AVIF pictures larger than one AV1 tile can be read, with gav1d 0.2.6

CHANGELOG.md

@@ -14,6 +14,17 @@ because it turns other people's test suites red.
 
 ## [Unreleased]
 
+### Breaking
+
+- **Some AVIF pictures and WebM and MP4 films are not byte for byte what
+  0.5.0 wrote.** The AV1 encoder underneath, gav1d, is now 0.2.6. Where the
+  right or bottom edge of a picture cuts through a block, the encoder now
+  predicts that block's colour the way every decoder does. Before, a viewer
+  showed those pixels along the edge up to 7 of 255 off from the picture that
+  was meant. Only pixels along those edges change, and many files do not
+  change at all. A test that compares a file with one 0.5.0 generated from the
+  same request can fail.
+
 ### Added
 
 - **A new format: `otlp`, OpenTelemetry traces and logs as OTLP JSON.**
@@ -145,6 +156,13 @@ because it turns other people's test suites red.
 
 ### Fixed
 
+- **An AVIF picture wider than 4096 px, or larger than 4096 x 2304 px, opens
+  now.** Every release since AVIF arrived in 0.3.0 wrote such a picture as a
+  file no viewer reads: Pillow, ImageMagick and libaom all refused it as
+  corrupt, and tfg said nothing. The picture is now cut into the tiles AV1
+  requires at that size, and all three read it. A picture of 8000 x 5000 px is
+  also written about three times faster on a machine with several cores.
+  Smaller pictures and films were never affected.
 - **A damaged file no longer claims to carry its label.** Its manifest entry
   said `label_embedded: true`, although the damage comes after the label is
   written and can overwrite it. On a text file, `zero-head` zeroes the start of

THIRD-PARTY-NOTICES.md

@@ -121,7 +121,7 @@ Source: <https://go.googlesource.com/text>
 
 ## github.com/gen2brain/gav1d
 
-Version 0.2.5. Codes and reads AV1, which is what the picture inside an
+Version 0.2.6. Codes and reads AV1, which is what the picture inside an
 AVIF is. It is written in Go and assembly with no C in it and no module
 of its own behind it, so it brings nothing else along.
 

go.mod

@@ -90,7 +90,7 @@ go 1.27.4
 
 require (
 	fyne.io/fyne/v2 v2.8.2
-	github.com/gen2brain/gav1d v0.2.5
+	github.com/gen2brain/gav1d v0.2.6
 	github.com/gen2brain/jxl v0.2.0
 	github.com/goccy/go-yaml v1.19.2
 	github.com/nicksnyder/go-i18n/v2 v2.7.0

go.sum

@@ -22,8 +22,8 @@ github.com/fyne-io/image v0.1.1 h1:WH0z4H7qfvNUw5l4p3bC1q70sa5+YWVt6HCj7y4VNyA=
 github.com/fyne-io/image v0.1.1/go.mod h1:xrfYBh6yspc+KjkgdZU/ifUC9sPA5Iv7WYUBzQKK7JM=
 github.com/fyne-io/oksvg v0.2.1-0.20260918172519-a9af55fa95d9 h1:owsdpq6a2KhaAA/hoHGQmFM7kOgKo3srXZVGnbEUzr0=
 github.com/fyne-io/oksvg v0.2.1-0.20260918172519-a9af55fa95d9/go.mod h1:dJ9oEkPiWhnTFNCmRgEze+YNprJF7YRbpjgpWS4kzoI=
-github.com/gen2brain/gav1d v0.2.5 h1:Zg5/DE1JBdf8kxZqIvNo2ZEizF9DVF9jdPTAKJQZbOY=
-github.com/gen2brain/gav1d v0.2.5/go.mod h1:ReFKjHq7pvRhEk+pgRPAo9gOlcrf51sdzVcAbbX7e0E=
+github.com/gen2brain/gav1d v0.2.6 h1:7TSkrWTdE22k5Ul7vYZML7Nu80gNW6OovV7FSCITSE0=
+github.com/gen2brain/gav1d v0.2.6/go.mod h1:ReFKjHq7pvRhEk+pgRPAo9gOlcrf51sdzVcAbbX7e0E=
 github.com/gen2brain/jxl v0.2.0 h1:cXSQnfbcC0JGFzaI344VzPMbe7mh6rYc0tjPcBUsE4U=
 github.com/gen2brain/jxl v0.2.0/go.mod h1:VjJHRai/8I8Es01mULqyiOihRBOjJr1Zo+NoN/MyIwo=
 github.com/go-gl/glfw/v3.4/glfw v0.1.0-pre.2 h1:ez76TQInhkDIMobWbOFcPJw6FeB7coXRAVZpKwF8NBg=

internal/format/avif/avif.go

@@ -76,6 +76,12 @@ const (
 	// Measured on 2026-08-29 with the encoder that is actually here: 1080p
 	// costs 16 MB and 266 ms, 4K costs 63 MB and 1.06 s, 8K costs 253 MB and
 	// 4.7 s. All of them encode, none of them fail.
+	//
+	// What nobody did then was decode them. Up to gav1d v0.2.5 a picture wider
+	// than 4096 px or past 4096x2304, 8K among them, came out as a file no
+	// decoder reads, and v0.2.6 codes it in tiles
+	// (TestAnAVIFLargerThanOneAV1TileSurvivesItsReferenceTool,
+	// docs/GAV1D-026-2026-11-11.md).
 	maxPixels = 40_000_000
 
