948005 - crash in android::OmxDecoder::NotifyDataArrived(char const*, unsigned int, long long)

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-7aeaa748-a307-4c74-9224-7860c2131209.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	android::OmxDecoder::NotifyDataArrived(char const*, unsigned int, long long) 	/home/geeksphone/FOS/peak/gecko/content/media/omx/OmxDecoder.cpp
1 	libxul.so 	mozilla::OmxDecoderNotifyDataArrivedRunnable::Run() 	/home/geeksphone/FOS/peak/gecko/content/media/omx/OmxDecoder.cpp
2 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/peak/gecko/xpcom/threads/nsThread.cpp
3 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/peak/gecko/xpcom/glue/nsThreadUtils.cpp
4 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp
5 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp
6 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
7 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
8 	libxul.so 	nsBaseAppShell::Run() 	/home/geeksphone/FOS/peak/gecko/widget/xpwidgets/nsBaseAppShell.cpp
9 	libxul.so 	XRE_RunAppShell 	/home/geeksphone/FOS/peak/gecko/toolkit/xre/nsEmbedFunctions.cpp
10 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp
11 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
12 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc
13 	libxul.so 	XRE_InitChildProcess 	/home/geeksphone/FOS/peak/gecko/toolkit/xre/nsEmbedFunctions.cpp
14 	plugin-container 	main 	/home/geeksphone/FOS/peak/gecko/ipc/app/MozillaRuntimeMain.cpp
15 	libc.so 	__libc_init 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/libc_init_dynamic.c

Build ID :  	20131205122837
URL :  	http://anitroubles.com/app.webapp?feature_profile=3ebdd4ff36b6.46.3 
On Geeksphone.

Need to check if they picked up the patch in bug 924678

Comment 1

[Geeksphone]

Yes, of course, we use the Mozilla code without modifications.

Comment 2

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Thanks, Geeksphone!

I was able to crash going to:
http://anitroubles.com in the browser

https://crash-stats.mozilla.com/report/index/4306a5a6-c277-42ae-8bb0-52e0a2131220

Same crash stack.

Gaia      574f79512a7b8a9ab99211b16a857ab812d7994e
Gecko     http://hg.mozilla.org/mozilla-central/rev/599100c4ebfe
BuildID   20131220040201
Version   29.0a1
ro.build.version.incremental=eng.archermind.20131114.105818
ro.build.date=Thu Nov 14 10:58:33 CST 2013
Buri

Comment 3

[Sotaro Ikeda [:sotaro]]

Changed a component based on Comment 2.

Comment 4

[Sotaro Ikeda [:sotaro]]

Attachment: crash of stack trace

Comment 5

[Sotaro Ikeda [:sotaro]]

The crash was easily reproducible on master hamachi.

Comment 6

[Sotaro Ikeda [:sotaro]]

By debugging, MediaOmxReader is destructed in different way than expected.

Comment 7

[Sotaro Ikeda [:sotaro]]

Attachment: stacktrace of MediaOmxReader destruction

From the debugging, MediaOmxReader that caused crash was used by MediaDecodeTask. So the crash was caused by WebAudio. I never care about this use case.

Comment 8

[Sotaro Ikeda [:sotaro]]

So, this is a problem of WebAudio enabled b2g. Is b2g v1.3 also affected from the problem?

Comment 9

[Sotaro Ikeda [:sotaro]]

Attachment: release reasources in MediaOmxReader's destructor

Current implementation of MediaOmxReader expects owned by MediaDecoderStateMachine. And a way of how to release resources are also depends on a way of MediaDecoderStateMachine. But webaudio case does not comply to this assumption.

This patch fix the way of release resources. If the resources are not freed until destructor, they are released in the destructor. The patch works on master hamachi.

Comment 10

[Jason Smith [:jsmith]]

blocking+ - it's a crash & likely a regression

Comment 11

[Sotaro Ikeda [:sotaro]]

Attachment: patch v2 - release reasources in MediaOmxReader's destructor (r=doublec)

Committable patch.

Comment 12

[Sotaro Ikeda [:sotaro]]

https://tbpl.mozilla.org/?tree=Try&rev=f0cdd9b080a5

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/b2g-inbound/rev/166bc0947d9a

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/166bc0947d9a

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/6233d1456824

Is this useful enough for non-B2G that it should go on beta for Fx27 as well?

Comment 16

[Sotaro Ikeda [:sotaro]]

(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #15)
> https://hg.mozilla.org/releases/mozilla-aurora/rev/6233d1456824
> 
> Is this useful enough for non-B2G that it should go on beta for Fx27 as well?

It is necessary only for b2g.