)
    at mencoder.c:1710
#7  0x402126cf in __libc_start_main () from /lib/libc.so.6

And a little asm:

(gdb) disas $eip-16 $eip+16
Dump of assembler code from 0x80cc0e0 to 0x80cc100:
0x80cc0e0 <pix_abs16x16_mmx2+36>:       cld    
0x80cc0e1 <pix_abs16x16_mmx2+37>:       mov    0xfffffffc(%ebp),%ecx
0x80cc0e4 <pix_abs16x16_mmx2+40>:       mov    0x10(%ebp),%ebx
0x80cc0e7 <pix_abs16x16_mmx2+43>:       sub    %edi,%edx
0x80cc0e9 <pix_abs16x16_mmx2+45>:       mov    %edi,%eax
0x80cc0eb <pix_abs16x16_mmx2+47>:       nop    
0x80cc0ec <pix_abs16x16_mmx2+48>:       lea    0x0(%esi,1),%esi
0x80cc0f0 <pix_abs16x16_mmx2+52>:       movq   (%edx,%eax,1),%mm0
0x80cc0f4 <pix_abs16x16_mmx2+56>:       movq   (%ecx,%eax,1),%mm2
0x80cc0f8 <pix_abs16x16_mmx2+60>:       psadbw %mm2,%mm0
0x80cc0fb <pix_abs16x16_mmx2+63>:       add    %ebx,%eax
0x80cc0fd <pix_abs16x16_mmx2+65>:       movq   (%edx,%eax,1),%mm1