h264 decoder: One too many unref of a codecframe
Submitted by Olivier Crête @ocrete
Link to original bug (#750754)
Description
The most obvious symptom is:
** (mmfd:10989): CRITICAL **: gst_video_codec_frame_unref: assertion 'frame->ref_count > 0' failed
With some interlaced H.264 streams, in the presence of packet loss (simulated with identity drop-probablity=0.01), the first field decoding fails in dpb_dump() (from gst_vaapi_decoder_decode->do_decode->do_decode_1->end_frame->decode_current_picture->dpb_add), this results in gst_vaapi_decoder_decode returning an error and gst_video_decoder_drop_frame() being called.
The problem is that before failing in dpb_bump(), the picture has been stored in a framestore which has been added to priv->prev_frames. And from prev_frames, find_first_field() retrieves it on the next frame and uses it as a base, which will cause it to push outputted by pushing it to gst_video_decoder_finish_frame.
This caues a problem, as when handle_frame is called, a single reference is given to the subclass, calling drop_frame() drops this reference... But calling finish_frame expects another reference!
I'm not sure how to solve that problem exactly.