After test the patch on https://bugzilla.mozilla.org/show_bug.cgi?id=879668 Bug 879668 - [MediaEncoder] Implement OmxTrackEncoder on B2G We found it would crash on copy data from video tags.

Hi Benjamin, Could you describe in detail?

Hi Marvin, I heard this feature comes from our partners, This one needs your input and we should have the requirement to finish this feature.

ah, wrong ni?

The root cause is that even though we hold a nsRefPtr<layers::Image>, the yuv data of this image still can be released. The release is triggered here: http://dxr.mozilla.org/mozilla-central/source/gfx/layers/client/ImageClient.cpp#150 Content process calls ImageClientSingle::UpdateImage -> TextureClient::ForceRemove() -> ipc to b2g process. b2g process calls PImageBridgeParent::DestroySharedMemory -> ipc to content process. Then the yuv data is released. b2g process call stack== 0 mozilla::layers::PImageBridgeParent::DestroySharedMemory (this=0xaffb7c00, shmem=...) at PImageBridgeParent.cpp:276 #1 0xb4ecb228 in mozilla::layers::PImageBridgeParent::DeallocShmem (this=<optimized out>, aMem=...) at PImageBridgeParent.cpp:816 #2 0xb505aa32 in mozilla::layers::ShmemTextureHost::DeallocateSharedData (this=0xb0f934c0) at ../../../../../../hg/mozilla-central/gfx/layers/composite/TextureHost.cpp:589 #3 0xb505b3f2 in mozilla::layers::TextureParent::ActorDestroy (this=0xb2bd5100, why=<optimized out>) at ../../../../../../hg/mozilla-central/gfx/layers/composite/TextureHost.cpp:704 #4 0xb4e9924c in mozilla::plugins::PBrowserStreamParent::DestroySubtree (this=0xb2bd5100, why=mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::Deletion) at PBrowserStreamParent.cpp:451 #5 0xb4f13fce in mozilla::layers::PTextureParent::Send__delete__ (actor=0xb2bd5100) at PTextureParent.cpp:69 #6 0xb4f17b64 in mozilla::layers::PTextureParent::OnMessageReceived (this=0xb2bd5100, __msg=...) at PTextureParent.cpp:209 #7 0xb4ed18ae in mozilla::layers::PImageBridgeParent::OnMessageReceived (this=0xaffb7c00, __msg=...) at PImageBridgeParent.cpp:380 #8 0xb4e86782 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0xaffb7c30, aMsg=...) at ../../../../../../hg/mozilla-central/ipc/glue/MessageChannel.cpp:992 #9 0xb4e884a0 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=<optimized out>) at ../../../../../../hg/mozilla-central/ipc/glue/MessageChannel.cpp:889 #10 0xb4e86234 in DispatchToMethod<mozilla::ipc::MessageChannel, void (mozilla::ipc::MessageChannel::*)()> (method= (void (mozilla::ipc::MessageChannel::*)(mozilla::ipc::MessageChannel * const)) 0xb4e88423 <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, obj=<optimized out>, arg=<optimized out>)

Moving to gfx, as the crash is happening in graphics.

remove this line works for sw decoder patch, but it caused problem for camera preview or other hw decoder path. http://dxr.mozilla.org/mozilla-central/source/gfx/layers/client/ImageClient.cpp#150

ImageClientSingle::UpdateImage(ImageContainer* aContainer, uint32_t aContentFlags) { ... if (mFrontBuffer) { GetForwarder()->AddForceRemovingTexture(mFrontBuffer); } The "AddForceRemovingTexture" API will add the texture to texture removed list. Inside ImageBridgeChild::EndTransaction, it will try to free the texture from the above texture removed list. But encoder still referred above texture which was free when next composition transaction finished. http://dxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/ImageBridgeChild.cpp#466 The correct way is separate the buffer lifecycle from composition transaction. And Bug 962101 is working on this part.

In my local, the patch from bug 962101 solved this issue.