1053124 - [FireFox OS] Browser crashes in mp4_demuxer with B2G PDM pref on.

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Blake Wu [:bwu][:blakewu]]

STR:
1. Set Media.fragmented-mp4.gonk.enabled and media.fragmented-mp4.exposed true
2. Go to http://people.mozilla.org/~cpearce/avatar.mp4

Back Trace:  
#0  mp4_demuxer::Index::ConvertByteRangesToTimeRanges (this=0x0, aByteRanges=..., aTimeRanges=0xbebca8b0) at ../../../gecko/media/libstagefright/binding/Index.cpp:93
#1  0xb4f5639e in mp4_demuxer::MP4Demuxer::ConvertByteRangesToTime (this=0xb33c6e40, aByteRanges=..., aIntervals=0xbebca8b0)
    at ../../../gecko/media/libstagefright/binding/mp4_demuxer.cpp:222
#2  0xb588be82 in mozilla::MP4Reader::NotifyDataArrived (this=0xb3f8bca0, aBuffer=<optimized out>, aLength=<optimized out>, aOffset=80191)
    at ../../../../gecko/content/media/fmp4/MP4Reader.cpp:754
#3  0xb584bc88 in mozilla::MediaDecoderStateMachine::NotifyDataArrived (this=0xb3575400, aBuffer=<optimized out>, aLength=<optimized out>, aOffset=80191)
    at ../../../gecko/content/media/MediaDecoderStateMachine.cpp:1427
#4  0xb585c726 in mozilla::ChannelMediaResource::CopySegmentToCache (aInStream=<optimized out>, aClosure=0xbebca960, 
    aFromSegment=0xb319b008 "\237\254\376 \230\260\331\021<\274\257\232\207\273\261\211\021\374\237\353ģ\374*\212Вr\315&o\343\214\363\330\367\377\240\177\064f\r\304\003\376\262\242>E\324QT\367\274^z\322\020t\362wc\321S\276\235N\212\347+\227\374[\226\373\063=\310R\266\335\332\347\024ʭbh\262\375\214\244\330_W\305\033:\347\214`D\341QM<\v\214l\253ǡ\215e\224'\345\254\304د>\020\035\177\301W\023)\224=\265\vz\322[\260\204\275a\v)\212\300\205y\346us\372\030ɓ-\026Ƭ\001\234\267\n\261\224N\324\032\265\264b\032|\301l\243\266\360\334\064v;\231\355\035k\n<6M\v", aToOffset=<optimized out>, aCount=66624, aWriteCount=0xbebca95c) at ../../../gecko/content/media/MediaResource.cpp:507
#5  0xb4f81290 in ReadSegments (aResult=0xbebca95c, aCount=<optimized out>, aClosure=<optimized out>, aWriter=<optimized out>, this=0xb3120c10)
    at ../../../gecko/xpcom/io/nsStringStream.cpp:234
#6  nsStringInputStream::ReadSegments (this=0xb3120c10, aWriter=<optimized out>, aClosure=<optimized out>, aCount=<optimized out>, aResult=0xbebca95c)
    at ../../../gecko/xpcom/io/nsStringStream.cpp:214
#7  0xb584e41c in mozilla::ChannelMediaResource::OnDataAvailable (this=<optimized out>, aRequest=<optimized out>, aStream=0xb3120c10, aCount=<optimized out>)
    at ../../../gecko/content/media/MediaResource.cpp:545
#8  0xb5839374 in mozilla::dom::MediaDocumentStreamListener::OnDataAvailable (this=<optimized out>, request=<optimized out>, ctxt=<optimized out>, inStr=<optimized out>, 
    sourceOffset=80191, count=66624) at ../../../../../gecko/content/html/document/src/MediaDocument.cpp:87
#9  0xb52952bc in nsDocumentOpenInfo::OnDataAvailable (this=<optimized out>, request=<optimized out>, aCtxt=<optimized out>, inStr=<optimized out>, sourceOffset=80191, count=66624)
    at ../../../gecko/uriloader/base/nsURILoader.cpp:306
#10 0xb5031228 in mozilla::net::HttpChannelChild::OnTransportAndData (this=0xb3574c00, channelStatus=<optimized out>, transportStatus=<optimized out>, progress=146815, 
    progressMax=@0xbebcab78, data=..., offset=@0xbebcab80, count=@0xbebcab6c) at ../../../../gecko/netwerk/protocol/http/HttpChannelChild.cpp:489
#11 0xb50317da in mozilla::net::HttpChannelChild::RecvOnTransportAndData (this=0xb3574c00, channelStatus=@0xbebcab64, transportStatus=@0xbebcab68, progress=@0xbebcab70, 
    progressMax=@0xbebcab78, data=..., offset=@0xbebcab80, count=@0xbebcab6c) at ../../../../gecko/netwerk/protocol/http/HttpChannelChild.cpp:405
#12 0xb5136500 in mozilla::net::PHttpChannelChild::OnMessageReceived (this=0xb3574c00, __msg=<optimized out>) at PHttpChannelChild.cpp:575
#13 0xb5114ad8 in mozilla::dom::PContentChild::OnMessageReceived (this=0xb6b51418, __msg=...) at PContentChild.cpp:3964
#14 0xb50d14e2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0xb6b51448, aMsg=...) at ../../../gecko/ipc/glue/MessageChannel.cpp:1222
#15 0xb50d6592 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=<optimized out>) at ../../../gecko/ipc/glue/MessageChannel.cpp:1087
#16 0xb4f6777a in DispatchToMethod<FdWatcher, void (FdWatcher::*)()> (method=
    (void (FdWatcher::*)(FdWatcher * const)) 0xb50d651b <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, obj=<optimized out>, arg=<optimized out>)
    at ../../../gecko/ipc/chromium/src/base/tuple.h:383
#17 RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run (this=<optimized out>) at ../../../gecko/ipc/chromium/src/base/task.h:307
#18 0xb50cfb0c in Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:397
#19 mozilla::ipc::MessageChannel::DequeueTask::Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:414
#20 0xb50c7658 in MessageLoop::RunTask (this=0xbebcb048, task=0xb31e86c0) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:357
#21 0xb50c961e in MessageLoop::DeferOrRunPendingTask (this=<optimized out>, pending_task=<optimized out>) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:365
#22 0xb50cb1c8 in DoWork (this=<optimized out>) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:443
#23 MessageLoop::DoWork (this=0xbebcb048) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:422
#24 0xb50d01d8 in mozilla::ipc::DoWorkRunnable::Run (this=<optimized out>) at ../../../gecko/ipc/glue/MessagePump.cpp:233
#25 0xb4f89f82 in ProcessNextEvent (aResult=0xbebcaf47, aMayWait=<optimized out>, this=0xb6b02550) at ../../../gecko/xpcom/threads/nsThread.cpp:770

Comment 1

[Blake Wu [:bwu][:blakewu]]

It looks like when MP4Demuxer::ConvertByteRangesToTime (http://dxr.mozilla.org/mozilla-central/source/media/libstagefright/binding/mp4_demuxer.cpp#198) is called from MP4Reader::NotifyDataArrived(), mPrivate->mVideoIndex is not created yet.

Comment 2

[Blake Wu [:bwu][:blakewu]]

On my Flame, the repro rate is 100%.

Comment 3

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Do the patches in 1049133 fix it?

Comment 4

[Blake Wu [:bwu][:blakewu]]

After pulling the latest codes, it will not crash. It looks like Bug 1050060 fixed this problem 
See also Bug 1053325.