#141 Illegal instruction when decoding XX264/AVC inside FLV

closed-out-of-date
MPlayer (86)
5
2013-02-20
2011-07-08
dos386
No

Sherpya 32848 from 2011-02-04 and later until latest 2011-06-09 there is a regression: XXX264/AVC (only inside FLV ???) decoder sometimes (???) crashes (Pentium 1 with MMX). Older r32492 2010-10-14 does not have this problem. http://ompldr.org/vN2c4Mw/BALLMERA.FLV (3 MiB, crash after 3 seconds and 92 frames). I'm aware that it's documented that "RTM means with runtime cpudetection, working on i486+ (except x264 decoder/encoder). Prefer p4/p3/athlon builds if possible", but:

1. It used to work
2. Problem only (???) affects XXX264/AVC inside FLV , not inside MPEG-4 !?!?

IIRC I had sent a mail on this some time ago.

Discussion

  • WSC
    WSC
    2011-07-08

    Have you tried his Pentium3 or Generic 486 rtm builds? Anyway, with Mplayer / Mencoder, I found the AAC inside an FLV to be very poor in quality, and the computed bitrate would be totally wrong to non existent. But this is from Mencoder using its FAAC. However, converting to AVC and AAC with an MP4 container was correct. Sound still poor, though. There is a big problem with -lavfopts format=flv. Try playing it with FFPlay from FFMpeg.

     
  • BALLMERA.FLV 2'678'141 | "XXX264" inside "FLV"
    D7226D3427DAB613F896C5AE509BE414

    http://ompldr.org/vN2c4Mw/BALLMERA.FLV

    ****

    New "bad" one:

    "mplayer-r32848.tar.bz2" 9'722'287
    A64ED359821D4EA652A2A70B7BDE6118

    "MPlayer-rtm-svn-32848.7z" 6'796'813
    F1DDB116D0DDBE53F3DDB1718D7D4C58

    MPWRC4.EXE 17'455'616 2011-02-03 23:08
    5F2F54FF836521CEF6ECA85BED670918

    > MPlayer Sherpya-SVN-r32848-4.2.5 (C) 2000-2011 MPlayer Team
    > Usage: mplayer [options] [url|path/]filename

    ****

    Old "good" one:

    MPWNN.EXE 17'225'728
    42ABB44D8E1F12D6BB391F61B42DD946

    MPlayer Sherpya-SVN-r32492-4.2.5 (C) 2000-2010 MPlayer Team
    Usage: mplayer [options] [url|path/]filename

    ****

    3 seconds and 92 frames decoded OK, then crash:

    $x8E1 0FBDCA bsr ecx,edx
    $x8E4 81C200008000 add edx,$800000
    $x8EA BB07000000 mov ebx,0x7
    $x8EF 39D9 cmp ecx,ebx
    $x8F1 0F4FCB cmovg ecx,ebx ; !!! BOOM !!!
    $x8F4 43 inc ebx
    $x8F5 D3EA shr edx,cl
    $x8F7 29CB sub ebx,ecx
    $x8F9 0F6EF3 movd mm6,ebx
    $x8FC 0F6F3DA0492401 movq mm7,[dword $0124'49A0]
    $x903 0F6FC8 movq mm1,mm0
    $x906 0F61C7 punpcklwd mm0,mm7
    $x909 0F69CF punpckhwd mm1,mm7
    $x90C 0F6FEA movq mm5,mm2
    $x90F 0F61D7 punpcklwd mm2,mm7
    $x912 0F69EF punpckhwd mm5,mm7
    $x915 0F6EFA movd mm7,edx
    $x918 0F62FF punpckldq mm7,mm7
    $x91B 0FF5C7 pmaddwd mm0,mm7
    $x91E 0FF5D7 pmaddwd mm2,mm7
    $x921 0FF5CF pmaddwd mm1,mm7
    $x924 0FF5EF pmaddwd mm5,mm7
    $x927 0FE2C6 psrad mm0,mm6
    $x92A 0FE2D6 psrad mm2,mm6
    $x92D 0FE2CE psrad mm1,mm6
    $x930 0FE2EE psrad mm5,mm6
    $x933 0F6BC1 packssdw mm0,mm1
    $x936 0F6BD5 packssdw mm2,mm5
    $x939 0F7EC1 movd ecx,mm0
    $x93C 0F73D020 psrlq mm0,0x20
    $x940 0F7EC3 movd ebx,mm0
    $x943 668908 mov [eax],cx
    $x946 66899880000000 mov [eax+0x80],bx
    $x94D C1E910 shr ecx,0x10
    $x950 C1EB10 shr ebx,0x10
    $x953 66894820 mov [eax+0x20],cx
    $x957 668998A0000000 mov [eax+0xa0],bx
    $x95E 0F7ED1 movd ecx,mm2
    $x961 0F73D220 psrlq mm2,0x20
    $x965 0F7ED3 movd ebx,mm2
    $x968 66894840 mov [eax+0x40],cx
    $x96C 668998C0000000 mov [eax+0xc0],bx
    $x973 C1E910 shr ecx,0x10
    $x976 C1EB10 shr ebx,0x10
    $x979 66894860 mov [eax+0x60],cx
    $x97D 668998E0000000 mov [eax+0xe0],bx
    $x984 0F6F3DA0492401 movq mm7,[dword $0124'49A0]
    $x98B 0F6FCB movq mm1,mm3
    $x98E 0F61DF punpcklwd mm3,mm7
    $x991 0F69CF punpckhwd mm1,mm7
    $x994 0F6FEC movq mm5,mm4
    $x997 0F61E7 punpcklwd mm4,mm7
    $x99A 0F69EF punpckhwd mm5,mm7
    $x99D 0F6EFA movd mm7,edx
    $x9A0 0F62FF punpckldq mm7,mm7
    $x9A3 0FF5DF pmaddwd mm3,mm7
    $x9A6 0FF5E7 pmaddwd mm4,mm7
    $x9A9 0FF5CF pmaddwd mm1,mm7
    $x9AC 0FF5EF pmaddwd mm5,mm7
    $x9AF 0FE2DE psrad mm3,mm6
    $x9B2 0FE2E6 psrad mm4,mm6
    $x9B5 0FE2CE psrad mm1,mm6
    $x9B8 0FE2EE psrad mm5,mm6
    $x9BB 0F6BD9 packssdw mm3,mm1
    $x9BE 0F6BE5 packssdw mm4,mm5
    $x9C1 0F7ED9 movd ecx,mm3
    $x9C4 0F73D320 psrlq mm3,0x20
    $x9C8 0F7EDB movd ebx,mm3
    $x9CB 66898800010000 mov [eax+0x100],cx
    $x9D2 66899880010000 mov [eax+0x180],bx
    $x9D9 C1E910 shr ecx,0x10
    $x9DC C1EB10 shr ebx,0x10
    $x9DF 66898820010000 mov [eax+0x120],cx
    $x9E6 668998A0010000 mov [eax+0x1a0],bx
    $x9ED 0F7EE1 movd ecx,mm4
    $x9F0 0F73D420 psrlq mm4,0x20
    $x9F4 0F7EE3 movd ebx,mm4
    $x9F7 66898840010000 mov [eax+0x140],cx
    $x9FE 668998C0010000 mov [eax+0x1c0],bx
    $xA05 C1E910 shr ecx,0x10
    $xA08 C1EB10 shr ebx,0x10
    $xA0B 66898860010000 mov [eax+0x160],cx
    $xA12 668998E0010000 mov [eax+0x1e0],bx
    $xA19 5B pop ebx
    $xA1A C3 ret

