Segmentation fault during render from Kdenlive

[pettinen]

Describe the bug
Segmentation fault during rendering.

gdb session
or maybe this is the actual backtrace, I’m not too familiar with debugging these

Current Position:          0
Thread 46 "melt" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff92fdc6c0 (LWP 10072)]
qt_memfillXX_avx2 (dest=0x7ffe3292df30 "", value256=..., bytes=8294400)
    at /usr/src/debug/qt6-base/qtbase/src/gui/painting/qdrawhelper_avx2.cpp:294
294             _mm256_storeu_si256(dst256 + 2, value256);
(gdb) bt
#0  qt_memfillXX_avx2 (dest=0x7ffe3292df30 "", value256=..., bytes=8294400)
    at /usr/src/debug/qt6-base/qtbase/src/gui/painting/qdrawhelper_avx2.cpp:294
#1  0x00007fffdbb37d15 in filter_get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () from /usr/local/lib/mlt-7/libmltqt6.so
#2  0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff728ae5a0, buffer=0x7fff92fd9d18, 
    format=0x555555b9924c, width=0x7fff92fd9ce4, height=0x7fff92fd9ce8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#3  0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff72558c60, buffer=0x7fff92fd9d18, 
    format=0x555555b9924c, width=0x7fff92fd9ce4, height=0x7fff92fd9ce8, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#4  0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff72558c60, buffer=0x7fff92fd9d18, 
    format=0x555555b9924c, width=0x7fff92fd9ce4, height=0x7fff92fd9ce8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#5  0x00007ffff7faa16d in get_image_b (b_frame=0x7fff72558c60, image=0x7fff92fd9d18, 
    format=0x555555b9924c, width=0x7fff92fd9ce4, height=0x7fff92fd9ce8, writable=0)
    at /home/jp/mlt/src/framework/mlt_transition.c:379
#6  0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff72558c60, buffer=0x7fff92fd9d18, 
    format=0x555555b9924c, width=0x7fff92fd9ce4, height=0x7fff92fd9ce8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#7  0x00007fffdbb679c4 in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () from /usr/local/lib/mlt-7/libmltqt6.so
#8  0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff72965a60, buffer=0x7fff92fda0e0, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#9  0x00007ffff7faa007 in get_image_a (a_frame=0x7fff72965a60, image=0x7fff92fda0e0, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_transition.c:348
#10 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff72965a60, buffer=0x7fff92fda0e0, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#11 0x00007fffdbb67f03 in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () from /usr/local/lib/mlt-7/libmltqt6.so
#12 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff72965a60, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#13 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff7295e220, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#14 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff7295e220, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#15 0x00007fffdc1de6f3 in filter_get_image () from /usr/local/lib/mlt-7/libmltplus.so
#16 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff7295e220, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#17 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff730c33a0, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#18 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff730c33a0, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#19 0x00007ffff7faa16d in get_image_b (b_frame=0x7fff730c33a0, image=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_transition.c:379
#20 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff730c33a0, buffer=0x7fff92fdab88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#21 0x00007ffff7f51c0f in transition_get_image () from /usr/local/lib/mlt-7/libmltfrei0r.so
#22 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff4c053660, buffer=0x7fff92fdad88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#23 0x00007ffff7faa16d in get_image_b (b_frame=0x7fff4c053660, image=0x7fff92fdad88, 
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_transition.c:379
#24 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff4c053660, buffer=0x7fff92fdad88, 
--Type <RET> for more, q to quit, c to continue without paging--c
    format=0x555555b9924c, width=0x7fff92fdad54, height=0x7fff92fdad58, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#25 0x00007fffdbb679c4 in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () from /usr/local/lib/mlt-7/libmltqt6.so
#26 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff4ee675e0, buffer=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#27 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff72631cb0, buffer=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#28 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff72631cb0, buffer=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#29 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff73da7e20, buffer=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#30 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff73da7e20, buffer=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#31 0x00007ffff7faa16d in get_image_b (b_frame=0x7fff73da7e20, image=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_transition.c:379
#32 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff73da7e20, buffer=0x7fff92fdb318, 
    format=0x555555b9924c, width=0x7fff92fdb2e4, height=0x7fff92fdb2e8, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#33 0x00007fffdbb679c4 in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () from /usr/local/lib/mlt-7/libmltqt6.so
#34 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c005300, buffer=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#35 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff8c004590, buffer=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#36 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c004590, buffer=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#37 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff8c003790, buffer=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#38 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c003790, buffer=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#39 0x00007ffff7faa16d in get_image_b (b_frame=0x7fff8c003790, image=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_transition.c:379
#40 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c003790, buffer=0x7fff92fdb8a8, 
    format=0x555555b9924c, width=0x7fff92fdb874, height=0x7fff92fdb878, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#41 0x00007fffdbb679c4 in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () from /usr/local/lib/mlt-7/libmltqt6.so
#42 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff4ede4b20, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#43 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff8c0028a0, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#44 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c0028a0, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#45 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff8c001aa0, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#46 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c001aa0, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#47 0x00007ffff7fa8bc3 in producer_get_image (self=0x7fff8c000c10, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_tractor.c:376
#48 0x00007ffff7f88d21 in mlt_frame_get_image (self=0x7fff8c000c10, buffer=0x7fff92fdbe18, 
    format=0x555555b9924c, width=0x7fff92fdbdb0, height=0x7fff92fdbdb4, writable=0)
    at /home/jp/mlt/src/framework/mlt_frame.c:515
#49 0x00007ffff7f824fc in consumer_read_ahead_thread (arg=0x555555ce4850)
    at /home/jp/mlt/src/framework/mlt_consumer.c:844
#50 0x00007ffff7c9698b in ?? () from /usr/lib/libc.so.6
#51 0x00007ffff7d1a9cc in ?? () from /usr/lib/libc.so.6

