[Bug] [example] Crash caused by discarded ‘preview_path’ pointer

[masamaru-san]

Git commit

[11/21 13:56:37] PS E:\stable-diffusion.cpp
> git rev-parse HEAD
5498cc0d67b0f95b4ef6004890b18cdbe3678175

Operating System & Version

Windows 11 25H2 [Version 10.0.26200.7171]

GGML backends

Vulkan

Command-line arguments used

see reproduce section

Steps to reproduce

I encountered crashes while testing t2v using ‘Wan2.2-TI2V-5B’. The running script is below:

# Run.ps1
[string]$prompt  = 'Wind-swaying dandelion in a meadow, floating in a gentle breeze, bright sunlight, natural setting, vibrant colors, 4k, photorealistic, high detail, warm tones, cinematic lighting, high quality
'
[string]$nprompt = 'no clutter, no black, too much blur'

[string]$sd_path = 'E:\stable-diffusion.cpp\out\build\x64-RelWDeb-ClangCL\bin\sd.exe'

. $sd_path `
	-M vid_gen `
	--diffusion-model 'E:\AI\models\wan\Wan2.2-TI2V-5B-Q4_K_M.gguf' `
	--vae             'E:\AI\models\wan\wan2.2_vae.safetensors' `
	--t5xxl           'E:\AI\models\wan\umt5-xxl-encoder-Q4_K_S.gguf' `
	-p $prompt --negative-prompt $nprompt `
	--cfg-scale 6.0 --sampling-method euler -v -t 14 --diffusion-conv-direct --vae-conv-direct `
	--color -W 832 -H 480 --diffusion-fa --video-frames 33 --flow-shift 3.0 --offload-to-cpu --clip-on-cpu -o ".\out_$([datetime]::Now.ToString('yyMMdd_hhmm')).avi"

> & Run.ps1

What you expected to happen

No crashes, except those caused by backend or hardware issues...

What actually happened

Crash silently (and launches MSVC debugger). Changing the compiler or modifying parts of the code sometimes prevents the crash.

The debugger showed that the issue was due to the base_path object that was passed to the preview_path pointer being destroyed (inaccessible).

stable-diffusion.cpp/examples/cli/main.cpp

Lines 1672 to 1682 in 5498cc0

	std::string base_path = params.preview_path;
	std::string file_ext = "";
	if (last_dot_pos != std::string::npos) { // filename has extension
	base_path = params.preview_path.substr(0, last_dot_pos);
	file_ext = params.preview_path.substr(last_dot_pos);
	std::transform(file_ext.begin(), file_ext.end(), file_ext.begin(), ::tolower);
	}
	if (file_ext == ".png") {
	base_path = base_path + ".avi";
	preview_path = base_path.c_str();
	}

It seems that changing the variable preview_path from const char* to a std::string object, and modifying related lines, allowed us to avoid the crash.

Logs / error messages / stack trace

silently crashed without any messages in console.

Additional context / environment details

> clang-cl --version
clang version 20.1.8
Target: x86_64-pc-windows-msvc
Thread model: posix
InstalledDir: C:\Program Files\Microsoft Visual Studio\18\Insiders\VC\Tools\Llvm\x64\bin

> cl
Microsoft(R) C/C++ Optimizing Compiler Version 19.50.35718 for x64
Copyright (C) Microsoft Corporation.  All rights reserved.

[wbruna]

It seems that changing the variable preview_path from const char* to a std::string object, and modifying related lines, allowed us to avoid the crash.

Sounds like a sensible fix. Would you like to submit a PR?

[masamaru-san]

Umm, submitting PRs seems to be very difficult task for me.

Furthermore, I don't understand why it crashed even though the preview option wasn't enabled, so I would like to investigate this.

Below is a my patch; feel free to use it. However, since I haven't been able to generate videos successfully yet, I haven't been able to verify if features like the preview function work properly.

--- a/examples/cli/main.cpp
+++ b/examples/cli/main.cpp
@@ -1648,7 +1648,7 @@
     return true;
 }
 
-const char* preview_path;
+std::string preview_path;  // Is it really okay even globally?
 float preview_fps;
 
 void step_callback(int step, int frame_count, sd_image_t* image, bool is_noisy) {
@@ -1657,16 +1657,16 @@
     // is_noisy is set to true if the preview corresponds to noisy latents, false if it's denoised latents
     // unused in this app, it will either be always noisy or always denoised here
     if (frame_count == 1) {
-        stbi_write_png(preview_path, image->width, image->height, image->channel, image->data, 0);
+        stbi_write_png(preview_path.c_str(), image->width, image->height, image->channel, image->data, 0);
     } else {
-        create_mjpg_avi_from_sd_images(preview_path, image, frame_count, preview_fps);
+        create_mjpg_avi_from_sd_images(preview_path.c_str(), image, frame_count, preview_fps);
     }
 }
 
 int main(int argc, const char* argv[]) {
     SDParams params;
     parse_args(argc, argv, params);
-    preview_path = params.preview_path.c_str();
+    preview_path = params.preview_path;
     if (params.video_frames > 4) {
         size_t last_dot_pos   = params.preview_path.find_last_of(".");
         std::string base_path = params.preview_path;
@@ -1678,7 +1678,7 @@
         }
         if (file_ext == ".png") {
             base_path    = base_path + ".avi";
-            preview_path = base_path.c_str();
+            preview_path = base_path;
         }
     }
     preview_fps = params.fps;

(translated by DeepL)

[wbruna]

Umm, submitting PRs seems to be very difficult task for me.

No problem, I'll make one.

Furthermore, I don't understand why it crashed even though the preview option wasn't enabled, so I would like to investigate this.

Since the buffer gets out of scope, any code path that touches that pointer may cause a crash, even if it ends up not actually used to open a file (it's "undefined behavior" territory).

Your patch seems OK (and the global std::string should work fine). But thinking about it, the preview callback should be able to get that value through a user data parameter, like the other callbacks do. I'll try this approach.

[masamaru-san]

This issue will be resolved. Thank you. 😄
I'll close this once your PR is merged.