Commit 86b57d5371 for aom

commit 86b57d5371989adf27eb160342cf62da89182a11
Author: Yunqing Wang <yunqingwang@google.com>
Date:   Mon Jun 15 12:39:12 2026 -0700

    Fix double-free bug in MT worker data allocation

    The bug was fixed by enforcing the deallocation of MT worker data while
    an error occurred during encoding of the previous frame.

    The fix was verified by a test built with ASAN.

    BUG=aomedia:513342555

    Change-Id: I36dacdba445b2276c1c78693987dcc24cd108612

diff --git a/av1/encoder/ethread.c b/av1/encoder/ethread.c
index 71cd41323b..d46b3ee1a7 100644
--- a/av1/encoder/ethread.c
+++ b/av1/encoder/ethread.c
@@ -1569,6 +1569,19 @@ static inline void prepare_enc_workers(AV1_COMP *cpi, AVxWorkerHook hook,
                                        int num_workers) {
   MultiThreadInfo *const mt_info = &cpi->mt_info;
   AV1_COMMON *const cm = &cpi->common;
+
+  // If a previous frame's encode raised an error after this function ran,
+  // accumulate_counters_enc_workers() was skipped via longjmp and the mb
+  // buffers (including cpi->td.mb) were never freed. Free them here so the
+  // shallow copy of cpi->td.mb below cannot leave a worker's mb aliasing
+  // cpi->td.mb's heap allocations on a subsequent partial-allocation failure
+  // (which would double-free in encoder_destroy()).
+  for (int i = num_workers - 1; i >= 0; i--) {
+    EncWorkerData *const thread_data = &mt_info->tile_thr_data[i];
+    ThreadData *const td = (i == 0) ? &cpi->td : thread_data->original_td;
+    if (td) av1_dealloc_mb_data(&td->mb, av1_num_planes(cm));
+  }
+
   for (int i = num_workers - 1; i >= 0; i--) {
     AVxWorker *const worker = &mt_info->workers[i];
     EncWorkerData *const thread_data = &mt_info->tile_thr_data[i];