mpv icon indicating copy to clipboard operation
mpv copied to clipboard
Published 1 month ago • verified publisher icon mpv-player

d3d11: crash on destroy in amdxx64.dll

Open kasper93 opened this issue 1 year ago • 14 comments

mpv Information

mpv v0.38.0-710-ga3b11b8812-dirty Copyright © 2000-2024 mpv/MPlayer/mplayer2 projects
 built on Jul 26 2024 22:13:44
libplacebo version: v7.349.0 (v7.349.0-rc1-20-gea3d0673-dirty)
FFmpeg version: N-116262-g61287272cb
FFmpeg library versions:
   libavcodec      61.10.100
   libavdevice     61.2.100
   libavfilter     10.2.102
   libavformat     61.5.101
   libavutil       59.28.100
   libswresample   5.2.100
   libswscale      8.2.100

Other Information

  • Windows version: Microsoft Windows NT 10.0.22631.0/22631.3880
  • GPU model, driver and version: AMD 5700XT @ 24.7.1
  • Source of mpv: self-built
  • Introduced in version: AMD driver regression since 23.12.1

Reproduction Steps

Open any file with --gpu-api=d3d11. Crash occurs on exit/destroy. The issue is reported mostly to track this and document the AMD driver bug, which we unfortunately are unable to fix. And the AMD's bug reporting tool is a black hole, reported there few times with updated stack traces for recent drivers, but nothing. The issue itself is annoying, because it prevents mpv executable to exit cleanly.

Likely the same issue observed in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1874474

Expected Behavior

No crash.

Actual Behavior

Crash.

Log File

mpv log doesn't show anything useful, as the crash is outside the mpv. The access violation exception doesn't happen always in normal conditions, depending on testing environment it crashes 4 out of 6 times. Enabling Application Verifier helps to reproduce the invalid write every time. Below is the stack trace from the latest driver:

(665c.3c80): Access violation - code c0000005 (!!! second chance !!!)
amdxx64!boost::serialization::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >+0xae2a5:
00007ffe`21af4055 488901          mov     qword ptr [rcx],rax ds:000001fd`89d98e60=????????????????
0:012> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Write

    Key  : AVRF.Enabled
    Value: 1

    Key  : Analysis.CPU.mSec
    Value: 437

    Key  : Analysis.Elapsed.mSec
    Value: 496

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 26

    Key  : Analysis.IO.Write.Mb
    Value: 26

    Key  : Analysis.Init.CPU.mSec
    Value: 140

    Key  : Analysis.Init.Elapsed.mSec
    Value: 8748

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 144

    Key  : Failure.Bucket
    Value: INVALID_POINTER_WRITE_AVRF_c0000005_amdxx64.dll!Unknown

    Key  : Failure.Hash
    Value: {303a9a38-b9f3-650f-923b-3c60129f1b5b}

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 795298

    Key  : Timeline.Process.Start.DeltaSec
    Value: 21

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Version
    Value: 10.0.22621.1

    Key  : WER.Process.Version
    Value: 2.0.0.0


NTGLOBALFLAG:  2000100

APPLICATION_VERIFIER_FLAGS:  80000001

APPLICATION_VERIFIER_LOADED: 1

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffe21af4055 (amdxx64!boost::serialization::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >+0x00000000000ae2a5)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 000001fd89d98e60
Attempt to write to address 000001fd89d98e60

FAULTING_THREAD:  00003c80

PROCESS_NAME:  mpv.exe

WRITE_ADDRESS:  000001fd89d98e60 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  000001fd89d98e60

