Adding audio filter triggers heap-buffer-overflow crash #3668
Description
System and IINA version:
- macOS 12.3
- IINA 1.2.0 develop branch build
Expected behavior:
IINA does not crash.
Actual behavior:
Using a native build of the current develop branch using Xcode 13.3 on a MacBook Pro with the M1 chip with address sanitizer enabled adding particular audio filters results in a SIGABRT crash reporting:
ERROR: AddressSanitizer: heap-buffer-overflow
Crash report:
-------------------------------------
Translated Report (Full Report Below)
-------------------------------------
Process: IINA [56507]
Path: /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/MacOS/IINA
Identifier: com.colliderli.iina
Version: 1.2.0 (129)
Code Type: ARM-64 (Native)
Parent Process: launchd [1]
User ID: 503
Date/Time: 2022-03-17 17:45:06.8944 -0400
OS Version: macOS 12.3 (21E230)
Report Version: 12
Anonymous UUID: C8F97525-3322-572C-B9CE-A91EB243AC3C
Sleep/Wake UUID: E5E5649A-BD23-44FB-8BF8-4C98A5F6CE07
Time Awake Since Boot: 26000 seconds
Time Since Wake: 11476 seconds
System Integrity Protection: enabled
Crashed Thread: 2 mpv/mpv core
Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Application Specific Information:
=================================================================
==56507==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x00013a685b18 at pc 0x00010893cc74 bp 0x00016d8729e0 sp 0x00016d872198
READ of size 16 at 0x00013a685b18 thread T4
#0 0x10893cc70 in wrap_memcpy+0x13c (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x18c70)
#1 0x1056d5efc in av_frame_ref+0x11c (libavutil.56.dylib:arm64+0x11efc)
#2 0x106e62658 in mp_frame_ref+0x3c (libmpv.1.dylib:arm64+0x52658)
#3 0x106e5b8a4 in lavfi_process+0x1c4 (libmpv.1.dylib:arm64+0x4b8a4)
#4 0x106e60bdc in mp_filter_graph_run+0x1d0 (libmpv.1.dylib:arm64+0x50bdc)
#5 0x106ea43b0 in run_playloop+0x910 (libmpv.1.dylib:arm64+0x943b0)
#6 0x106e9b2c4 in mp_play_files+0x197c (libmpv.1.dylib:arm64+0x8b2c4)
#7 0x106e81e04 in core_thread+0x44 (libmpv.1.dylib:arm64+0x71e04)
#8 0x1817e6268 in _pthread_start+0x90 (libsystem_pthread.dylib:arm64e+0x7268)
#9 0x1817e1088 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x2088)
0x00013a685b18 is located 0 bytes to the right of 8-byte region [0x00013a685b10,0x00013a685b18)
allocated by thread T4 here:
#0 0x10896436c in wrap_posix_memalign+0xa4 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4036c)
#1 0x1056dca50 in av_malloc+0x30 (libavutil.56.dylib:arm64+0x18a50)
#2 0x106e24b4c in process+0x1c8 (libmpv.1.dylib:arm64+0x14b4c)
#3 0x106e60bdc in mp_filter_graph_run+0x1d0 (libmpv.1.dylib:arm64+0x50bdc)
#4 0x106ea43b0 in run_playloop+0x910 (libmpv.1.dylib:arm64+0x943b0)
#5 0x106e9b2c4 in mp_play_files+0x197c (libmpv.1.dylib:arm64+0x8b2c4)
#6 0x106e81e04 in core_thread+0x44 (libmpv.1.dylib:arm64+0x71e04)
#7 0x1817e6268 in _pthread_start+0x90 (libsystem_pthread.dylib:arm64e+0x7268)
#8 0x1817e1088 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x2088)
Thread T4 created by T0 here:
#0 0x10895e008 in wrap_pthread_create+0x54 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3a008)
#1 0x106e81d74 in mpv_create+0x5c (libmpv.1.dylib:arm64+0x71d74)
#2 0x1031ea3fc in MPVController.mpvInit() MPVController.swift:113
#3 0x10311c9ac in PlayerCore.startMPV() PlayerCore.swift:308
#4 0x1030fc934 in static PlayerCore.createPlayerCore() PlayerCore.swift:67
#5 0x1030fc300 in one-time initialization function for first PlayerCore.swift:16
#6 0x1816221c4 in _dispatch_client_callout+0x10 (libdispatch.dylib:arm64e+0x41c4)
#7 0x181623a2c in _dispatch_once_callout+0x1c (libdispatch.dylib:arm64e+0x5a2c)
#8 0x1030fcab8 in PlayerCore.first.unsafeMutableAddressor PlayerCore.swift:16
#9 0x1030fd4d4 in static PlayerCore.active.getter PlayerCore.swift:33
#10 0x1030fcf78 in static PlayerCore.lastActive.getter PlayerCore.swift:22
#11 0x10315a774 in static NowPlayingInfoManager.updateInfo(withTitle:) PlayerCore.swift:1733
