mpv crashes on windows playing a certain file with --gpu-api=vulkan (rev1 and rev2)

[Artoriuz]

mpv version and platform

Tested on both 052ae53 and 33973dc (branch-vulkan-rev2), Windows 10 x64 15063.608 with a a RX470 (Polaris AMD card, should expose async compute)

Reproduction steps

Playing a certain file with --gpu-context=win --gpu-api=vulkan always makes mpv crash on the exact same frame, but it doesn't seem to happen with other files (at least I don't think I've seen it crashing with anything else). The file which makes it crash is a normal AVC High10p AAC file.

Log files provided with a [bench] profile since I was originally trying to benchmark vulkan's performance against opengl.

The [bench] profile is just this:
[bench]
audio=no
untimed=yes
video-sync=display-desync
vulkan-swap-mode=immediate
opengl-swapinterval=0
osd-msg1="FPS: ${estimated-display-fps}"

Expected behavior

Just like with any other possible configuration (OpenGL with angle, win or dxinterop) it should work fine without crashing.

Actual behavior

It crashes every single time on the same frame. Making the player skip the frame makes it able to go until the end of the file just fine. What's even weirder is that making it skip the frame once (just forcing it to go to any other part of the video), then making it go back to the beginning "fixes" the problem and mpv is able to go through the entire file without crashing where it would previously crash.

I tried to make a short length sample from the original file with FFMpeg (problem occurs at 00:01:03, my sample had the first 5 minutes of the movie) so it would be easier to share, but the problem isn't reproducible in the sample. Instead of crashing on the same frame, it works as expected and stays working. I don't really think uploading a 10GB file will work, so I don't know how to proceed.

Log file

Log file with vulkan-rev1:
https://pastebin.com/1h5037Ka
Log file with vulkan-rev2:
https://pastebin.com/Sxj8jjfN

[haasn]

Does it still happen if you disable the subtitles?

[Artoriuz]

Disabling the subs in the OSD, pressing j or with --no-sub-visibility fixes it indeed. Plays perfectly fine.

[shinchiro]

I also have the movie (but from different group) and yes it also crash at certain time. Checking with the sub, it is .pgs format unlike usual .ass format so there might something weird with it

[haasn]

I've had some weird subtitle-related crashes recently as well. I wonder if it's possibly a libass bug? It seems like the subtitle uploading code writes out-of-bounds, at least compared to how big the buffer is allocated.

[haasn]

Anyway, can you upload just the subtitle track?

[Artoriuz]

Sure

Google Drive:
https://drive.google.com/open?id=0B5NOUubgYTCySlVkWE04WUpyWmc

0x0.st:
https://0x0.st/Foy.sup

[haasn]

Hmm, it works fine here. Can you reproduce it on any file with just --sub-file=Foy.sup? Including with --no-config --gpu-api=vulkan?

[Artoriuz]

Yeah, with that sub it always crashes at 00:01:03 regardless of which file mpv is playing.

Log on a different file:
https://pastebin.com/pH3qc43i

[Artoriuz]

I'd just like to add that the exact same problem used to happen with the very first ra_d3d11 build available in shinchiro's sourceforge (exactly the same, it worked fine with OpenGL (angle, dxinterop or win) but didn't with d3d11), but now with the current d3d11 build available there it's working fine. It might help with trying to figure out what's still causing the issue under Vulkan.

[rossy]

The only difference between the original d3d11 build and the current one is this commit:
rossy@8cce5fb56527

Basically, for partial tex_upload() regions where the region touched the top or left edge of the texture, it would ignore the region and copy way too much data.

[shinchiro]

@haasn Apart from this bug, I also got crash when switching to secondary subtitle after faster seek in vulkan which doesn't happen in d3d11. I can reproduce this on win10. Dont know whether this is driver bug or not

[haasn]

@shinchiro Can you get me a backtrace?

[shinchiro]

here's debug (generated by drmingw)
https://0x0.st/CCJ.txt

Both crash seem to point to same line. Hopefully this will be useful

[haasn]

Yeah all of the crashes I've seen seem to point at the exact same stack. If I can reproduce it again I'll have a look through the variables, I suppose.

[notanuser]

Disabling the subs in the OSD, pressing j or with --no-sub-visibility fixes it indeed. Plays perfectly fine.

--no-osc helps as well.

[Artoriuz]

@notanuser still crashes here with --no-osc, our problems might be unrelated.

[haasn]

Found the bug. (Caused, of course, by the nonsensical design of ra_tex_upload)