999894 - crash in android_atomic_inc when putting the phone to sleep & waking it back up after playing a recorded video at a blob URL

Status: RESOLVED INVALID

(Core :: Audio/Video, defect, P1)

Description

[Jason Smith [:jsmith]]

This bug was filed from the Socorro interface and is 
report bp-cda75c8f-2f8c-4216-91c0-27f012140423.
=============================================================

Build - 4/22/2014 1.4 Open C

STR

1. Go to http://mozilla.github.io/qa-testcase-data/webapi/mediarecorder/
2. Setup a stream for media recorder by file with:
** File: any ogg video (e.g. chained_streams.ogg)
** Media Type: video
** Mime Type: video/mp4
3. Start playback on each set of media controls
4. Start recording
5. When recording ends, select the blob URL generated
6. After the recorded video starts playing back, put the phone to sleep
7. Wake up the phone & unlock the device

Expected

The browser tab should still have the recorded video open for viewing.

Actual

The browser tab crashes.

Stack

Frame 	Module 	Signature 	Source
0 	libcutils.so 	android_atomic_inc 	/builds/slave/b2g_m-cen_nexus-4_ntly-0000000/build/system/core/include/cutils/atomic-arm.h
1 	libutils.so 	android::VectorImpl::VectorImpl(android::VectorImpl const&) 	/builds/slave/b2g_m-cen_nexus-4_ntly-0000000/build/frameworks/native/libs/utils/VectorImpl.cpp
2 	libstagefright.so 	libstagefright.so@0x6b143 	
3 	libstagefright.so 	libstagefright.so@0x6eb65 	
4 	binder 	binder@0x272 	
5 	libbinder.so 	android::IPCThreadState::transact(int, unsigned int, android::Parcel const&, android::Parcel*, unsigned int) 	/builds/slave/b2g_m-cen_nexus-4_ntly-0000000/build/frameworks/native/libs/binder/IPCThreadState.cpp
6 	libbinder.so 	android::Parcel::freeDataNoInit() 	/builds/slave/b2g_m-cen_nexus-4_ntly-0000000/build/frameworks/native/libs/binder/Parcel.cpp
7 		@0x11f374b1 	
8 	libstagefright.so 	libstagefright.so@0xd7394 	
9 	libstagefright.so 	libstagefright.so@0x6bf87 	
10 	binder 	binder@0x26e 	
11 	binder 	binder@0x272 	
12 	libbinder.so 	android::IPCThreadState::self() 	/builds/slave/b2g_m-cen_nexus-4_ntly-0000000/build/frameworks/native/libs/binder/IPCThreadState.cpp

Comment 1

[Randy Lin [:rlin] - Be Mozillian on 2015/01/26]

Dump the callstack on flame 2.2 

(gdb) bt
#0  android_atomic_add (ptr=0xfffffff1, increment=1) at system/core/include/cutils/atomic-arm.h:121
#1  android_atomic_inc (addr=0xfffffff1) at system/core/include/cutils/atomic-arm.h:134
#2  0xb4df64c0 in android::VectorImpl::VectorImpl (this=0xb0b377ec, rhs=...) at system/core/libutils/VectorImpl.cpp:54
#3  0xb4e9b6c0 in BetterSniffMPEG4 (meta=0xb4f358ec, confidence=0xb0359b60, mimeType=0x0, source=...) at frameworks/av/media/libstagefright/MPEG4Extractor.cpp:3806
#4  android::SniffMPEG4 (source=..., mimeType=0x0, confidence=0xb0359b60, meta=0xb4f358ec) at frameworks/av/media/libstagefright/MPEG4Extractor.cpp:3901
#5  0x00000004 in ?? ()
#6  0x00000004 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) fr 4
#4  android::SniffMPEG4 (source=..., mimeType=0x0, confidence=0xb0359b60, meta=0xb4f358ec) at frameworks/av/media/libstagefright/MPEG4Extractor.cpp:3901
3901	    if (BetterSniffMPEG4(source, mimeType, confidence, meta)) {
(gdb) l
3896	}
3897	
3898	bool SniffMPEG4(
3899	        const sp<DataSource> &source, String8 *mimeType, float *confidence,
3900	        sp<AMessage> *meta) {
3901	    if (BetterSniffMPEG4(source, mimeType, confidence, meta)) {
3902	        return true;
3903	    }
3904	
3905	    if (LegacySniffMPEG4(source, mimeType, confidence)) {
(gdb) p source
$1 = (const android::sp<android::DataSource> &) @0xb0a15338: {m_ptr = 0x5a5a5a5a}

Comment 2

[Randy Lin [:rlin] - Be Mozillian on 2015/01/26]

Push right library and the call stack looks better.

#0  android_atomic_add (ptr=0x5a5a5a4a, increment=1) at system/core/include/cutils/atomic-arm.h:121
#1  android_atomic_inc (addr=0x5a5a5a4a) at system/core/include/cutils/atomic-arm.h:134
#2  0xb42b54c0 in android::VectorImpl::VectorImpl (this=0xb0301748, rhs=...) at system/core/libutils/VectorImpl.cpp:54
#3  0xb435a57c in Vector (rhs=..., this=0xb0301748) at system/core/include/utils/Vector.h:230
#4  android::MPEG4Source::Sample::Sample (this=0xb0301728) at frameworks/av/media/libstagefright/MPEG4Extractor.cpp:162
#5  0xb435dff6 in android::MPEG4Source::fragmentedRead (this=0xb061df30, out=0xb0301838, options=<optimized out>) at frameworks/av/media/libstagefright/MPEG4Extractor.cpp:3513
#6  0xb435cdc8 in android::MPEG4Source::read (this=0xb061df30, out=0xb0301838, options=0x0) at frameworks/av/media/libstagefright/MPEG4Extractor.cpp:3178
#7  0xb4370f90 in android::OMXCodec::drainInputBuffer (this=this@entry=0xb040e200, info=0xb0409d48) at frameworks/av/media/libstagefright/OMXCodec.cpp:3324
#8  0xb43729ce in drainInputBuffers (this=0xb040e200) at frameworks/av/media/libstagefright/OMXCodec.cpp:3181
#9  android::OMXCodec::drainInputBuffers (this=0xb040e200) at frameworks/av/media/libstagefright/OMXCodec.cpp:3161
#10 0xb43744d4 in android::OMXCodec::read (this=0xb040e200, buffer=0xb0417da4, options=<optimized out>) at frameworks/av/media/libstagefright/OMXCodec.cpp:4141
#11 0xb54ac33e in android::OMXCodecProxy::read (this=0xb044cf10, buffer=0xb0417da4, options=0x0) at ../../../../../../../media/ssd/gecko_c2/content/media/omx/OMXCodecProxy.cpp:242
#12 0xb54ae1f6 in android::OmxDecoder::ReadVideo (this=0xb0417c00, aFrame=aFrame@entry=0xb0301a40, aTimeUs=<optimized out>, aKeyframeSkip=false, aDoSeek=aDoSeek@entry=false)
    at ../../../../../../../media/ssd/gecko_c2/content/media/omx/OmxDecoder.cpp:569
#13 0xb54abd68 in mozilla::MediaOmxReader::DecodeVideoFrame (this=0xafd9e000, aKeyframeSkip=@0xb0301adf: false, aTimeThreshold=0)
    at ../../../../../../../media/ssd/gecko_c2/content/media/omx/MediaOmxReader.cpp:392
#14 0xb54438b8 in mozilla::MediaDecoderReader::RequestVideoData (this=0xafd9e000, aSkipToNextKeyframe=<optimized out>, aTimeThreshold=<optimized out>)
    at ../../../../../../media/ssd/gecko_c2/content/media/MediaDecoderReader.cpp:167
#15 0xb544edde in mozilla::MediaDecoderStateMachine::DecodeMetadata (this=this@entry=0xafd9e800) at ../../../../../../media/ssd/gecko_c2/content/media/MediaDecoderStateMachine.cpp:1982
#16 0xb544eecc in mozilla::MediaDecoderStateMachine::CallDecodeMetadata (this=0xafd9e800) at ../../../../../../media/ssd/gecko_c2/content/media/MediaDecoderStateMachine.cpp:1910
#17 0xb475acb0 in nsRunnableMethodImpl<tag_nsresult (nsMemoryReporterManager::*)(), void, true>::Run (this=<optimized out>) at ../../dist/include/nsThreadUtils.h:388
#18 0xb5440416 in mozilla::MediaTaskQueue::Runner::Run (this=0xb0619e60) at ../../../../../../media/ssd/gecko_c2/content/media/MediaTaskQueue.cpp:194
#19 0xb47969e6 in nsThreadPool::Run (this=0xb0ca3c50) at ../../../../../../media/ssd/gecko_c2/xpcom/threads/nsThreadPool.cpp:220

Comment 3

[Sotaro Ikeda [:sotaro]]

It might be related to blobs validity/lifetime like Bug 806503.

Comment 4

[Randy Lin [:rlin] - Be Mozillian on 2015/01/26]

Hi Alastor, 
If you have time, could you help on this? :)

Comment 5

[Randy Lin [:rlin] - Be Mozillian on 2015/01/26]

Let Alastor to follow this.

Comment 6

[Alastor Wu [:alwu]]

The original URL is invalid.
See Bug 1100803 comment2.

Comment 7

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

FYI, URL from comment 0 changed. http://mozilla-b2g.github.io/qa-testcase-data/webapi/mediarecorder/MediaRecorder.html