It has been hit by two users in 25.0a1/20130731. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=73b69c146ca6&tochange=c2b375f3a909 It's likely a regression from bug 858914. Some users have preffed the OGL backend on. Signature mozilla::MediaPluginReader::ImageBufferCallback::operator()(unsigned int, unsigned int, MPAPI::ColorFormat) More Reports Search UUID 0b0751ba-e09b-4507-90e1-5a86f2130801 Date Processed 2013-08-01 00:05:00.677528 Uptime 13178 Last Crash 544488 seconds before submission Install Age 35496 since version was first installed. Install Time 2013-07-31 14:13:11 Product FennecAndroid Version 25.0a1 Build ID 20130731030203 Release Channel nightly OS Android OS Version 0.0.0 Linux 3.0.31-1130792 #2 SMP PREEMPT Mon Apr 15 19:05:47 KST 2013 armv7l samsung/d2spr/d2spr:4. Build Architecture arm Build Architecture Info ARMv0 | 2 Crash Reason SIGSEGV Crash Address 0x0 App Notes AdapterDescription: 'Qualcomm -- Adreno (TM) 225 -- OpenGL ES 2.0 V@2.1 AU@ (CL@) -- Model: SPH-L710, Product: d2spr, Manufacturer: samsung, Hardware: qcom' GL Layers! EGL? EGL+ GL Context? GL Context+ GL Layers+ Stagefright? Stagefright+ samsung SPH-L710 samsung/d2spr/d2spr:4.1.2/JZO54K/L710VPBMD4:user/release-keys Frame Module Signature Source 0 libxul.so mozilla::MediaPluginReader::ImageBufferCallback::operator()(unsigned int, unsigned int, MPAPI::ColorFormat) content/media/plugins/MediaPluginReader.cpp 1 libomxplugin.so (deleted) libomxplugin.so (deleted)@0x1617 2 libstagefright.so libstagefright.so@0x7f1f7 3 libomxplugin.so (deleted) libomxplugin.so (deleted)@0x173f 4 OMXCodec (deleted) OMXCodec (deleted)@0x77fffe 5 libstagefright_foundation.so libstagefright_foundation.so@0x9d8b 6 OMXCodec (deleted) OMXCodec (deleted)@0x77fffe 7 libomxplugin.so (deleted) libomxplugin.so (deleted)@0x1d67 8 OMXCodec (deleted) OMXCodec (deleted)@0x77fffe 9 libomxplugin.so (deleted) libomxplugin.so (deleted)@0x1e27 10 libxul.so mozilla::MediaPluginReader::DecodeVideoFrame(bool&, long long) content/media/plugins/MediaPluginReader.cpp 11 libxul.so mozilla::MediaDecoderReader::DecodeToFirstVideoData() content/media/MediaDecoderReader.cpp 12 libxul.so mozilla::MediaDecoderReader::FindStartTime(long long&) content/media/MediaDecoderReader.cpp 13 libxul.so mozilla::MediaDecoderStateMachine::FindStartTime() content/media/MediaDecoderStateMachine.cpp 14 libxul.so mozilla::MediaDecoderStateMachine::DecodeMetadata() content/media/MediaDecoderStateMachine.cpp 15 libxul.so mozilla::MediaDecoderStateMachine::DecodeThreadRun() content/media/MediaDecoderStateMachine.cpp 16 libxul.so nsRunnableMethodImpl<tag_nsresult (mozilla::dom::NotificationPermissionRequest::*)(), true>::Run() obj-firefox/dist/include/nsThreadUtils.h 17 libxul.so nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 18 libxul.so NS_ProcessNextEvent(nsIThread*, bool) obj-firefox/xpcom/build/nsThreadUtils.cpp 19 libxul.so nsThread::ThreadFunc(void*) xpcom/threads/nsThread.cpp 20 libnss3.so _pt_root nsprpub/pr/src/pthreads/ptthread.c 21 libc.so libc.so@0x12eb2 22 libc.so libc.so@0x1260a More reports at: https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=mozilla%3A%3AMediaPluginReader%3A%3AImageBufferCallback%3A%3Aoperator%28%29%28unsigned+int%2C+unsigned+int%2C+MPAPI%3A%3AColorFormat%29

It's #5 top crasher (#2 unfixed) in 25.0a1.

The breakdown per device is the following: Samsung GT-S5830i (Galaxy Ace) 8 Samsung SPH-L710 (Galaxy SIII LTE) 5 Motorola DROID RAZR HD 4

Per email conversation, nical will take this.

In one of the patches of Bug 858914 I needed to add a separate SharedRGBImage class that works with the new textures, some code directly refers to DeprecatedSharedRGBImage so I had to move some stuff into an interface (ISharedImage) shared by both SharedRGBImage and DeprecatedSharedRGBImage. Turns out I forgot to override AsSharedImage() in both classes which led to this crash. I am surprised this passed through our tests. This patch adds the proper AsSharedImage() overrides.

Comment on attachment 786371 [details] [diff] [review] Properly override AsSharedImage() [Approval Request Comment] Bug caused by (feature/regressing bug #): 858914 User impact if declined: Frequent crashes with video playback on android Testing completed (on m-c, etc.): just landed on m-c, fixes the crash Risk to taking this patch (and alternatives if risky): low risk, trivial patch. String or IDL/UUID changes made by this patch:

Reproducing every time I tap on Play button on Example 1 video from http://www.w3schools.com/html/html5_video.asp. Only reproducing on Gingerbread devices, not reproducing on Jelly Bean.

(In reply to Pop Mihai from comment #10) > Reproducing every time I tap on Play button on Example 1 video from > http://www.w3schools.com/html/html5_video.asp. Only reproducing on > Gingerbread devices, not reproducing on Jelly Bean. Does it happen in 26.0a1/20130809 or 25.0a2/20130810 (not yet released)?

I'm out of office right now, and can not test on a gingerbread device. However, the issue reproduces on 25.0a2/20130809. The fix may not hit that version of Aurora.