    EAX=02971680 EBX=00000007
    ECX=0000000F EDX=00808000
    ESI=00000160 EDI=027E81AF
    EBP=0294D7E0 ESP=00324678
    EFL=0001'3202 EIP=00A7'04F1

    The CMOVG / CMOVNTQ instruction is an old problem, here it is
    just used "rarely". The MMX code is fine, the used CPU does have MMX.
    But there should be no CMOVNTQ in the MMX branch, as not every
    MMX CPU supports it. If the MMX branch is inherently broken, then
    the solution is to drop it completely and use the generic/80486/no-MMX
    branch instead. Just below there seems to be the SSE2 branch, that one
    might keep the CMOVNTQ's as Pentium4 always (?) has both SSE2
    and CMOVNTQ.

     
  • > Have you tried his Pentium3 or Generic 486 rtm builds?

    Generic 486 (surprisingly).

    > [09/06/2011] Fixed dvdnav:// crash. Perhaps, do you really still need p3 builds?

    NO I don't. On my P4, I use P4 builds or Generic 486, on my P1, I use only Generic 486.

     
  • (dos386) previous 2 comments

     
  • dos386
    dos386
    2011-07-10

    (dos386) previous 3 comments (can't login?)

     
  • I just sent
    > [PATCH] Detect and check for CMOV.
    to ffmpeg mailing list, so hopefully this will be fixed soon.
    The cmov is only on the DC prediction MMX code, so it will only crash for H.264 files that have that feature.
    In addition several functions for SVQ3 contain cmov, so SVQ3 files would probably crash for you, too.

     
  • Thank you ... this looks very informative. The solution is simple: remove CMOV from MMX branch (so Pentium 3 and only Pentium 3 will suffer from 0.1% performance loss maybe then).

    (dos386)

     
  • dos386
    dos386
    2012-02-23

    > In addition several functions for SVQ3 contain cmov,
    > so SVQ3 files would probably crash for you, too

    because SVQ3 ~~ H264 http://en.wikipedia.org/wiki/Sorenson_codec#Technical_details

    please let me informed how your patch is doing

     
  • WvaaLi <a href="http://eieodrcdcsrg.com/">eieodrcdcsrg</a>, [url=http://lssnbililstk.com/]lssnbililstk[/url], [link=http://petrwrrojatu.com/]petrwrrojatu[/link], http://wkjznbhiicoy.com/

     
  • qGvF7Y <a href="http://phrxdapfbwez.com/">phrxdapfbwez</a>, [url=http://ygkkxazbexdg.com/]ygkkxazbexdg[/url], [link=http://mmqizmymdrhw.com/]mmqizmymdrhw[/link], http://xvbvwgbohgsa.com/

     
    • Status: open --> closed-out-of-date