1127115 - crash in abort | abort | __android_log_assert | stagefright::SampleTable::setSampleToChunkParams(__int64, unsigned int)

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[(Away)]

[Tracking Requested - why for this release]: This is a top crash on 36 beta.

This bug was filed from the Socorro interface and is 
report bp-4d62b602-1604-41ee-83b0-c0dfd2150121.
=============================================================

CHECK(U32_AT(buffer) >= 1)
http://hg.mozilla.org/releases/mozilla-beta/annotate/521859f9eae2/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp#l260

The top URL by far is http://www.microsoft.com/en-us/outlook-com/ which currently contains a video.

Comment 1

[(Away)]

Forgot to mention: This happens almost exclusively on Win7

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Top crash, tracking!

Comment 3

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

Attachment: 1127115.patch

I can't reproduce this anywhere. I suspect a malformed MP4 that has now been fixed.

We should at least make the assertion non-fatal. It is trivial to construct an MP4 that would kill the browser.

Comment 4

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ae4c8ecf7145

Comment 5

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

Comment on attachment 8556771 [details] [diff] [review]
1127115.patch

Approval Request Comment
[Feature/regressing bug #]: MP4 playback
[User impact if declined]: crashing on some (possibly malformed) MP4s
[Describe test coverage new/current, TreeHerder]: Nope
[Risks and why]: None
[String/UUID change made/needed]: None

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ae4c8ecf7145

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/cad51d6a9b41
https://hg.mozilla.org/releases/mozilla-beta/rev/c76f32421541

Comment 8

[Robert Kaiser]

I can confirm this is gone from 36.0b6.

Comment 9

[Marcia Knous [:marcia]]

Adding the Mac specific signature to the crash field.