Closed Bug 959487 Opened 7 years ago Closed 7 years ago

[MediaEncoder] Can't record the media stream from video tags

Categories

(Core :: Graphics: Layers, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 962101

People

(Reporter: rlin, Assigned: pchang)

References

Details

(Keywords: crash, reproducible, Whiteboard: [b2g-crash])

After test the patch on https://bugzilla.mozilla.org/show_bug.cgi?id=879668
Bug 879668 - [MediaEncoder] Implement OmxTrackEncoder on B2G
We found it would crash on copy data from video tags.
Blocks: MediaEncoder
blocking-b2g: --- → 1.4?
Hi Benjamin, 
Could you describe in detail?
Flags: needinfo?(bechen)
Hi Marvin, 
I heard this feature comes from our partners, 
This one needs your input and we should have the requirement to finish this feature.
Flags: needinfo?(mkhoo)
ah, wrong ni?
Flags: needinfo?(mkhoo)
Summary: [Media Recorder] Can't record the media stream from video tags → [MediaEncoder] Can't record the media stream from video tags
The root cause is that even though we hold a nsRefPtr<layers::Image>, the yuv data of this image still can be released.

The release is triggered here:
http://dxr.mozilla.org/mozilla-central/source/gfx/layers/client/ImageClient.cpp#150

Content process calls ImageClientSingle::UpdateImage -> TextureClient::ForceRemove() -> ipc to b2g process.
b2g process calls PImageBridgeParent::DestroySharedMemory -> ipc to content process. Then the yuv data is released.

b2g process call stack==

0  mozilla::layers::PImageBridgeParent::DestroySharedMemory (this=0xaffb7c00, shmem=...) at PImageBridgeParent.cpp:276
#1  0xb4ecb228 in mozilla::layers::PImageBridgeParent::DeallocShmem (this=<optimized out>, aMem=...) at PImageBridgeParent.cpp:816
#2  0xb505aa32 in mozilla::layers::ShmemTextureHost::DeallocateSharedData (this=0xb0f934c0) at ../../../../../../hg/mozilla-central/gfx/layers/composite/TextureHost.cpp:589
#3  0xb505b3f2 in mozilla::layers::TextureParent::ActorDestroy (this=0xb2bd5100, why=<optimized out>) at ../../../../../../hg/mozilla-central/gfx/layers/composite/TextureHost.cpp:704
#4  0xb4e9924c in mozilla::plugins::PBrowserStreamParent::DestroySubtree (this=0xb2bd5100, why=mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::Deletion) at PBrowserStreamParent.cpp:451
#5  0xb4f13fce in mozilla::layers::PTextureParent::Send__delete__ (actor=0xb2bd5100) at PTextureParent.cpp:69
#6  0xb4f17b64 in mozilla::layers::PTextureParent::OnMessageReceived (this=0xb2bd5100, __msg=...) at PTextureParent.cpp:209
#7  0xb4ed18ae in mozilla::layers::PImageBridgeParent::OnMessageReceived (this=0xaffb7c00, __msg=...) at PImageBridgeParent.cpp:380
#8  0xb4e86782 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0xaffb7c30, aMsg=...) at ../../../../../../hg/mozilla-central/ipc/glue/MessageChannel.cpp:992
#9  0xb4e884a0 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=<optimized out>) at ../../../../../../hg/mozilla-central/ipc/glue/MessageChannel.cpp:889
#10 0xb4e86234 in DispatchToMethod<mozilla::ipc::MessageChannel, void (mozilla::ipc::MessageChannel::*)()> (method=
    (void (mozilla::ipc::MessageChannel::*)(mozilla::ipc::MessageChannel * const)) 0xb4e88423 <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, obj=<optimized out>, arg=<optimized out>)
Flags: needinfo?(bechen)
Duplicate of this bug: 958388
Moving to gfx, as the crash is happening in graphics.
Component: General → Graphics: Layers
Keywords: crash, reproducible
Product: Firefox OS → Core
Severity: normal → critical
Whiteboard: [b2g-crash]
Assignee: nobody → pchang
remove this line works for sw decoder patch, but it caused problem for camera preview or other hw decoder path.

http://dxr.mozilla.org/mozilla-central/source/gfx/layers/client/ImageClient.cpp#150

ImageClientSingle::UpdateImage(ImageContainer* aContainer,
                               uint32_t aContentFlags)
{
...
    if (mFrontBuffer) {
      GetForwarder()->AddForceRemovingTexture(mFrontBuffer);
    }

The "AddForceRemovingTexture" API will add the texture to texture removed list.
Inside ImageBridgeChild::EndTransaction, it will try to free the texture from the above texture removed list.

But encoder still referred above texture which was free when next composition transaction finished.
http://dxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/ImageBridgeChild.cpp#466

The correct way is separate the buffer lifecycle from composition transaction.
And Bug 962101 is working on this part.
In my local, the patch from bug 962101 solved this issue.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 962101
No longer blocks: MediaEncoder
blocking-b2g: 1.4? → ---
You need to log in before you can comment on or make changes to this bug.