Closed Bug 948005 Opened 6 years ago Closed 6 years ago

crash in android::OmxDecoder::NotifyDataArrived(char const*, unsigned int, long long)

Categories

(Core :: Audio/Video, defect, critical)

ARM
Gonk (Firefox OS)
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla29
blocking-b2g 1.3+
Tracking Status
firefox27 --- wontfix
firefox28 --- fixed
firefox29 --- fixed

People

(Reporter: nhirata, Assigned: sotaro)

References

Details

(Keywords: crash, regression, reproducible)

Crash Data

Attachments

(1 file, 3 obsolete files)

This bug was filed from the Socorro interface and is 
report bp-7aeaa748-a307-4c74-9224-7860c2131209.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	android::OmxDecoder::NotifyDataArrived(char const*, unsigned int, long long) 	/home/geeksphone/FOS/peak/gecko/content/media/omx/OmxDecoder.cpp
1 	libxul.so 	mozilla::OmxDecoderNotifyDataArrivedRunnable::Run() 	/home/geeksphone/FOS/peak/gecko/content/media/omx/OmxDecoder.cpp
2 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/peak/gecko/xpcom/threads/nsThread.cpp
3 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/peak/gecko/xpcom/glue/nsThreadUtils.cpp
4 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp
5 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp
6 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
7 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
8 	libxul.so 	nsBaseAppShell::Run() 	/home/geeksphone/FOS/peak/gecko/widget/xpwidgets/nsBaseAppShell.cpp
9 	libxul.so 	XRE_RunAppShell 	/home/geeksphone/FOS/peak/gecko/toolkit/xre/nsEmbedFunctions.cpp
10 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp
11 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
12 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
13 	libxul.so 	XRE_InitChildProcess 	/home/geeksphone/FOS/peak/gecko/toolkit/xre/nsEmbedFunctions.cpp
14 	plugin-container 	main 	/home/geeksphone/FOS/peak/gecko/ipc/app/MozillaRuntimeMain.cpp
15 	libc.so 	__libc_init 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/libc_init_dynamic.c

Build ID :  	20131205122837
URL :  	http://anitroubles.com/app.webapp?feature_profile=3ebdd4ff36b6.46.3 
On Geeksphone.

Need to check if they picked up the patch in bug 924678
Flags: needinfo?(gp)
Yes, of course, we use the Mozilla code without modifications.
Flags: needinfo?(gp)
Thanks, Geeksphone!

I was able to crash going to:
http://anitroubles.com in the browser

https://crash-stats.mozilla.com/report/index/4306a5a6-c277-42ae-8bb0-52e0a2131220

Same crash stack.

Gaia      574f79512a7b8a9ab99211b16a857ab812d7994e
Gecko     http://hg.mozilla.org/mozilla-central/rev/599100c4ebfe
BuildID   20131220040201
Version   29.0a1
ro.build.version.incremental=eng.archermind.20131114.105818
ro.build.date=Thu Nov 14 10:58:33 CST 2013
Buri
Flags: needinfo?(sotaro.ikeda.g)
Blocks: 927884
Component: Vendcom → Video/Audio
Flags: needinfo?(sotaro.ikeda.g)
Product: Firefox OS → Core
Changed a component based on Comment 2.
Attached file crash of stack trace (obsolete) —
The crash was easily reproducible on master hamachi.
By debugging, MediaOmxReader is destructed in different way than expected.
From the debugging, MediaOmxReader that caused crash was used by MediaDecodeTask. So the crash was caused by WebAudio. I never care about this use case.
So, this is a problem of WebAudio enabled b2g. Is b2g v1.3 also affected from the problem?
blocking-b2g: --- → 1.3?
OS: Android → Gonk (Firefox OS)
Hardware: All → ARM
Assignee: nobody → sotaro.ikeda.g
Current implementation of MediaOmxReader expects owned by MediaDecoderStateMachine. And a way of how to release resources are also depends on a way of MediaDecoderStateMachine. But webaudio case does not comply to this assumption.

This patch fix the way of release resources. If the resources are not freed until destructor, they are released in the destructor. The patch works on master hamachi.
Attachment #8350859 - Flags: review?(chris.double)
blocking+ - it's a crash & likely a regression
blocking-b2g: 1.3? → 1.3+
Keywords: regression
Attachment #8350859 - Flags: review?(chris.double) → review+
Status: NEW → ASSIGNED
Committable patch.
Attachment #8350856 - Attachment is obsolete: true
Attachment #8350857 - Attachment is obsolete: true
Attachment #8350859 - Attachment is obsolete: true
Attachment #8356118 - Flags: review+
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/166bc0947d9a
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
https://hg.mozilla.org/releases/mozilla-aurora/rev/6233d1456824

Is this useful enough for non-B2G that it should go on beta for Fx27 as well?
Flags: needinfo?(sotaro.ikeda.g)
(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #15)
> https://hg.mozilla.org/releases/mozilla-aurora/rev/6233d1456824
> 
> Is this useful enough for non-B2G that it should go on beta for Fx27 as well?

It is necessary only for b2g.
Flags: needinfo?(sotaro.ikeda.g)
You need to log in before you can comment on or make changes to this bug.