 	// minimumBytes is the smallest AVIF this generator produces, and it is one

internal/format/mp4/mp4.go

@@ -96,7 +96,12 @@ type generator struct{}
 // 904), the sample lengths and the second pass's crew the difference -
 // and 1241 with one object allocated per frame, the defect the ceiling
 // exists for. 1024 sits between the two.
-func (generator) AllocCeiling() int64 { return 1024 }
+//
+// Raised to 1536 on 2026-11-11 with WebM's, by the owner's decision and for
+// WebM's reason, gav1d v0.2.6 allocating more a call. The default film is
+// 1398 to 1400 objects at one, four and sixteen threads, and one object a
+// frame takes it to 1698 to 1701 (docs/GAV1D-026-2026-11-11.md).
+func (generator) AllocCeiling() int64 { return 1536 }
 
 func (generator) Plan(r format.Request) (format.Plan, error) {
 	need := func(st video.Stream) int64 { return newLayout(st).need() }

internal/format/rtf/settings.go

@@ -101,7 +101,7 @@ func ownProperties() []format.Property {
 			"codepage writes only the code page bytes, and the emoji still as numbers, since no code page holds them. " +
 			"literal writes the question mark as a plain character. " +
 			"LibreOffice, Tika and the RichEdit control of Windows read all four. " +
-			"pandoc shows codepage text in the wrong letters and drops the character after every letter written literal, and pandoc 3.1 and 3.7 drop the emoji in all four. " +
+			"pandoc shows codepage text in the wrong letters. pandoc before 3.13 also drops the character after every letter written literal, and pandoc 3.1 and 3.7 drop the emoji in all four. " +
 			"striprtf returns an emoji as two halves, which Python refuses to write as UTF-8.",
 	}, {
 		Name: Elements, Kind: format.PropertyChoice,

internal/format/video/settings.go

@@ -41,12 +41,14 @@ const (
 	maxQuality     = 100
 	defaultQuality = 60
 
-	// The picture's bounds are AV1's, not the encoder's. gav1d codes one tile
-	// correctly and no more - a larger frame comes out of it with a header
-	// that announces several tiles over the data of one (measured 2026-10-06,
-	// docs/REVIEW-165-2026-10-06.md), and until 2026-10-07 that held the
-	// picture to 4096x2304. A picture is cut into tiles here now (grid.go) and
-	// every tile is within one of gav1d's, so the bound left is the format's:
+	// The picture's bounds are AV1's, not the encoder's. gav1d up to v0.2.5
+	// coded one tile correctly and no more - a larger frame came out of it
+	// with a header that announced several tiles over the data of one
+	// (measured 2026-10-06, docs/REVIEW-165-2026-10-06.md), and until
+	// 2026-10-07 that held the picture to 4096x2304. A picture is cut into
+	// tiles here now (grid.go) and every tile is within one of gav1d's - still
+	// so with v0.2.6, which codes several, because a tile no picture changes
+	// is then coded once a film - so the bound left is the format's:
 	// maxPixels is the largest picture an AV1 level describes, 8192 by 4352
 	// (MaxPicSize of the 6.x levels, annex.a.levels.md lines 89-92). A larger
 	// one could declare no level but the maximum parameters one, which a

internal/format/video/still.go

@@ -33,9 +33,10 @@ type tileCoded struct {
 // which every tile of one frame has to be: gav1d writes them from the
 // quantizer alone (gav1d v0.2.5, av1/encode_hdr.go, writeFrameHdr - the loop
 // filter off, no delta, no tx_mode_select), measured on 2026-10-06 as one
-// suffix per quantizer across 27 pictures of 9 sizes. A later gav1d that chose
-// them from the picture would break that, and the frame is refused rather
-// than written with one tile's header over another's data.
+// suffix per quantizer across 27 pictures of 9 sizes. v0.2.6 changed only
+// tile_info in that function (docs/GAV1D-026-2026-11-11.md). A later gav1d
+// that chose them from the picture would break that, and the frame is refused
+// rather than written with one tile's header over another's data.
 func (t tileCoded) sameHeader(o tileCoded) bool {
 	if t.to-t.from != o.to-o.from {
 		return false

internal/format/webm/webm.go

@@ -102,7 +102,14 @@ type generator struct{}
 // ceiling exists for, takes it to 1177. 1024 sits between the two, as
 // 512 sat between 474 and 698 (docs/WEBM-WYDAJNOSC-2026-10-06.md
 // section 10).
-func (generator) AllocCeiling() int64 { return 1024 }
+//
+// Raised to 1536 on 2026-11-11 by the owner's decision, with gav1d v0.2.6,
+// which no longer reserves its entropy coder's buffer up front and grows it
+// instead: 36 to 57 objects a call where v0.2.5 made 21 to 22
+// (tools/probes/videotiles/allocs, docs/GAV1D-026-2026-11-11.md). The
+// default film is 1341 to 1350 objects at one, four and sixteen threads, and
+// one object a frame takes it to 1634 to 1644. 1536 sits between the two.
+func (generator) AllocCeiling() int64 { return 1536 }
 
 func (generator) Plan(r format.Request) (format.Plan, error) {
 	need := func(st video.Stream) int64 { return newLayout(st).boundBytes() + minVoid }

internal/guard/avifwide_test.go

@@ -0,0 +1,109 @@
+package guard
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/gen2brain/gav1d/avif"
+
+	"github.com/donislawdev/TestingFilesGenerator/internal/format"
+	"github.com/donislawdev/TestingFilesGenerator/internal/oracle"
+)
+
+// An AVIF picture larger than one AV1 tile is coded as tiles, and it is read
+// back whole - by the specification's tile_info, by gav1d's own decoder and
+// by the format's reference tool.
+//
+// AV1 holds a tile to 4096 px across and to 4096x2304 px in area
+// (06.bitstream.syntax.md lines 1176-1192), so a picture past either has to be
+// coded as several. gav1d up to v0.2.5 wrote such a picture's tile_info as
+// several tiles over the data of one (docs/REVIEW-165-2026-10-06.md), and
+// this format takes pictures to 16384 px and 40 megapixels - so every AVIF
+// wider than 4096 px or past that area was a file no decoder reads. Pillow,
+// libaom and ImageMagick refused all four such sizes measured on 2026-11-11,
+// and read them once gav1d v0.2.6 coded them in tiles
+// (docs/GAV1D-026-2026-11-11.md). Films were never hit:
+// they cut a picture into tiles themselves (internal/format/video, grid.go).
+//
+// The two pictures are the two ways tile_info cuts one: a width a few pixels
+// past one column, and an area one superblock row past the limit at the full
+// width of a tile, which is cut into rows. Each is held to its tiles read
+// from the file first, so this guard knows it asked about a picture of tiles
+// rather than assuming it. A missing reference tool skips that part loudly.
+func TestAnAVIFLargerThanOneAV1TileSurvivesItsReferenceTool(t *testing.T) {
+	d, err := format.Get("avif")
+	if err != nil {
+		t.Fatal(err)
+	}
+	checker, known := oracle.For(d.Oracle)
+	if !known {
+		t.Fatalf("avif declares the oracle %q and nothing implements it", d.Oracle)
+	}
+	for _, c := range []struct {
+		width, height int
+		cols, rows    int
+	}{
+		{width: 4100, height: 64, cols: 2, rows: 1},
+		{width: 4096, height: 2305, cols: 1, rows: 2},
+	} {
+		name := strconv.Itoa(c.width) + "x" + strconv.Itoa(c.height)
+		plan, err := d.Generator.Plan(format.Request{Bytes: 4 << 20, Seed: goldenSeed, Label: true,
+			Properties: map[string]string{"width": strconv.Itoa(c.width), "height": strconv.Itoa(c.height)}})
+		if err != nil {
+			t.Fatalf("%s: planning failed: %v", name, err)
+		}
+		var buf bytes.Buffer
+		if err := d.Generator.Write(context.Background(), &buf, plan); err != nil {
+			t.Fatalf("%s: writing failed: %v", name, err)
+		}
+		b := buf.Bytes()
+
+		mdat, err := mp4Child(b, "mdat")
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		frame, _, err := frameOBU(mdat)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		// A still picture's frame header has three bits ahead of tile_info:
+		// disable_cdf_update, allow_screen_content_tools and
+		// render_and_frame_size_different (internal/format/video, still.go).
+		tiles, err := readFilmTiles(frame, 3, c.width, c.height)
+		if err != nil {
+			t.Errorf("%s: the picture's tiles do not read back from the file: %v", name, err)
+			continue
+		}
+		if len(tiles.rects) != c.cols*c.rows {
+			t.Fatalf("%s: %d tiles read back where tile_info derives %d columns and %d rows - the case no longer asks about a picture of tiles",
+				name, len(tiles.rects), c.cols, c.rows)
+		}
+
+		m, err := avif.Decode(bytes.NewReader(b))
+		if err != nil {
+			t.Errorf("%s: gav1d's decoder refused it: %v", name, err)
+			continue
+		}
+		if got := m.Bounds(); got.Dx() != c.width || got.Dy() != c.height {
+			t.Errorf("%s: gav1d's decoder read a %dx%d picture", name, got.Dx(), got.Dy())
+		}
+
+		path := filepath.Join(t.TempDir(), name+".avif")
+		if err := os.WriteFile(path, b, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		res := checker.Check(path)
+		switch {
+		case !res.Available:
+			t.Logf("SKIPPED %s: %s is not installed, so only the tiles and gav1d's decoder were asked", name, checker.Name)
+		case res.Err != nil:
+			t.Errorf("%s: %v", name, res.Err)
+		default:
+			t.Logf("%s: %d tiles, %s accepted it - %s", name, len(tiles.rects), checker.Name, firstLine(res.Output))
+		}
+	}
+}