#12 0x10319392c in static NowPlayingInfoManager.updateState(_:) PlayerCore.swift:1762
#13 0x102cdc560 in AppDelegate.applicationDidFinishLaunching(_:) AppDelegate.swift:170
#14 0x102ce3828 in @objc AppDelegate.applicationDidFinishLaunching(_:) <compiler-generated>
#15 0x1818a6dd8 in __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__+0x18 (CoreFoundation:arm64e+0x78dd8)
#16 0x18194b574 in ___CFXRegistrationPost_block_invoke+0x30 (CoreFoundation:arm64e+0x11d574)
#17 0x18194b4e0 in _CFXRegistrationPost+0x1c4 (CoreFoundation:arm64e+0x11d4e0)
#18 0x181875a70 in _CFXNotificationPost+0x2d8 (CoreFoundation:arm64e+0x47a70)
#19 0x182732e44 in -[NSNotificationCenter postNotificationName:object:userInfo:]+0x5c (Foundation:arm64e+0x9e44)
#20 0x184418938 in -[NSApplication _postDidFinishNotification]+0x150 (AppKit:arm64e+0x4a938)
#21 0x184418650 in -[NSApplication _sendFinishLaunchingNotification]+0xe8 (AppKit:arm64e+0x4a650)
#22 0x184416074 in -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:]+0x248 (AppKit:arm64e+0x48074)
#23 0x184415c54 in -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:]+0x308 (AppKit:arm64e+0x47c54)
#24 0x18275f9e4 in -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:]+0x158 (Foundation:arm64e+0x369e4)
#25 0x18275f81c in _NSAppleEventManagerGenericHandler+0x5c (Foundation:arm64e+0x3681c)
#26 0x18803d8f0 (AE:arm64e+0xb8f0)
#27 0x18803d248 (AE:arm64e+0xb248)
#28 0x1880363f4 in aeProcessAppleEvent+0x1e4 (AE:arm64e+0x43f4)
#29 0x18a4e23f8 in AEProcessAppleEvent+0x40 (HIToolbox:arm64e+0x453f8)
#30 0x18440ffa0 in _DPSNextEvent+0x730 (AppKit:arm64e+0x41fa0)
#31 0x18440e4c0 in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]+0x52c (AppKit:arm64e+0x404c0)
#32 0x18440068c in -[NSApplication run]+0x250 (AppKit:arm64e+0x3268c)
#33 0x1843d1da4 in NSApplicationMain+0x468 (AppKit:arm64e+0x3da4)
#34 0x102cfb978 in main AppDelegate.swift:22
#35 0x1045b1084 in start+0x200 (dyld:arm64e+0x5084)
SUMMARY: AddressSanitizer: heap-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x18c70) in wrap_memcpy+0x13c
Shadow bytes around the buggy address:
0x0070274f0b10: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x0070274f0b20: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x0070274f0b30: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x0070274f0b40: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x0070274f0b50: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
=>0x0070274f0b60: fa fa 00[fa]fa fa fa fa 00 02 fa fa fa fa 00 02
0x0070274f0b70: fa fa fa fa 00 fa fa fa fa fa fd fd fa fa fa fa
0x0070274f0b80: fd fd fa fa fa fa 00 02 fa fa fa fa fd fd fa fa
0x0070274f0b90: fa fa fd fa fa fa fa fa fd fd fa fa fa fa 00 02
0x0070274f0ba0: fa fa fa fa fd fd fa fa fa fa 00 fa fa fa fa fa
0x0070274f0bb0: 00 fa fa fa fa fa fd fd fd fa fa fa fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==56507==ABORTING
abort() called
Thread 0:: Dispatch queue: com.apple.main-thread
0 libsystem_kernel.dylib 0x1817a88d0 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1817a8d40 mach_msg + 76
2 CoreFoundation 0x1818b2c1c __CFRunLoopServiceMachPort + 372
3 CoreFoundation 0x1818b10cc __CFRunLoopRun + 1180
4 CoreFoundation 0x1818b0490 CFRunLoopRunSpecific + 600
5 HIToolbox 0x18a4d0dd8 RunCurrentEventLoopInMode + 292
6 HIToolbox 0x18a4d0b54 ReceiveNextEventCommon + 564
7 HIToolbox 0x18a4d0908 _BlockUntilNextEventMatchingListInModeWithFilter + 72
8 AppKit 0x18440fbcc _DPSNextEvent + 860
9 AppKit 0x18440e4c4 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1328
10 AppKit 0x184400690 -[NSApplication run] + 596
11 AppKit 0x1843d1da8 NSApplicationMain + 1132
12 IINA 0x102cfb97c main + 12 (AppDelegate.swift:22)
13 dyld 0x1045b1088 start + 516
Thread 1:
0 libsystem_pthread.dylib 0x1817e1078 start_wqthread + 0
Thread 2 Crashed:: mpv/mpv core
0 libsystem_kernel.dylib 0x1817b0db8 __pthread_kill + 8