To Reproduce
Seems to happen only with enough tracks and nested sequences, irrespective of the encoding settings; I can’t pinpoint the exact cause. Tell me if sending the Kdenlive project (or .mlt file and sources or something) would be useful.

Expected behavior
...

Desktop (please complete the following information):

• OS: 6.18.4-1-MANJARO
• MLT/melt version: occurred with both v7.36.1 and aadad0a

[luzpaz]

Can you reproduce the issue in the most simplistic way ?

[pettinen]

I trimmed the project down to a relatively minimal example (still too big for github’s file limits): https://jeremi.as/crash.tar
Let me know if you can reproduct with that.

[luzpaz]

Not sure how to reproduce this. the format isn't a kdenlive project file.

[ddennedy]

I reproduced it in melt. I do not know if it is normal that Kdenlive structures the project in this manner, but the way this XML is structured defeats the avformat producer cache, which is necessary for constraining the number of open file handles and threads. MLT's multitrack object automatically sizes these to twice the number of tracks, which is 8 in this file. This is mentioned in the docs under Notes: https://mltframework.org/plugins/ProducerAvformat/#plugin-information
See about environment variable MLT_AVFORMAT_PRODUCER_CACHE. With a value of 16 it crashes but with 18 it succeeds.

Is there something weird or special about this project and the way it is structured? It is difficult for me to visualize it since it just crashes when opening in Kdenlive Flatpak. I am not a kdenlive developer; so, I am not setup to debug within that. Also, viewing the XML, I do not recognize Kdenlive's patterns. It has many more tractors and "black_track" producers than I am used to.

It also succeeds if I change the code to use 3 times the number of tracks, but that makes the apps use much more memory, which we'd rather avoid. As a workaround, you can try adding a blank track to the project.

[ddennedy]

Here is an interpretation of a small subset of the XML structure:

the main tractor (tractor32, a sequence) contains 8 tracks, one of them is tractor18:
	tractor18 has 2 video tracks: the first is playlist24, which has one item {f2664c91-5369-43de-befa-f870f3c90c10}
	{f2664c91-5369-43de-befa-f870f3c90c10} is a tractor (**ink-3**):
		tractor {f2664c91-5369-43de-befa-f870f3c90c10}  has 3 tracks:
		the first one is producer8, a black_track, and the second one is tractor14:
			tractor14 has 2 video-only tracks: the first is playlist25, which has one item {6e1c4c9d-ad76-418d-8c3f-b4e1d17d0aac}
				{6e1c4c9d-ad76-418d-8c3f-b4e1d17d0aac} is a tractor (**ink-3-scene**) with 3 tracks:
				the first is producer9, a black_track, and the second one is tractor12
					tractor12 has 2 video-only tracks: the first is playlist26, whose first item is chain0
					finally, chain0 is video file small.mp4 

It looks like Kdenlive is wrapping every clip in a tractor, a MLT object that embodies a multitrack timeline, and there are 3 levels of nested sequences. I do not know if that is safe in MLT. It seems risky to do and to understand, maintain, and debug.
To the user, I recommend to avoid creating multiple levels of nested sequences within Kdenlive.