STACK_TEXT:  
000000a1`dd5ff3f0 00007ffe`21af3dcf     : 000001fd`8fee7a40 00000000`00000000 00000000`00000001 00007ffe`21af56c2 : amdxx64!boost::serialization::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >+0xae2a5
000000a1`dd5ff420 00007ffe`21af48df     : 000001fd`8fee7a40 00000000`00000000 00000000`0000000b 00000000`0000000b : amdxx64!boost::serialization::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >+0xae01f
000000a1`dd5ff470 00007ffe`21b04e86     : 000001fd`da268d78 00007ffe`7a3028cd 00000000`00000000 00000000`00000000 : amdxx64!boost::serialization::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >+0xaeb2f
000000a1`dd5ff4a0 00007ffe`75f38b0b     : 000001fd`da25e420 00000000`00000000 000001fd`da201618 00000000`00000000 : amdxx64!boost::serialization::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >::singleton<boost::serialization::extended_type_info_typeid<_SC_COMPILE_FLAGS> >+0xbf0d6
000000a1`dd5ff4d0 00007ffe`75f454ce     : 00000000`00000000 000001fd`da25e420 00000000`00000000 00007ffe`75f144e5 : d3d11!NDXGI::CDevice::DestroyDriverInstance+0x6b
000000a1`dd5ff520 00007ffe`75f3e340     : 000001fd`da25e3f0 00007ffe`75f31e16 000001fd`f4af0000 00000000`00003c80 : d3d11!CContext::LUCBeginLayerDestruction+0x7e
000000a1`dd5ff570 00007ffe`75f31df6     : 000001fd`da201608 00007ffe`75f3235c 000001fd`b4c79ea0 00000000`00000001 : d3d11!NOutermost::CDeviceChild::LUCBeginLayerDestruction+0x24
000000a1`dd5ff5a0 00007ffe`75f32315     : 000001fd`da25e3f0 00007ffe`75f34b6c 000000ea`22b911b4 000001fd`8d767ec0 : d3d11!CUseCountedObject<NOutermost::CDeviceChild>::`scalar deleting destructor'+0x46
000000a1`dd5ff5d0 00007ffe`75f3a01e     : 00000001`4e1401b4 000001fd`8d767ee0 000000ea`22b911b4 000001fd`8d767ec0 : d3d11!CUseCountedObject<NOutermost::CDeviceChild>::UCDestroy+0x25
000000a1`dd5ff600 00007ffe`75f365c2     : 000001fd`da2015c0 00000000`00000000 00000000`00000000 00000000`00000000 : d3d11!CUseCountedObject<NOutermost::CDeviceChild>::UCReleaseUse+0xae
000000a1`dd5ff630 00007ffe`75f450b8     : 000001fd`da201ef8 000001fd`da201e00 000001fd`da201990 000001fd`da201990 : d3d11!CDevice::LLOBeginLayerDestruction+0x192
000000a1`dd5ff660 00007ffe`75f43854     : 000001fd`da201608 000001fd`da2015c0 000001fd`89db6f90 00000000`00000000 : d3d11!NDXGI::CDevice::LLOBeginLayerDestruction+0x138
000000a1`dd5ff6a0 00007ffe`75f38c47     : 00000001`4e1401b4 000001fd`8d767ee0 000000ea`22b911b4 000001fd`8d767ec0 : d3d11!NOutermost::CDevice::LLOBeginLayerDestruction+0x24
000000a1`dd5ff6d0 00007ffe`75f389b4     : 00000000`00000000 00000000`00000000 000001fd`89db6f90 000001fd`da25e420 : d3d11!TComObject<NOutermost::CDevice>::~TComObject<NOutermost::CDevice>+0x23
000000a1`dd5ff700 00007ffe`75f36f43     : 00000000`00000000 000001fd`8d767ee0 000001fd`8d767ec0 000001fd`da25e528 : d3d11!TComObject<NOutermost::CDevice>::`scalar deleting destructor'+0x14
000000a1`dd5ff730 00007ffe`75f36bd9     : 000001fd`da25e3f0 000001fd`da25e420 000001fd`da25e420 000001fd`89db6f90 : d3d11!TComObject<NOutermost::CDevice>::Release+0x43
000000a1`dd5ff760 00007ffe`75f0bd32     : 00007ffe`760cd1f8 000001fd`d9857fd8 00000000`00000000 000001fd`89db6f90 : d3d11!CUseCountedObject<NOutermost::CDeviceChild>::Release+0x1c9
000000a1`dd5ff790 00007ff7`065d51c3     : 000001fd`da25e4b8 000001fd`d9857fd8 000001fd`89db6f90 00007ff7`065d2991 : d3d11!CLayeredObject<CClassLinkage>::CContainedObject::Release+0x22
000000a1`dd5ff7c0 00007ff7`06566de6     : 000001fd`d9857fd8 000001fd`00000000 000001fd`b6af7fa0 000001fd`8d767ee0 : mpv!destroy+0x1b3
000000a1`dd5ff820 00007ff7`065a0ae6     : 00007ffe`7a1f364b 00007ff7`00000000 000001fd`8d767ec0 00007ffe`7a1f364b : mpv!ra_ctx_destroy+0x36
000000a1`dd5ff860 00007ff7`06583c56     : 00000000`00000000 00007ffe`00000000 00000000`00000000 000001fd`894c1ee0 : mpv!gpu_ctx_destroy+0xb6
000000a1`dd5ff8b0 00007ffe`7a209333     : 000001fd`d975bfd0 00000000`00000000 00000000`00000000 00000000`00000000 : mpv!vo_thread+0x1f6
000000a1`dd5ffa70 00007ffe`7c46257d     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ucrtbase!thread_start<unsigned int (__cdecl*)(void *),1>+0x93
000000a1`dd5ffaa0 00007ffe`7c9caf28     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x1d
000000a1`dd5ffad0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x28