internal/guard/film_test.go

@@ -490,7 +490,7 @@ func TestEveryFrameOfAFilmSurvivesItsReferenceTool(t *testing.T) {
 // before coding, and the pictures that used to be refused for not fitting one
 // tile are not.
 //
-// Until 2026-10-07 the bound was one AV1 tile, 4096x2304, because gav1d codes
+// Until 2026-10-07 the bound was one AV1 tile, 4096x2304, because gav1d coded
 // one tile correctly and no more (docs/REVIEW-165-2026-10-06.md). A picture
 // is cut into tiles of at most that now, and the bound is AV1's own: 8192 by
 // 4352, the 6.x levels' MaxPicSize, with either side up to 16384 (the owner's

internal/guard/mutation/entries.py

@@ -13695,7 +13695,8 @@
     ),
     (
         # One object per frame, the defect the film's own allocation ceiling
-        # sits below: measured at 698 objects against a ceiling of 512.
+        # sits below: measured at 698 objects against a ceiling of 512, and
+        # with gav1d v0.2.6 at 1634 to 1644 against 1536.
         "a film allocates a block header for every frame it writes",
         "internal/format/webm/webm.go",
         "		out.write(block[:])",
@@ -14022,7 +14023,8 @@
     ),
     (
         # One object per frame, the defect the film's own allocation ceiling
-        # sits below: measured at 1241 objects against a ceiling of 1024.
+        # sits below: measured at 1241 objects against a ceiling of 1024, and
+        # with gav1d v0.2.6 at 1698 to 1701 against 1536.
         "an MP4 allocates a copy of every frame it writes",
         "internal/format/mp4/mp4.go",
         "			o.write(frame[t.SampleAt(i)])",
@@ -17705,4 +17707,18 @@
         "fmt.Fprintf(out, \"  extension  %s\\n\", d.Extension)",
         "TestTheFormatsCommandSaysWhichSettingGivesWhichEnding",
     ),
+    (
+        "pandoc's version line is read only without the .exe Windows prints, so pandoc 3.13 there is a version nobody knows",
+        'internal/oracle/rtfscripts.go',
+        '`(?m)^pandoc(?:\\.exe)? (\\d+)\\.(\\d+)`',
+        '`(?m)^pandoc (\\d+)\\.(\\d+)`',
+        'TestThePandocVersionDecidesWhatALiteralDocumentReadsAs',
+    ),
+    (
+        "pandoc's minor version is read from the major's digits, so 3.13 reads as 3.3 and is held to the old reading of literal",
+        'internal/oracle/rtfscripts.go',
+        'minor, errMinor := strconv.Atoi(m[2])',
+        'minor, errMinor := strconv.Atoi(m[1])',
+        'TestThePandocVersionDecidesWhatALiteralDocumentReadsAs',
+    ),
 ]

internal/guard/mutationcoverage_test.go

@@ -136,6 +136,11 @@ var notProvenByMutation = map[string]bool{
 // "proven another way" are different states and lumping them together would
 // send a later session to re-prove what is already proven.
 var provenByProbe = map[string]string{
+	// What breaks it lives in a module, not in a file of this repository, so
+	// no mutation of this tree reaches it - the dependency it was written
+	// against is the break.
+	"TestAnAVIFLargerThanOneAV1TileSurvivesItsReferenceTool": "broken on 2026-11-11 by gav1d v0.2.5, go.mod as it stood before v0.2.6: both pictures went red saying tile_start_and_end_present_flag is set in an OBU_FRAME, " +
+		"the tile_info of several tiles read over the data of one. With v0.2.6 both read back as 2 tiles, gav1d's decoder read them whole and Pillow accepted them (docs/GAV1D-026-2026-11-11.md).",
 	// Runs only in the CI job that has the Collector, so a mutation job without
 	// one would meet a skip. What the guard adds to the structural check is the
 	// oracle itself, and the oracle was handed three files it has to refuse.