Closed Bug 1127115 Opened 9 years ago Closed 9 years ago

crash in abort | abort | __android_log_assert | stagefright::SampleTable::setSampleToChunkParams(__int64, unsigned int)

Categories

(Core :: Audio/Video, defect)

Product:
Core
Component:
Audio/Video
Platform:
x86
Windows NT
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla38
Tracking Flags:
Tracking Status
firefox36 + verified
firefox37 --- fixed
firefox38 --- fixed

People

(Reporter: away, Assigned: eflores)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

1127115.patch
1.35 KB, patch
ajones
: review+
Sylvestre
: approval-mozilla-aurora+
Sylvestre
: approval-mozilla-beta+
Details | Diff | Splinter Review 
[Tracking Requested - why for this release]: This is a top crash on 36 beta.

This bug was filed from the Socorro interface and is 
report bp-4d62b602-1604-41ee-83b0-c0dfd2150121.
=============================================================

CHECK(U32_AT(buffer) >= 1)
http://hg.mozilla.org/releases/mozilla-beta/annotate/521859f9eae2/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp#l260

The top URL by far is http://www.microsoft.com/en-us/outlook-com/ which currently contains a video.
Forgot to mention: This happens almost exclusively on Win7
Top crash, tracking!
tracking-firefox36: ? → +
Attached patch 1127115.patch — — Splinter Review 
I can't reproduce this anywhere. I suspect a malformed MP4 that has now been fixed.

We should at least make the assertion non-fatal. It is trivial to construct an MP4 that would kill the browser.
Attachment #8556771 - Flags: review?(ajones) → review+
Comment on attachment 8556771 [details] [diff] [review]
1127115.patch

Approval Request Comment
[Feature/regressing bug #]: MP4 playback
[User impact if declined]: crashing on some (possibly malformed) MP4s
[Describe test coverage new/current, TreeHerder]: Nope
[Risks and why]: None
[String/UUID change made/needed]: None
Attachment #8556771 - Flags: approval-mozilla-beta?
Attachment #8556771 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/ae4c8ecf7145
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Attachment #8556771 - Flags: approval-mozilla-beta?
Attachment #8556771 - Flags: approval-mozilla-beta+
Attachment #8556771 - Flags: approval-mozilla-aurora?
Attachment #8556771 - Flags: approval-mozilla-aurora+
I can confirm this is gone from 36.0b6.
status-firefox36: fixed → verified
Adding the Mac specific signature to the crash field.
Crash Signature: [@ abort | abort | __android_log_assert | stagefright::SampleTable::setSampleToChunkParams(__int64, unsigned int)] → [@ abort | abort | __android_log_assert | stagefright::SampleTable::setSampleToChunkParams(__int64, unsigned int)] [@ __android_log_assert | stagefright::SampleTable::setSampleToChunkParams(long long, unsigned long)]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: