Closed Bug 890394 Opened 11 years ago Closed 11 years ago

[A/V] Crash from OMX decoder (android::OmxDecoder::ReadAudio) round 2.

Categories

(Firefox OS Graveyard :: General, defect)

Product:
Firefox OS Graveyard
Component:
General
Platform:
ARM
Gonk (Firefox OS)
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(blocking-b2g:leo+, firefox23 wontfix, firefox24 wontfix, firefox25 fixed, b2g18 fixed, b2g18-v1.0.0 wontfix, b2g18-v1.0.1 wontfix, b2g-v1.1hd fixed)

Status:
RESOLVED FIXED
Milestone:
1.1 QE4 (15jul)
Project Flags:
blocking-b2g leo+
Tracking Flags:
Tracking Status
firefox23 --- wontfix
firefox24 --- wontfix
firefox25 --- fixed
b2g18 --- fixed
b2g18-v1.0.0 --- wontfix
b2g18-v1.0.1 --- wontfix
b2g-v1.1hd --- fixed

People

(Reporter: sotaro, Assigned: sotaro)

References

Details

(Keywords: crash, reproducible, Whiteboard: [b2g-crash][LeoVB+])

Crash Data

Attachments

(2 files, 2 obsolete files)

patch v3 - prevent incorrect state transition
1.20 KB, patch
sotaro
: review+
Details | Diff | Splinter Review
patch v3 for b2g18 - prevent incorrect state transition
1.23 KB, patch
sotaro
: review+
Details | Diff | Splinter Review 
+++ This bug was initially created as a clone of Bug #884182 +++

Crash at android::OmxDecoder::ReadAudio() still happens even when Bug 884182 is fixed.

STR
1. Browse http://people.mozilla.org/~cpeterson/videos/H264_Baseline_Profile_Level_30_640x360p.mp4
2. Touch home button
3. When home screen is shown, touch browser icon quickly.

repeat 2. 3. forever very quickly until crash happens.
I found it, when I try to reproduce Bug 889167.
Blocks: 889167
blocking-b2g: --- → leo?
The crash happens when an interval of following function calls is too close.
- nsBuiltinDecoder::SetDormantIfNecessary(true) 
- nsBuiltinDecoder::SetDormantIfNecessary(false)

It it happens, nsBuiltinDecoderStateMachine's state change from DECODER_STATE_DORMANT to other state during freeing media resources.
(In reply to Sotaro Ikeda [:sotaro] from comment #2)
> The crash happens when an interval of following function calls is too close.
> - nsBuiltinDecoder::SetDormantIfNecessary(true) 
> - nsBuiltinDecoder::SetDormantIfNecessary(false)
> 
> It it happens, nsBuiltinDecoderStateMachine's state change from
> DECODER_STATE_DORMANT to other state during freeing media resources.

This change bypasses the status check added in Bug 884182.
Severity: normal → critical
Crash Signature: [@ android::OmxDecoder::ReadAudio] [@ android::OmxDecoder::ReadAudio(MPAPI::AudioFrame*, long long)]
Keywords: reproducible
Whiteboard: [b2g-crash]
Assignee: nobody → sotaro.ikeda.g
Confirmed that the patch fix the problem on v1.1 unagi.
Attachment #771496 - Flags: review?(chris.double)
Comment on attachment 771496 [details] [diff] [review]
patch - prevent incorrect state transition

Need to fix nits.
Attachment #771496 - Attachment is obsolete: true
Attachment #771496 - Flags: review?(chris.double)
Attachment #771500 - Flags: review?(chris.double)
Can we verify this also no longer reproduces on the leo device?
blocking-b2g: leo? → leo+
Attachment #771500 - Flags: review?(chris.double) → review+
A patch for master. Carry "chris.double: review+"
Attachment #771500 - Attachment is obsolete: true
Attachment #772798 - Flags: review+
A patch for b2g18. Carry "chris.double: review+".
Attachment #772799 - Flags: review+
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/f36e0a6bd255
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Whiteboard: [b2g-crash] → [b2g-crash][LeoVB+]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: