[vlc-devel] [PATCH v2 2/2] mmal: Fix picture passing through mmal

[Julian Scheel]

Assign the picture pointer to mmal buffers user_data right before passing it
into mmal instead of doing it in mmal_picture_lock. This is necessary, because
the picture pointer used to call mmal_picture_lock points to the original
picture instance, while the picture handed to the plugins from
picture_pool_Get is a clone of the original picture. Assigning the picture in
user_data caused picture_Release to be called on the original instead of the
clone. Since commit 22e61f10 this is fatal as the pf_destroy pointer is not
pointing to picture_pool_ReleasePicture anymore.

Signed-off-by: Julian Scheel <julian at jusst.de>
---
Changes in v2:
- Set the user_data pointer in vout before sending to mmal core. Otherwise the
  vout might free the wrong picture pointer (non-pool).
---
 modules/hw/mmal/codec.c        | 2 +-
 modules/hw/mmal/deinterlace.c  | 1 +
 modules/hw/mmal/mmal_picture.c | 2 --
 modules/hw/mmal/vout.c         | 1 +
 4 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/hw/mmal/codec.c b/modules/hw/mmal/codec.c
index 75184c6..7d652f6 100644
--- a/modules/hw/mmal/codec.c
+++ b/modules/hw/mmal/codec.c
@@ -455,7 +455,6 @@ static int send_output_buffer(decoder_t *dec)
 
     if (sys->output_pool) {
         mmal_buffer_header_reset(buffer);
-        buffer->user_data = picture;
         buffer->alloc_size = sys->output->buffer_size;
         if (buffer_size < sys->output->buffer_size) {
             msg_Err(dec, "Retrieved picture with too small data block (%d < %d)",
@@ -475,6 +474,7 @@ static int send_output_buffer(decoder_t *dec)
         }
         buffer->data = p_sys->buffer->data;
     }
+    buffer->user_data = picture;
     buffer->cmd = 0;
 
     status = mmal_port_send_buffer(sys->output, buffer);
diff --git a/modules/hw/mmal/deinterlace.c b/modules/hw/mmal/deinterlace.c
index f7e2a2c..341927a 100644
--- a/modules/hw/mmal/deinterlace.c
+++ b/modules/hw/mmal/deinterlace.c
@@ -305,6 +305,7 @@ static int send_output_buffer(filter_t *filter)
     picture->format.i_frame_rate_base = filter->fmt_out.video.i_frame_rate_base;
 
     buffer = picture->p_sys->buffer;
+    buffer->user_data = picture;
     buffer->cmd = 0;
 
     mmal_picture_lock(picture);
diff --git a/modules/hw/mmal/mmal_picture.c b/modules/hw/mmal/mmal_picture.c
index d127c27..7ddd5b5 100644
--- a/modules/hw/mmal/mmal_picture.c
+++ b/modules/hw/mmal/mmal_picture.c
@@ -32,8 +32,6 @@ int mmal_picture_lock(picture_t *picture)
     picture_sys_t *pic_sys = picture->p_sys;
     MMAL_BUFFER_HEADER_T *buffer = pic_sys->buffer;
 
-    buffer->user_data = picture;
-
     int offset = 0;
     picture->p[0].p_pixels = buffer->data;
     for (int i = 1; i < picture->i_planes; i++) {
diff --git a/modules/hw/mmal/vout.c b/modules/hw/mmal/vout.c
index dc1a273..8c7bc1f 100644
--- a/modules/hw/mmal/vout.c
+++ b/modules/hw/mmal/vout.c
@@ -572,6 +572,7 @@ static void vd_display(vout_display_t *vd, picture_t *picture,
     if (!pic_sys->displayed || !sys->opaque) {
         buffer->cmd = 0;
         buffer->length = sys->input->buffer_size;
+        buffer->user_data = picture;
 
         status = mmal_port_send_buffer(sys->input, buffer);
         if (status == MMAL_SUCCESS)
-- 
2.6.0