I discovered a bug in OggIndex's decoder, and the same bug exists in nsOggReader.
When nsOggReader starts decoding Theora, it finds the first packet with a granulepos, and we increment that granulepos every time we read a subsequent packet, and use that as the packet's granulepos. If a packet already has a granulepos (because it's the last packet in the page) we overwrite the running granulepos with the incoming granulepos, since I found they can be different when there are gaps in the media.
This is wrong, it produces inconsistent results. When we seek to the "gap" page and capture granulepos there, we'll assign granulepos to the packets different to how we assign them when decoding the gap page from the previous granulepos capture.
In the "seek to the gap" case, we (correctly) assume the gap is before the first packet on the page, whereas with the "decoding from previous capture" case we'll assume the gap is before the last packet in the page.
ffmpeg output files with these gaps sometimes.
When we decode Theora, we should always read ahead until the packet with a non -1 granulepos, and propagate that backwards to assign granulepos to packets. We already have this code, we should just always use it and not try to keep a running granulepos for Theora.
Fixed by bug 650994.