It happens on Peak. Here is a crash report: bp-3f5309d6-c87f-4eee-bc22-301842130615. Frame Module Signature Source 0 libxul.so android::MediaStreamSource::readAt OmxDecoder.cpp:100 1 libxul.so android::DataSource::readAt DataSource.h:63 2 libstagefright.so android::MPEG4DataSource::readAt MPEG4Extractor.cpp:179 3 libstagefright.so android::MPEG4Source::getFormat MPEG4Extractor.cpp:2190 4 libstagefright.so android::MPEG4DataSource::readAt MPEG4Extractor.cpp:179 5 libstagefright.so android::MPEG4Source::getFormat MPEG4Extractor.cpp:2190 6 libstagefright.so android::MPEG4Source::read MPEG4Extractor.cpp:2377 More reports at: https://crash-stats.mozilla.com/report/list?signature=android%3A%3AMediaStreamSource%3A%3AreadAt

I found folloiwng stack in all crashe logs. OmxDecoder should be destructed in MediaOmxReader::~MediaOmxReader(). But if there is a message in ALooper the destruction could be deffered. Need to fix it. ------------------------------------------------------------ 0 libc.so libc.so@0xd788 1 libstagefright.so android::OMXCodec::stop threads.h:289 2 libxul.so android::OmxDecoder::~OmxDecoder OmxDecoder.cpp:176 3 libxul.so android::OmxDecoder::~OmxDecoder OmxDecoder.cpp:183 4 libutils.so android::RefBase::decStrong RefBase.cpp:359 5 libxul.so android::AHandlerReflector<android::OmxDecoder>::onMessageReceived StrongPointer.h:149 6 libstagefright_foundation.so android::ALooperRoster::deliverMessage ALooperRoster.cpp:133 7 libstagefright_foundation.so android::ALooper::loop ALooper.cpp:212 8 libstagefright_foundation.so android::ALooper::LooperThread::threadLoop ALooper.cpp:47 9 libutils.so android::Thread::_threadLoop Threads.cpp:834 10 libutils.so thread_data_t::trampoline Threads.cpp:127 11 libc.so __thread_entry pthread.c:217 12 libc.so pthread_create pthread.c:357

It is also necessary to stop OMXCodec when MediaDecoderStateMachine come into DECODER_STATE_SHUTDOWN.

I found out this bug is dupe of Bug 880902. It have same stack as in comment #1 at Bug 880902 comment #0.