[ffmpeg regression] hwdec=vaapi with intel-media-va-driver causes mpv to crash with some videos

Reproduce the crash with mpv.conf setting hwdec=vaapi and the linked YouTube sample, then inspect the av1 decoder path identified in src/libavcodec/av1dec.c and the attached backtrace. Compare behavior with the listed VA-API drivers and verify that hardware decoding no longer segfaults on the reproducer.

mpv Information

mpv 0.38.0 Copyright © 2000-2024 mpv/MPlayer/mplayer2 projects
libplacebo version: v7.349.0
FFmpeg version: 7.0.2-3
FFmpeg library versions:
   libavutil       59.8.100
   libavcodec      61.3.100
   libavformat     61.1.100
   libswscale      8.1.100
   libavfilter     10.1.100
   libswresample   5.1.100

Other Information

- Linux version: Debian GNU/Linux trixie/sid
- Kernel Version: ~ 6.x - 6.10.9-amd64
- GPU Model: TigerLake-LP GT2 [Iris Xe Graphics]
- Mesa/GPU Driver Version: Mesa ~ 23.0 - 24.3-devel
- Window Manager and Version: GNOME Shell
- Source mpv: Debian package
- Introduced in version: unsure

Reproduction Steps

First, I assume this bug will be directly ffmpeg related, but only reproducer is mpv for me, so I would like to document it somewhere and go from here. As you can see, the issue is visible at least in two forums on the internet [1] [2].

Possible workaround is to use intel-media-va-driver-non-free, but since this is regression, mpv crashes, and I remember it worked ~ 1 year ago, I believe it's worth addressing without forcing users to find non-free driver version.

Setup:

apt install intel-media-va-driver  # default installed, version 24.2.5+dfsg1-1

$ cat ~/.config/mpv/mpv.conf
hwdec=vaapi

Reproducer:

1. mpv https://www.youtube.com/watch?v=zCLOJ9j1k2Y (from [1])
2. locally I have multiple downloaded videos, which yield this issue (small resolution)

[1] https://www.linux.org.ru/forum/desktop/17491102
[2] https://askubuntu.com/questions/1447790/mpv-crash-in-ubuntu-22-10

Expected Behavior

Video will play

Actual Behavior

 (+) Video --vid=1 (*) (av1 7680x4320 59.940fps)
 (+) Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz)
File tags:
 Uploader: _REMOVED_
 Channel_URL: _REMOVED_
[ffmpeg/video] av1: Failed to end picture decode issue: 23 (internal decoding error).
[ffmpeg/video] av1: HW accel end frame fail.
Error while decoding frame (hardware decoding)!
[ffmpeg/video] av1: Failed to end picture decode issue: 23 (internal decoding error).
[ffmpeg/video] av1: HW accel end frame fail.
Error while decoding frame (hardware decoding)!
[1]    449537 segmentation fault

Thread 1 "mpv" received signal SIGSEGV, Segmentation fault.
0x00007ffff6bdf20c in skip_mode_params (s=0x555555972340) at src/libavcodec/av1dec.c:283
warning: 283	src/libavcodec/av1dec.c: No such file or directory
(gdb) bt
#0  0x00007ffff6bdf20c in skip_mode_params (s=0x555555972340) at src/libavcodec/av1dec.c:283
#1  get_current_frame (avctx=<optimized out>) at src/libavcodec/av1dec.c:1288
#2  av1_receive_frame_internal (avctx=<optimized out>, frame=<optimized out>) at src/libavcodec/av1dec.c:1396
#3  av1_receive_frame (avctx=<optimized out>, frame=<optimized out>) at src/libavcodec/av1dec.c:1554
#4  0x00007ffff6cce932 in decode_receive_frame_internal (avctx=avctx@entry=0x5555559b0f00, frame=0x55555599bb40) at src/libavcodec/decode.c:598
#5  0x00007ffff6ccf094 in avcodec_send_packet (avctx=0x5555559b0f00, avpkt=0x5555559a1080) at src/libavcodec/decode.c:700
#6  0x0000555555654f97 in ??? ()
#7  0x00005555555e7529 in ??? ()
#8  0x00005555555f02cd in ??? ()
#9  0x00005555555f0498 in ??? ()
#10 0x00005555555f08a1 in ??? ()
#11 0x000055555563ded5 in ??? ()
#12 0x0000555555637a31 in ??? ()
#13 0x0000555555631696 in ??? ()
#14 0x0000555555631bc9 in ??? ()
#15 0x00005555556329a0 in ??? ()
#16 0x00007ffff2f7bd68 in __libc_start_call_main (main=main@entry=0x5555555a4f70 <main>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdd18) at ../sysdeps/nptl/libc_start_call_main.h:58
#17 0x00007ffff2f7be25 in __libc_start_main_impl
    (main=0x5555555a4f70 <main>, argc=2, argv=0x7fffffffdd18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdd08) at ../csu/libc-start.c:360
#18 0x00005555555a4fa1 in _start ()

Log File

output.txt

Sample Files

https://www.youtube.com/watch?v=zCLOJ9j1k2Y

I carefully read all instruction and confirm that I did the following:

• I tested with the latest mpv version to validate that the issue is not already fixed.
• I provided all required information including system and mpv version.
• I produced the log file with the exact same set of files, parameters, and conditions used in "Reproduction Steps", with the addition of --log-file=output.txt.
• I produced the log file while the behaviors described in "Actual Behavior" were actively observed.
• I attached the full, untruncated log file.
• I attached the backtrace in the case of a crash.