Blackberry10 crash on avformat_find_stream_info

[Sacha]

Summary of the bug:
I noticed my device was randomly crashing in avformat_find_stream_info. The event was only reproducable on Blackberry10 (did not occur on Windows or Android).

I followed the codepath and determined that I was able to fix the crash by commenting out: ​https://github.com/FFmpeg/FFmpeg/blob/master/libavformat/utils.c#L2750

av_dict_set(options ? &options[i] : &thread_opt, "threads", "1", 0);

I followed it further in to the avcodec_open2 function where I determined the crash could be fixed by commenting out:
​https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/utils.c#L1181

av_dict_copy(&tmp, *options, 0);

Commenting out anything that tmp was used in did not help. It only seemed to occur from the av_dict_copy.
I was able to reproduce the crash using:

AVDictionary *foo = NULL; av_dict_copy(&foo, *options, 0);

My backtrace is uneventful as it doesn't seem to show anything from ffmpeg despite compiling with -g -O0: ​http://pastebin.com/jw2kdk4v

How to reproduce:

While playing back an audio or video in PPSSPP, the application crashes randomly from avformat_find_stream_info.
Using a recent ffmpeg-git built from github.com/hrydgard/ppsspp-ffmpeg-history

[Carl Eugen Hoyos]

How do you know where the crash happens (the backtrace you linked to does not tell).
Please post all relevant information here, do not use external resources (if possible).
Assuming this is not reproducible with ffmpeg (the application) - or is it? - could you post a minimal test case?

[Sacha]

I stepped through each line until I discovered the crash.
I put all the relevant information here.

I am running on a mobile platform and don't have any other ffmpeg frontend. If I did, the crash would also occur there as well as it is due to the avformat and avcodec modules and nothing to do with the front-end.

The test case I provided is the best I can do I am afraid. Do you own a Blackberry device? I may be able to automate the procedure.

[Carl Eugen Hoyos]

Please test if ffmpeg (the application) also allows to reproduce the crash. If it does, please provide a useful backtrace etc. as explained on ​http://ffmpeg.org/bugreports.html

And please confirm that this crash is reproducible with current FFmpeg git head from ​git://source.ffmpeg.org/ffmpeg.git - nothing else is supported (sorry for not realizing this earlier).

[Michael Niedermayer]

which asm instruction crashes, what are the register values ?

[Carl Eugen Hoyos]

Please reopen this ticket if you can add the missing information.

Allow me to clarify that crashes are always important problems but without any additional information, developers are unable to look into this issue or fix it. Following ​http://ffmpeg.org/bugreports.html is an easy way of reporting the necessary information.