Segmentation fault on .extract with some converted gif -> webp

[thefjhca]

Possible bug

Is this a possible bug in a feature of sharp, unrelated to installation?

• Running npm install sharp completes without error.
• Running node -e "require('sharp')" completes without error.

If you cannot confirm both of these, please open an installation issue instead.

Are you using the latest version of sharp?

• I am using the latest version of sharp as reported by npm view sharp dist-tags.latest.

If you cannot confirm this, please upgrade to the latest version and try again before opening an issue.

If you are using another package which depends on a version of sharp that is not the latest, please open an issue against that package instead.

What is the output of running npx envinfo --binaries --system --npmPackages=sharp --npmGlobalPackages=sharp?

System:
OS: Linux 6.5 Artix Linux
CPU: (32) x64 AMD Ryzen 9 5950X 16-Core Processor
Memory: 11.60 GB / 125.69 GB
Container: Yes
Shell: 5.2.15 - /bin/bash
Binaries:
Node: 21.0.0 - /usr/bin/node
npm: 10.2.1 - /usr/bin/npm
pnpm: 8.10.0 - /usr/bin/pnpm
npmPackages:
sharp: ^0.32.6 => 0.32.6

What are the steps to reproduce?

Convert animated .gif to animated .webp. Save and load into sharp again, then run .extract

What is the expected behaviour?

No segmentation fault

Please provide a minimal, standalone code sample, without other dependencies, that demonstrates this problem

await sharp('test.gif', {
animated: true,
}).extract({left: 0, top: 0, width: 50, height: 50}).toBuffer(); // no segfault

await sharp('test.gif', {
animated: true,
}).webp().extract({left: 0, top: 0, width: 50, height: 50}).webp().toBuffer(); // no segfault

const buffer = await sharp('test.gif', {
animated: true,
}).webp().toBuffer();

await sharp(buffer, {animated: true}).extract({left: 0, top: 0, width: 50, height: 50}).toBuffer(); // segfault

Please provide sample image(s) that help explain this problem

[lovell]

Thanks for reporting, I can reproduce this locally - here's the backtrace:

#0  __memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:265
#1  0x00007ffff4c633a3 in vips_region_copy (reg=0x7fffc00b1310, dest=0x7fffc4369730, r=0x7fffcf7fdd10, x=0, y=0) at ../libvips/iofuncs/region.c:1100
#2  0x00007ffff4c6b238 in vips_region_prepare_to_generate (reg=0x7fffc00b1310, dest=0x7fffc4369730, r=0x7fffcf7fdd10, x=0, y=0) at ../libvips/iofuncs/region.c:1756
#3  0x00007ffff4c6b5c7 in vips_region_prepare_to (reg=0x7fffc00b1310, dest=0x7fffc4369730, r=0x7fffc0000c90, x=0, y=0) at ../libvips/iofuncs/region.c:1865
#4  0x00007ffff4c5772a in wbuffer_work_fn (state=0x7fffc0000c30, a=0x7fffecaaf990) at ../libvips/iofuncs/sinkdisc.c:430
#5  0x00007ffff4c341c1 in vips_worker_work_unit (worker=0x7fffc43702b0) at ../libvips/iofuncs/threadpool.c:380
#6  0x00007ffff4c3429c in vips_thread_main_loop (a=0x7fffc43702b0, b=0x0) at ../libvips/iofuncs/threadpool.c:407
#7  0x00007ffff4c33505 in vips_threadset_work (pointer=0x7fffd001cd70) at ../libvips/iofuncs/threadset.c:134
#8  0x00007ffff4c32fc1 in vips_thread_run (data=0x7fffd001ce10) at ../libvips/iofuncs/thread.c:148
#9  0x00007ffff4940361 in g_thread_proxy (data=0x7fffd001ce30) at ../../../glib/gthread.c:831
#10 0x00007ffff788f6ba in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:444
#11 0x00007ffff791e0d0 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

It looks like attempting to read animated WebP images sequentially (i.e. top to bottom) from libwebp isn't always playing nicely with sharp's multi-page extract/join logic. This will relate to the change in v0.32.0 to default to sequential read where possible. Luckily there's a quick fix for this - commit 655da11 will be part of v0.33.0.

[thefjhca]

Updated to commit 655da11, issue still exists for me.
npmPackages:
sharp: git+https://github.com/lovell/sharp.git#gauge => 0.33.0-alpha.9

Probably I've installed it correctly (removed node_modules and installed from scratch). What I'm missing?

[lovell]

You'll need to add the --build-from-source flag or wait until the next pre-release.

[thefjhca]

Tried with npm install git+https://github.com/lovell/sharp.git#655da113c843769f4ceb481c5612b1a504c8f76d --build-from-source --verbose in clean packages.json, same segmentation fault

[lovell]

The gauge branch is still under active development so I recommend waiting until the next pre-release.

If you really want to try, you'll probably need to add a few other dependencies too e.g. npm install --save node-addon-api node-gyp @img/sharp-libvips-dev. When you build from source the node_modules/sharp/src/build directory is created, so if it's missing then prebuilt binaries are still being used.

[thefjhca]

Thanks for hint with build directory, now its working great ☺️

[lovell]

v0.33.0 is now available, thanks for reporting this.