900393 - crash in mozilla::MediaPluginReader::ImageBufferCallback::operator

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Scoobidiver (away)]

It has been hit by two users in 25.0a1/20130731. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=73b69c146ca6&tochange=c2b375f3a909
It's likely a regression from bug 858914.
Some users have preffed the OGL backend on.

Signature 	mozilla::MediaPluginReader::ImageBufferCallback::operator()(unsigned int, unsigned int, MPAPI::ColorFormat) More Reports Search
UUID 	0b0751ba-e09b-4507-90e1-5a86f2130801
Date Processed	2013-08-01 00:05:00.677528
Uptime	13178
Last Crash	544488 seconds before submission
Install Age 	35496 since version was first installed.
Install Time 	2013-07-31 14:13:11
Product 	FennecAndroid
Version 	25.0a1
Build ID 	20130731030203
Release Channel 	nightly
OS 	Android
OS Version 	0.0.0 Linux 3.0.31-1130792 #2 SMP PREEMPT Mon Apr 15 19:05:47 KST 2013 armv7l samsung/d2spr/d2spr:4.
Build Architecture 	arm
Build Architecture Info 	ARMv0 | 2
Crash Reason 	SIGSEGV
Crash Address 	0x0
App Notes 	
AdapterDescription: 'Qualcomm -- Adreno (TM) 225 -- OpenGL ES 2.0 V@2.1 AU@ (CL@) -- Model: SPH-L710, Product: d2spr, Manufacturer: samsung, Hardware: qcom'
GL Layers! EGL? EGL+ GL Context? GL Context+ GL Layers+ Stagefright? Stagefright+ 
samsung SPH-L710
samsung/d2spr/d2spr:4.1.2/JZO54K/L710VPBMD4:user/release-keys

Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::MediaPluginReader::ImageBufferCallback::operator()(unsigned int, unsigned int, MPAPI::ColorFormat) 	content/media/plugins/MediaPluginReader.cpp
1 	libomxplugin.so (deleted) 	libomxplugin.so (deleted)@0x1617 	
2 	libstagefright.so 	libstagefright.so@0x7f1f7 	
3 	libomxplugin.so (deleted) 	libomxplugin.so (deleted)@0x173f 	
4 	OMXCodec (deleted) 	OMXCodec (deleted)@0x77fffe 	
5 	libstagefright_foundation.so 	libstagefright_foundation.so@0x9d8b 	
6 	OMXCodec (deleted) 	OMXCodec (deleted)@0x77fffe 	
7 	libomxplugin.so (deleted) 	libomxplugin.so (deleted)@0x1d67 	
8 	OMXCodec (deleted) 	OMXCodec (deleted)@0x77fffe 	
9 	libomxplugin.so (deleted) 	libomxplugin.so (deleted)@0x1e27 	
10 	libxul.so 	mozilla::MediaPluginReader::DecodeVideoFrame(bool&, long long) 	content/media/plugins/MediaPluginReader.cpp
11 	libxul.so 	mozilla::MediaDecoderReader::DecodeToFirstVideoData() 	content/media/MediaDecoderReader.cpp
12 	libxul.so 	mozilla::MediaDecoderReader::FindStartTime(long long&) 	content/media/MediaDecoderReader.cpp
13 	libxul.so 	mozilla::MediaDecoderStateMachine::FindStartTime() 	content/media/MediaDecoderStateMachine.cpp
14 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeMetadata() 	content/media/MediaDecoderStateMachine.cpp
15 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeThreadRun() 	content/media/MediaDecoderStateMachine.cpp
16 	libxul.so 	nsRunnableMethodImpl<tag_nsresult (mozilla::dom::NotificationPermissionRequest::*)(), true>::Run() 	obj-firefox/dist/include/nsThreadUtils.h
17 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
18 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
19 	libxul.so 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp
20 	libnss3.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c
21 	libc.so 	libc.so@0x12eb2 	
22 	libc.so 	libc.so@0x1260a

More reports at:
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=mozilla%3A%3AMediaPluginReader%3A%3AImageBufferCallback%3A%3Aoperator%28%29%28unsigned+int%2C+unsigned+int%2C+MPAPI%3A%3AColorFormat%29

Comment 1

[Scoobidiver (away)]

It's #5 top crasher (#2 unfixed) in 25.0a1.

Comment 2

[Scoobidiver (away)]

The breakdown per device is the following:
Samsung GT-S5830i (Galaxy Ace)	8
Samsung SPH-L710 (Galaxy SIII LTE)	5
Motorola DROID RAZR HD 	4

Comment 3

[Benjamin Smedberg]

Per email conversation, nical will take this.

Comment 4

[Nicolas Silva [:nical]]

Attachment: Properly override AsSharedImage()

In one of the patches of Bug 858914 I needed to add a separate SharedRGBImage class that works with the new textures, some code directly refers to DeprecatedSharedRGBImage so I had to move some stuff into an interface (ISharedImage) shared by both SharedRGBImage and DeprecatedSharedRGBImage. Turns out I forgot to override AsSharedImage() in both classes which led to this crash.
I am surprised this passed through our tests.

This patch adds the proper AsSharedImage() overrides.

Comment 6

[Nicolas Silva [:nical]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2b55f012b27a

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/2b55f012b27a

Comment 8

[Nicolas Silva [:nical]]

Comment on attachment 786371 [details] [diff] [review]
Properly override AsSharedImage()

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 858914
User impact if declined: Frequent crashes with video playback on android
Testing completed (on m-c, etc.): just landed on m-c, fixes the crash
Risk to taking this patch (and alternatives if risky): low risk, trivial patch.
String or IDL/UUID changes made by this patch:

Comment 9

[Paul Adenot (:padenot)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/30e91989f2a3

Comment 10

[u421692]

Reproducing every time I tap on Play button on Example 1 video from http://www.w3schools.com/html/html5_video.asp. Only reproducing on Gingerbread devices, not reproducing on Jelly Bean.

Comment 11

[Scoobidiver (away)]

(In reply to Pop Mihai from comment #10)
> Reproducing every time I tap on Play button on Example 1 video from
> http://www.w3schools.com/html/html5_video.asp. Only reproducing on
> Gingerbread devices, not reproducing on Jelly Bean.
Does it happen in 26.0a1/20130809 or 25.0a2/20130810 (not yet released)?

Comment 12

[u421692]

I'm out of office right now, and can not test on a gingerbread device. However, the issue reproduces on 25.0a2/20130809. The fix may not hit that version of Aurora.