1 libsystem_pthread.dylib 0x1817e5ee0 pthread_kill + 288
2 libsystem_c.dylib 0x181720340 abort + 168
3 libclang_rt.asan_osx_dynamic.dylib 0x108984110 __sanitizer::Abort() + 68
4 libclang_rt.asan_osx_dynamic.dylib 0x1089837d8 __sanitizer::Die() + 212
5 libclang_rt.asan_osx_dynamic.dylib 0x10896a870 __asan::ScopedInErrorReport::~ScopedInErrorReport() + 424
6 libclang_rt.asan_osx_dynamic.dylib 0x10896a110 __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) + 1244
7 libclang_rt.asan_osx_dynamic.dylib 0x10893cc94 wrap_memcpy + 352
8 libavutil.56.dylib 0x1056d5f00 av_frame_ref + 288
9 libmpv.1.dylib 0x106e6265c mp_frame_ref + 64
10 libmpv.1.dylib 0x106e5b8a8 lavfi_process + 456
11 libmpv.1.dylib 0x106e60be0 mp_filter_graph_run + 468
12 libmpv.1.dylib 0x106ea43b4 run_playloop + 2324
13 libmpv.1.dylib 0x106e9b2c8 mp_play_files + 6528
14 libmpv.1.dylib 0x106e81e08 core_thread + 72
15 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
16 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 3:: mpv/log-file
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106e35794 log_file_thread + 120
3 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
4 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 4:: mpv/lua script (ytdl_hook)
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106e81670 wait_wakeup + 88
3 libmpv.1.dylib 0x106e81fec mpv_wait_event + 392
4 libmpv.1.dylib 0x106e9cf08 script_raw_wait_event + 108
5 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
6 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
7 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
8 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
9 liblua.5.1.dylib 0x105dbdc94 lua_pcall + 112
10 libmpv.1.dylib 0x106e9cb48 script_autofree_trampoline + 128
11 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
12 liblua.5.1.dylib 0x105dcb434 luaV_execute + 2596
13 liblua.5.1.dylib 0x105dc1958 luaD_call + 120
14 liblua.5.1.dylib 0x105dbdbf8 lua_call + 36
15 libmpv.1.dylib 0x106e9ca10 load_scripts + 376
16 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
17 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
18 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
19 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
20 liblua.5.1.dylib 0x105dbdc94 lua_pcall + 112
21 libmpv.1.dylib 0x106e9c348 run_lua + 956
22 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
23 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
24 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
25 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
26 liblua.5.1.dylib 0x105dbdd08 lua_cpcall + 48
27 libmpv.1.dylib 0x106e9be58 load_lua + 276
28 libmpv.1.dylib 0x106ea6bfc run_script + 100
29 libmpv.1.dylib 0x106ea6c80 script_thread + 32
30 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
31 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 5:: mpv/lua script (stats)
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106e81670 wait_wakeup + 88
3 libmpv.1.dylib 0x106e81fec mpv_wait_event + 392
4 libmpv.1.dylib 0x106e9cf08 script_raw_wait_event + 108
5 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
6 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
7 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
8 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
9 liblua.5.1.dylib 0x105dbdc94 lua_pcall + 112
10 libmpv.1.dylib 0x106e9cb48 script_autofree_trampoline + 128
11 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
12 liblua.5.1.dylib 0x105dcb434 luaV_execute + 2596
13 liblua.5.1.dylib 0x105dc1958 luaD_call + 120
14 liblua.5.1.dylib 0x105dbdbf8 lua_call + 36
15 libmpv.1.dylib 0x106e9ca10 load_scripts + 376
16 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
17 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
18 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
19 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
20 liblua.5.1.dylib 0x105dbdc94 lua_pcall + 112