SYMBOL_NAME:  amdxx64+ae2a5

MODULE_NAME: amdxx64

IMAGE_NAME:  amdxx64.dll

STACK_COMMAND:  ~12s ; .cxr ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_AVRF_c0000005_amdxx64.dll!Unknown

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  32.0.11029.1008

FAILURE_ID_HASH:  {303a9a38-b9f3-650f-923b-3c60129f1b5b}

Followup:     MachineOwner
---------

And the offending module:

0:012> lmvm amdxx64
Browse full module list
start             end                 module name
00007ffe`219a0000 00007ffe`2581e000   amdxx64    (export symbols)       C:\WINDOWS\System32\DriverStore\FileRepository\u0405491.inf_amd64_cb31d9b7ce8e6841\B405281\amdxx64.dll
    Loaded symbol image file: C:\WINDOWS\System32\DriverStore\FileRepository\u0405491.inf_amd64_cb31d9b7ce8e6841\B405281\amdxx64.dll
    Image path: C:\WINDOWS\System32\DriverStore\FileRepository\u0405491.inf_amd64_cb31d9b7ce8e6841\B405281\amdxx64.dll
    Image name: amdxx64.dll
    Browse all global symbols  functions  data
    Timestamp:        Thu Jul 11 16:11:45 2024 (668FE821)
    CheckSum:         03F9EEE9
    ImageSize:        03E7E000
    File version:     32.0.11029.1008
    Product version:  9.17.11.69
    File flags:       0 (Mask 0)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04e4
    Information from resource tables:
        CompanyName:      Advanced Micro Devices, Inc. 
        ProductName:      Advanced Micro Devices, Inc. Radeon DirectX 10/11 Driver
        InternalName:     amdxx64.dll
        OriginalFilename: amdxx64.dll
        ProductVersion:   9.17.11.0069
        FileVersion:      9.17.11.0069
        PrivateBuild:     Built by AMD
        SpecialBuild:     DevStudio Build
        FileDescription:  AMD DX10/DX11 UMD 
        LegalCopyright:   Copyright (C) 2017-2024 AMD Inc.
        LegalTrademarks:  Radeon (TM) is a Trademark of AMD Inc.

Sample Files

No response

I carefully read all instruction and confirm that I did the following:

  • [X] I tested with the latest mpv version to validate that the issue is not already fixed.
  • [X] I provided all required information including system and mpv version.
  • [ ] I produced the log file with the exact same set of files, parameters, and conditions used in "Reproduction Steps", with the addition of --log-file=output.txt.
  • [ ] I produced the log file while the behaviors described in "Actual Behavior" were actively observed.
  • [ ] I attached the full, untruncated log file.
  • [X] I attached the backtrace in the case of a crash.

kasper93 avatar Jul 26 '24 20:07 kasper93

Can't reproduce on my 6700XT, is there something else needed to reproduce? I can only get MPV to crash when trying to load large shaders and then trying to quit while it's still compiling but that's regarded as an application hang. It looks pretty similar to the type of errors Nvidia was blaming the 13th/14th gen Intel processors for, it might help to include which CPU is in use.

Jules-A avatar Jul 27 '24 00:07 Jules-A

i have AMD Ryzen 5 5600G with Radeon Graphics driver Driver Version: 31.0.21916.2 and i use libmpv from shinchiro, i don't have any problem. i'm reporting this just to narrow down the issue to a specific combination cpu/gpu

wbtcpip2 avatar Jul 27 '24 22:07 wbtcpip2

This is not easily visible, because it crashes on program exit, so it looks like normal close most of the time, unless you have actually debugger attached, or just in time debugger configured.

kasper93 avatar Jul 28 '24 01:07 kasper93

unless you have actually debugger attached, or just in time debugger configured.

Are you saying it won't appear in event viewer? I tried in Visual Studio debugger and wasn't able to see it.

Jules-A avatar Jul 28 '24 03:07 Jules-A

Have you tried with app verifier? It is easier to reproduce this way, it doesn't happen all the time without it, as the region of invalid memory access is not that big apparently.

kasper93 avatar Jul 28 '24 14:07 kasper93

Have you tried with app verifier?

I just tried about 15x with it also enabled and still wasn't able to see it. I forgot to ask if it's exclusive to self builds or does it also happen with Zhongfly's builds (which I'm using)?

Jules-A avatar Jul 28 '24 17:07 Jules-A