1236756 - GMP crash or garbled HE-AAC audio when playing MP4 decoded using Adobe's GMP

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Description

[Chris Pearce [:cpearce (Not reading bugmail)]]

If I play http://ht.cdn.turner.com/cnn/big//justice/2015/12/29/affluenza-teen-captured-mexico-evan-perez-newday.cnn_cnn_iphone_cell.mp4 using Adobe's GMP as the decoder, I get a crash.

STR:
1. Load Nightly on Windows.
2. Set media.wmf.enabled=false
3. Load http://ht.cdn.turner.com/cnn/big//justice/2015/12/29/affluenza-teen-captured-mexico-evan-perez-newday.cnn_cnn_iphone_cell.mp4
4. Observe garbled audio.

On Windows XP we get a "Video can't be played because the file is corrupted". On Windows 10 we get garbled audio, that sounds identical to when our WMF MediaDataDecoder wasn't handling the sample rate changing after inputting HE-AAC.

Comment 1

[Chris Pearce [:cpearce (Not reading bugmail)]]

Note if I set media.gmp.decoder.aac=1 we'll use gmp-clearkey's AAC decoder here, and the audio is not garbled. So the bug must be inside the Adobe GMP.

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

The Adobe GMP is crashing in a Nightly debug build:

First-chance exception at 0x66FEEE2C (msvcr120.dll) in plugin-container.exe: 0xC0000005: Access violation reading location 0x01DC1000.
Unhandled exception at 0x66FEEE2C (msvcr120.dll) in plugin-container.exe: 0xC0000005: Access violation reading location 0x01DC1000.


msvcr120.dll!memmove(unsigned char * dst, unsigned char * src, unsigned long count) Line 188	Unknown
eme-adobe.dll!0fc1864d()	Unknown
[Frames below may be incorrect and/or missing, no symbols loaded for eme-adobe.dll]	
xul.dll!mozilla::gmp::Runnable::Run() Line 41	C++
xul.dll!details::CallMethod<,mozilla::gmp::Runnable,void (__thiscall mozilla::gmp::Runnable::*)(void)>(mozilla::IndexSequence<> __formal, mozilla::gmp::Runnable * obj, void (void) * method, mozilla::Tuple<> & arg) Line 29	C++
xul.dll!DispatchTupleToMethod<mozilla::gmp::Runnable,void (__thiscall mozilla::gmp::Runnable::*)(void)>(mozilla::gmp::Runnable * obj, void (void) * method, mozilla::Tuple<> & arg) Line 47	C++
xul.dll!RunnableMethod<mozilla::gmp::Runnable,void (__thiscall mozilla::gmp::Runnable::*)(void),mozilla::Tuple<> >::Run() Line 307	C++
xul.dll!MessageLoop::RunTask(Task * task) Line 365	C++
xul.dll!MessageLoop::DeferOrRunPendingTask(const MessageLoop::PendingTask & pending_task) Line 375	C++
xul.dll!MessageLoop::DoWork() Line 459	C++
xul.dll!base::MessagePumpDefault::Run(base::MessagePump::Delegate * delegate) Line 34	C++
xul.dll!MessageLoop::RunInternal() Line 235	C++
xul.dll!MessageLoop::RunHandler() Line 228	C++
xul.dll!MessageLoop::Run() Line 202	C++
xul.dll!XRE_InitChildProcess(int aArgc, char * * aArgv, mozilla::gmp::GMPLoader * aGMPLoader) Line 629	C++
plugin-container.exe!content_process_main(int argc, char * * argv) Line 237	C++
plugin-container.exe!NS_internal_main(int argc, char * * argv) Line 11	C++
plugin-container.exe!wmain(int argc, wchar_t * * argv) Line 131	C++
[External Code]

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

Stepping through the gmp-clearkey's audio decoder, Firefox passes a channel count of 2 and sample rate of 44100 in the stream metadata to the child, but the first IMFTransform::Output() call from the WMF decoder returns MF_E_TRANSFORM_STREAM_CHANGE, and we re-get the channel and rate from the decoder and they're changed to channels=1 rate=22050.

So presumably the Adobe AAC decoder is just assuming the rate/channels from the metadata we send it are correct, and are doing a memmove based on a number of samples calculated from that, and since the number of samples will be less once the channels/rate decreases, they'll be trying to memmove more bytes than are in the actual audio samples buffer, and thus crashing.

Comment 4

[Chris Peterson [:cpeterson]]

We would like to fix this bug 2+ weeks before FF 45 (March 7 - 2 weeks = February 22) so we can use the CDM to decode AAC in FF 45 (bug 1210231)

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Most Facebook video is also affected by this bug, so we're preffing off decoding using the Adobe GMP, and we're going to hold off pushing out the Adobe GMP to WinXP users.

Comment 6

[Chris Peterson [:cpeterson]]

Joe says this HE-AAC bug should be fixed in the next CDM release in about two weeks (January ~26?).

Comment 7

[Joe Steele]

I am unable to get Firefox to actually try to play it. It tells me I can download or play with the Windows 10 built-in player. I have followed the instructions above -- what am I missing?

Comment 8

[Joe Steele]

I should add that I am using 47.0a1. I am going to try 46 now. I am running Windows 10 and the Adobe GMP is already downloaded.

Comment 9

[Joe Steele]

Never mind. I found another email from you that says to set media.gmp.decoder.enabled=true also.

Comment 10

[Joe Steele]

Primetime CDM v17 has been pushed to the Adobe servers to resolve this problem.

Comment 11

[Chris Peterson [:cpeterson]]

Thanks, Joe!

Comment 12

[Chris Pearce [:cpearce (Not reading bugmail)]]

Upon testing, the Primetime v17 CDM does not appear to fix this problem.

Comment 13

[Joe Steele]

@cpearce - Did the content link above not work? I am assuming it did. Can you provide a link to content that does not work?

Comment 14

[Joe Steele]

The latest v17 build (primetime_gmp_win_x86_gmc_40673.zip) has been posted and resolves 1247007.

Comment 15

[Chris Pearce [:cpearce (Not reading bugmail)]]

(In reply to Joe Steele from comment #14)
> The latest v17 build (primetime_gmp_win_x86_gmc_40673.zip) has been posted
> and resolves 1247007.

Closing bug. Thanks Joe!