21 libmpv.1.dylib 0x106e9c348 run_lua + 956
22 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
23 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
24 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
25 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
26 liblua.5.1.dylib 0x105dbdd08 lua_cpcall + 48
27 libmpv.1.dylib 0x106e9be58 load_lua + 276
28 libmpv.1.dylib 0x106ea6bfc run_script + 100
29 libmpv.1.dylib 0x106ea6c80 script_thread + 32
30 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
31 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 6:: mpv/lua script (console)
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106e81670 wait_wakeup + 88
3 libmpv.1.dylib 0x106e81fec mpv_wait_event + 392
4 libmpv.1.dylib 0x106e9cf08 script_raw_wait_event + 108
5 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
6 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
7 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
8 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
9 liblua.5.1.dylib 0x105dbdc94 lua_pcall + 112
10 libmpv.1.dylib 0x106e9cb48 script_autofree_trampoline + 128
11 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
12 liblua.5.1.dylib 0x105dcb434 luaV_execute + 2596
13 liblua.5.1.dylib 0x105dc1958 luaD_call + 120
14 liblua.5.1.dylib 0x105dbdbf8 lua_call + 36
15 libmpv.1.dylib 0x106e9ca10 load_scripts + 376
16 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
17 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
18 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
19 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
20 liblua.5.1.dylib 0x105dbdc94 lua_pcall + 112
21 libmpv.1.dylib 0x106e9c348 run_lua + 956
22 liblua.5.1.dylib 0x105dc1590 luaD_precall + 728
23 liblua.5.1.dylib 0x105dc1948 luaD_call + 104
24 liblua.5.1.dylib 0x105dc0fdc luaD_rawrunprotected + 76
25 liblua.5.1.dylib 0x105dc1c2c luaD_pcall + 60
26 liblua.5.1.dylib 0x105dbdd08 lua_cpcall + 48
27 libmpv.1.dylib 0x106e9be58 load_lua + 276
28 libmpv.1.dylib 0x106ea6bfc run_script + 100
29 libmpv.1.dylib 0x106ea6c80 script_thread + 32
30 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
31 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 7:: mpv/ipc socket listener
0 libsystem_kernel.dylib 0x1817b0ed0 poll + 8
1 libclang_rt.asan_osx_dynamic.dylib 0x10894f358 wrap_poll + 856
2 libmpv.1.dylib 0x106e69350 ipc_thread + 368
3 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
4 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 8:: AMCP Logging Spool
0 libsystem_kernel.dylib 0x1817a890c semaphore_wait_trap + 8
1 caulk 0x18a23aa2c caulk::mach::semaphore::wait_or_error() + 28
2 caulk 0x18a21e77c caulk::concurrent::details::worker_thread::run() + 56
3 caulk 0x18a21e39c void* caulk::thread_proxy<std::__1::tuple<caulk::thread::attributes, void (caulk::concurrent::details::worker_thread::*)(), std::__1::tuple<caulk::concurrent::details::worker_thread*> > >(void*) + 96
4 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
5 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 9:
0 libsystem_pthread.dylib 0x1817e1078 start_wqthread + 0
Thread 10:
0 libsystem_pthread.dylib 0x1817e1078 start_wqthread + 0
Thread 11:: com.apple.NSEventThread
0 libsystem_kernel.dylib 0x1817a88d0 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1817a8d40 mach_msg + 76
2 CoreFoundation 0x1818b2c1c __CFRunLoopServiceMachPort + 372
3 CoreFoundation 0x1818b10cc __CFRunLoopRun + 1180
4 CoreFoundation 0x1818b0490 CFRunLoopRunSpecific + 600
5 AppKit 0x18457c794 _NSEventThread + 196
6 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
7 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 12:: mpv/demux
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106e3abf8 demux_thread + 236
3 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
4 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 13:: mpv/worker
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106e6d8ec worker_thread + 88
3 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
4 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 14:: mpv/vo
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libmpv.1.dylib 0x106ee9160 vo_thread + 1028
3 libsystem_pthread.dylib 0x1817e626c _pthread_start + 148
4 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 15:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 16:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 17:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 18:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 19:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 20:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 21:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 22:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 23:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 24:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 25:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavcodec.58.dylib 0x107c0f928 0x107870000 + 3799336
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 26:
0 libsystem_pthread.dylib 0x1817e1078 start_wqthread + 0
Thread 27:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 28:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 29:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 30:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 31:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 32:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 33:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 34:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 35:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 36:
0 libsystem_kernel.dylib 0x1817ac290 __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1817e683c _pthread_cond_wait + 1236
2 libavutil.56.dylib 0x1056ef51c 0x1056c4000 + 177436
3 libsystem_pthread.dylib 0x1817e108c thread_start + 8
Thread 2 crashed with ARM Thread State (64-bit):
x0: 0x0000000000000000 x1: 0x0000000000000000 x2: 0x0000000000000000 x3: 0x0000000000000000
x4: 0x0000000000000000 x5: 0x0000000000000000 x6: 0x0000000000000000 x7: 0x0000000000000000
x8: 0x39efc6269785c021 x9: 0x39efc627fa02f021 x10: 0x000000002db0e293 x11: 0x0000000000000013
x12: 0x0000000000000000 x13: 0x0000000108a97330 x14: 0x0000000000000000 x15: 0xffffffffffffffff
x16: 0x0000000000000148 x17: 0x00000001db653640 x18: 0x0000000000000000 x19: 0x0000000000000006
x20: 0x000000016d873000 x21: 0x000000000000740b x22: 0x000000016d8730e0 x23: 0x000000016d872198
x24: 0x000000016d8729e0 x25: 0x0000000000000000 x26: 0x0000000000000000 x27: 0x000000016d872a8b
x28: 0x0000000107084cc7 fp: 0x000000016d871470 lr: 0x00000001817e5ee0
sp: 0x000000016d871450 pc: 0x00000001817b0db8 cpsr: 0x40001000
far: 0x000000011b6c0000 esr: 0x56000080 Address size fault
Binary Images:
0x1817a7000 - 0x1817defff libsystem_kernel.dylib (*) <1d7b3b8e-75a1-34ea-aa52-9f7c23155c55> /usr/lib/system/libsystem_kernel.dylib
0x18182e000 - 0x181d73fff com.apple.CoreFoundation (6.9) <8e1809ff-f5b1-3d9e-be15-f2e7b1d8ce51> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x18a49d000 - 0x18a7d0fff com.apple.HIToolbox (2.1.1) <4a1d1f30-c79d-3502-b51f-9792adbd8e06> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x1843ce000 - 0x185285fff com.apple.AppKit (6.9) <465b9570-6646-31ea-a082-ab0dfa538966> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x1027b8000 - 0x1035b7fff com.colliderli.iina (1.2.0) <efe1ec7f-eab8-387d-ab9a-958f767a5f33> /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/MacOS/IINA
0x1045ac000 - 0x10460bfff dyld (*) <fbb89662-e6f2-3434-b542-f75185ac5e74> /usr/lib/dyld
0x1817df000 - 0x1817ebfff libsystem_pthread.dylib (*) <cee8bc77-6923-34d9-89a3-6f8f7279605e> /usr/lib/system/libsystem_pthread.dylib
0x1816a6000 - 0x181727fff libsystem_c.dylib (*) <fd566a15-42d8-314a-a99a-b59237ddf5bc> /usr/lib/system/libsystem_c.dylib
0x108924000 - 0x1089abfff libclang_rt.asan_osx_dynamic.dylib (*) <0fc3ed89-fe1a-39a4-8789-16c0e754c723> /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/Frameworks/libclang_rt.asan_osx_dynamic.dylib
0x1056c4000 - 0x105713fff libavutil.56.dylib (*) <5c895e35-ab89-33a2-a642-8d5a486174dc> /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/Frameworks/libavutil.56.dylib
0x106e10000 - 0x1070e3fff libmpv.1.dylib (*) <a484fb47-91da-3294-9c91-82bcc566d154> /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/Frameworks/libmpv.1.dylib
0x105db8000 - 0x105dd7fff liblua.5.1.dylib (*) <22e0e246-4fca-362d-aec2-f887a557d21d> /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/Frameworks/liblua.5.1.dylib
0x18a21c000 - 0x18a242fff com.apple.audio.caulk (1.0) <23d0d7ce-cb87-35f3-9c15-943bd8f6645a> /System/Library/PrivateFrameworks/caulk.framework/Versions/A/caulk
0x107870000 - 0x1080b7fff libavcodec.58.dylib (*) <0ef47139-dcbe-341f-be69-af216ea6a6fe> /Users/USER/Library/Developer/Xcode/DerivedData/iina-echacgeisxgbwucwumppkhklmnkd/Build/Products/Debug/IINA.app/Contents/Frameworks/libavcodec.58.dylib
External Modification Summary:
Calls made by other processes targeting this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by all processes on this machine:
task_for_pid: 10
thread_create: 0
thread_set_state: 658
VM Region Summary:
ReadOnly portion of Libraries: Total=1.1G resident=0K(0%) swapped_out_or_unallocated=1.1G(100%)
Writable regions: Total=14.0T written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=14.0T(100%)
VIRTUAL REGION
REGION TYPE SIZE COUNT (non-coalesced)
=========== ======= =======
Accelerate framework 128K 1
Activity Tracing 256K 1
CG backing stores 3840K 4
CG image 1536K 23
ColorSync 656K 29
CoreAnimation 4416K 72
CoreGraphics 32K 2
CoreImage 16K 1
CoreUI image data 3984K 29
Foundation 16K 1
Kernel Alloc Once 32K 1
MALLOC 133.2M 11
MALLOC guard page 96K 5
MALLOC_NANO (reserved) 384.0M 1 reserved VM address space (unallocated)
OpenGL GLSL 384K 5
STACK GUARD 56.6M 37
Sanitizer 2.0T 1690
Sanitizer (reserved) 14.0T 76 reserved VM address space (unallocated)
Stack 27.1M 37
VM_ALLOCATE 336K 20
__AUTH 2584K 308
__AUTH_CONST 20.5M 503
__DATA 38.2M 565
__DATA_CONST 20.6M 571
__DATA_DIRTY 1800K 209
__FONT_DATA 4K 1
__GLSLBUILTINS 5176K 1
__LINKEDIT 602.2M 67
__OBJC_CONST 3606K 273
__OBJC_RO 82.9M 1
__OBJC_RW 3152K 1
__TEXT 551.1M 589
__UNICODE 592K 1
dyld private memory 1024K 1
mapped file 161.6M 26
shared memory 848K 14
=========== ======= =======
TOTAL 16.0T 5177
TOTAL, minus reserved VM space 2.0T 5177
Truncated report due to GitHub comment size limits...
Steps to reproduce:
Start IINA and open Preferences / Advanced. Enable advanced settings and under additional mpv options add this mpv setting:
input-ipc-server /tmp/mpv-socket
Bring up Xcode and select "Product / Scheme / Edit Scheme...".
Under "Runtime Sanitization" enable "Address Sanitizer".
Rebuild IINA.
Start IINA and start playing a movie.
Open a terminal window and run these two commands to add the audio filters:
echo '{ "command": ["af", "add", "scaletempo:stride=8:overlap=1:search=10:scale=2:speed=pitch"] }' | socat - /tmp/mpv-socket | jq
echo '{ "command": ["af", "add", "@iina_aeq9:lavfi=[anequalizer=c0 f=16000.0 w=13063.945299020566 g=0.0|c1 f=16000.0 w=13063.945299020566 g=0.0]"] }' | socat - /tmp/mpv-socket | jqAdding the second audio filter will trigger the crash when IINA is build with the address sanitizer.
The same crash will occur if the filters are added using IINA's filter window.
- MPV does not have this problem.
I've not had a chance to do much investigation but this appears to be a "upstream" problem that likely has already been fixed. Under Apple Silicon IINA is currently using mpv 0.33.0 and FFmpeg 4.3.1. Running the same test with an IINA fork that uses mpv 0.34.1 and FFmpeg 5.0 did not reproduce the problem.
How often does this happen?
Every time.