448994 - <video> element causes floating point exception [@ oggplay_callback_predetected] when playing theora file

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[cajbir (:cajbir)]

Attachment: Ogg file that causes the crash

When paying the crash.ogg file attached I get a floating point exception.

#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb7296e96 in nanosleep () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7296ca7 in sleep () from /lib/tls/i686/cmov/libc.so.6
#3  0xb7e9439f in ah_crap_handler (signum=8) at nsSigHandlers.cpp:149
#4  <signal handler called>
#5  0xb735250c in __divdi3 () from /lib/libgcc_s.so.1
#6  0xb5822959 in oggplay_callback_skel (oggz=0xaf203c00, op=0xae8fe1bc, serialno=1031189973, 
    user_data=0xaf5f0be0)
    at /home/chris/src/mozilla/firefox/mozilla/modules/liboggplay/src/liboggplay/oggplay_callback.c:257
#7  0xb5822644 in oggplay_callback_predetected (oggz=0xaf203c00, op=0xae8fe1bc, serialno=1031189973, 
    user_data=0xaf5e4f60)
    at /home/chris/src/mozilla/firefox/mozilla/modules/liboggplay/src/liboggplay/oggplay_callback.c:597
#8  0xb5827e85 in oggz_read_sync (oggz=0xaf203c00)
    at /home/chris/src/mozilla/firefox/mozilla/modules/liboggz/src/liboggz/oggz_read.c:496
#9  0xb5828434 in oggz_read (oggz=0xaf203c00, n=8192)
    at /home/chris/src/mozilla/firefox/mozilla/modules/liboggz/src/liboggz/oggz_read.c:629
#10 0xb5822263 in oggplay_initialise (me=0xaf5e4f60, block=0)
    at /home/chris/src/mozilla/firefox/mozilla/modules/liboggplay/src/liboggplay/oggplay.c:103
#11 0xb5822362 in oggplay_open_with_reader (reader=0xaf21c380)
    at /home/chris/src/mozilla/firefox/mozilla/modules/liboggplay/src/liboggplay/oggplay.c:137
#12 0xb581c17b in nsOggDecoder::LoadOggHeaders (this=0xaf5d8700)
    at /home/chris/src/mozilla/firefox/mozilla/content/media/video/src/nsOggDecoder.cpp:626
#13 0xb581dfa5 in nsRunnableMethod<nsOggDecoder>::Run (this=0xaf2380e0)
    at ../../../../dist/include/xpcom/nsThreadUtils.h:261
#14 0xb7d6c9a8 in nsThread::ProcessNextEvent (this=0xaf5e4dd0, mayWait=1, result=0xae8fe350)
    at /home/chris/src/mozilla/firefox/mozilla/xpcom/threads/nsThread.cpp:510
#15 0xb7d1524f in NS_ProcessNextEvent_P (thread=0x0, mayWait=1) at nsThreadUtils.cpp:227
#16 0xb7d6d2c5 in nsThread::ThreadFunc (arg=0xaf5e4dd0)
    at /home/chris/src/mozilla/firefox/mozilla/xpcom/threads/nsThread.cpp:254

Comment 1

[cajbir (:cajbir)]

Attachment: Test case html file

HTML file that uses <video> to load crash.ogg

Comment 2

[cajbir (:cajbir)]

The file was originally the 320x240.ogg file from the theora test suite. I used oggz-chop to make it smaller:

oggz-chop -o crash.ogg -e "00:00.2" 320x240.ogg

Playing this file using glut-player (from liboggplay) or oggplayer-info, gives the same error so I've raised the issue in the liboggplay bug system:

http://trac.annodex.net/ticket/412

Comment 3

[Ralph Giles (:rillian)]

This file uncovered a spec bug. The skeleton fields include a zero denominator, hence the fpe. liboggplay r3679 deals with the problem.

http://trac.annodex.net/changeset/3679

Comment 5

[cajbir (:cajbir)]

Attachment: Updates to liboggplay svn r3693

Updates to liboggplay svn r3693 to pull in the fix mentioned by Ralph. Additional changes pulled in by the later svn revision number are README and whitespace changes as the liboggplay library was modified for the first public release.

Comment 6

[Dão Gottwald [:dao]]

http://hg.mozilla.org/index.cgi/mozilla-central/rev/177454c4547a