This bug is found while debugging bug 1049241. By playing the particular link "rtsp://125.141.31.147:554/QE/Coverage20130826/R006_3GP_H.263(qCIF@541Kbps@15fps)_AAC-LC(96Kbps@22.05kHz@2ch).3gp", there are two possible results: 1. The video cannot be played and an error message is shown: "Video can't be played because the file if corrupt." 2. System crash. In this case, the crash caused in an assertion in AMPEG4AudioAssembler.cpp.

GDB backtrace output of the crash.

The audio codec of this clip is AAC-LC (Advanced Audio Coding, Low-Complexity). For some reason (tracked by bug 1049241), OmxDecoder fails to read its audio metadata and would trigger MediaDecoder::DecodeError(), which would then shutdown the media resource. This shutdown is triggered from the content process and will be propagated to the parent process: MediaDecoder::Shutdown() -> RtspMediaResource::Close() -> RtspControllerChild::Stop() -> ... [IPC] ... -> RtspControllerParent::RecvStop() -> ... -> RTSPSource::stop() The problem is, when this shutdown is in process, the parent process could still receive and process RTP packets from the network. In this case, it is possible that AMPEG4AudioAssembler is accessing some memory that was already revoked by the shutdown procedure and caused the crash.

This bug is resolved fixed by the patch of bug 1049241.