[Android] VideoTexture using cause crash with some devices (mostly Samsung)

[itlancer]

Problem Description

VideoTexture using cause crash with some Android devices (mostly Samsung).

Tested with latest AIR 50.2.3.5 with different AIR applications and different Android devices, versions with different architectures.
Reproduced with:

• Samsung Galaxy A40 (SM-A405FM), Android 11
• Samsung Galaxy A5
• Samsung Galaxy S9

There is no such crash using Video or StageVideo.
There is no crash with some other devices too.

Related issues:
#2296
#2268
#2125
#1174
#1159
#587
#554
#92
#81
#16

Steps to Reproduce

Launch application with code below with any Samsung Android device. It just play video by VideoTexture in a loop.

Application example with sources, full log and video attached.
android_samsung_videotexture_crash.zip

package {
	import flash.display.Sprite;
	import flash.events.Event;
	import flash.display.Stage3D;
	import flash.display3D.Context3D;
	import flash.display3D.IndexBuffer3D;
	import flash.geom.Matrix3D;
	import flash.net.NetConnection;
	import flash.net.NetStream;
	import flash.display3D.textures.VideoTexture;
	import flash.events.NetStatusEvent;
	import flash.display3D.VertexBuffer3D;
	import flash.display3D.Context3DProgramType;
	import com.adobe.utils.AGALMiniAssembler;
	import flash.display3D.Program3D;
	import flash.display3D.Context3DVertexBufferFormat;
	import flash.desktop.NativeApplication;
	import flash.desktop.SystemIdleMode;
	
	public class AndroidVideoTextureArgumentError3672 extends Sprite {
		private var stage3D:Stage3D;
		private var context3D:Context3D;
		private var indexbuffer:IndexBuffer3D;
		private var matrix:Matrix3D = new Matrix3D();
		private var nc:NetConnection;
		private var ns:NetStream;
		private var videoTexture:VideoTexture;
		
		public function AndroidVideoTextureArgumentError3672() {
			NativeApplication.nativeApplication.systemIdleMode = SystemIdleMode.KEEP_AWAKE;
			
			stage3D = stage.stage3Ds[0];
			stage3D.addEventListener(Event.CONTEXT3D_CREATE, contextCreated);
			stage3D.requestContext3D();
		}
		
		private function contextCreated(event:Event):void {
			trace("contextCreated");
			
			context3D = stage.stage3Ds[0].context3D;
			context3D.enableErrorChecking = true;
			context3D.configureBackBuffer(300, 240, 4, false, false, true);
			trace(context3D.driverInfo);
			
			var vertices:Vector.<Number> = Vector.<Number>([
			1, -1, 0, 1, 0,
			1, 1, 0, 1, 1,
			-1, 1, 0, 0, 1,
			-1,-1, 0, 0, 0
			]);
			
			var vertexbuffer:VertexBuffer3D = context3D.createVertexBuffer(4, 5);
			vertexbuffer.uploadFromVector(vertices, 0, 4);
			
			indexbuffer = context3D.createIndexBuffer(6);
			indexbuffer.uploadFromVector(Vector.<uint>([0, 1, 2, 2, 3, 0]), 0, 6);
			
			var vertexShaderAssembler:AGALMiniAssembler = new AGALMiniAssembler();
			vertexShaderAssembler.assemble(Context3DProgramType.VERTEX, "m44 op, va0, vc0\n" + "mov v0, va1");
			
			var fragmentShaderAssembler:AGALMiniAssembler = new AGALMiniAssembler();
			fragmentShaderAssembler.assemble( Context3DProgramType.FRAGMENT, "tex ft1, v0, fs0 <2d,linear, nomip>\n" + "mov oc, ft1");
			
			var program:Program3D = context3D.createProgram();
			program.upload(vertexShaderAssembler.agalcode, fragmentShaderAssembler.agalcode);
			
			context3D.setVertexBufferAt(0, vertexbuffer, 0, Context3DVertexBufferFormat.FLOAT_3);
			context3D.setVertexBufferAt(1, vertexbuffer, 3, Context3DVertexBufferFormat.FLOAT_2);
			
			context3D.setProgram(program);
			matrix.appendScale(1, -1, 1);
			context3D.setProgramConstantsFromMatrix(Context3DProgramType.VERTEX, 0, matrix, true);
			
			startVideo();
		}
	
		private function netStatusHandlerVideoTexture(event:NetStatusEvent):void {
			trace(event.info.code);
			switch (event.info.code){
				case "NetConnection.Connect.Success":
					ns = new NetStream(nc);
					ns.addEventListener(NetStatusEvent.NET_STATUS, netStatusHandlerVideoTexture);
					ns.client = {onMetaData:getMetaVideoTexture, onPlayStatus:onPlayStatusVideoTexture};
					ns.play("video.mp4");
					videoTexture.attachNetStream(ns);
					
					videoTexture.addEventListener(Event.TEXTURE_READY, renderState);
					break;
				case "NetStream.Play.StreamNotFound":
					trace("Stream not found");
					break;
				case "NetStream.Play.Stop":
					videoTextureFinishedPlayback();
					break;
				default:
					break;
			}
		}
		
		private function startVideo():void {
			if (videoTexture != null){
				videoTexture.removeEventListener(Event.TEXTURE_READY, renderState);
				videoTexture.attachNetStream(null);
				videoTexture.dispose();
				videoTexture = null;
			}
			
			if (ns != null){
				ns.removeEventListener(NetStatusEvent.NET_STATUS, netStatusHandlerVideoTexture);
				ns.dispose();
				ns = null;
			}
			
			if (nc != null){
				nc.removeEventListener(NetStatusEvent.NET_STATUS, netStatusHandlerVideoTexture);
				nc.close();
			}
			
			
			videoTexture = context3D.createVideoTexture();
			context3D.setTextureAt(0, videoTexture);
			
			nc = new NetConnection();
			nc.addEventListener(NetStatusEvent.NET_STATUS, netStatusHandlerVideoTexture);
			nc.connect(null);
		}

		private function getMetaVideoTexture(mdata:Object):void {
			trace("metadataVideoTexture");
		}

		private function onPlayStatusVideoTexture(infoObject:Object):void {
			trace("onPlayStatusVideoTexture", infoObject.code);
			videoTextureFinishedPlayback();
		}
		
		private function renderState(e:Event):void {
			videoTexture.removeEventListener(Event.TEXTURE_READY, renderState);
			trace("renderState");
			render();
			addEventListener(Event.ENTER_FRAME, enterFrame);
		}
	
		private function enterFrame(event:Event):void {
			render();
		}

		private function render():void {
			context3D.clear(1, 0, 0, 1);
			if (videoTexture != null) context3D.drawTriangles(indexbuffer);
			context3D.present();
		}
		
		
		private function videoTextureFinishedPlayback():void {
			trace("videoTextureFinishedPlayback");
			
			removeEventListener(Event.ENTER_FRAME, enterFrame);
			startVideo();
		}
	
		private function netStatusHandlerVideo(event:NetStatusEvent):void {
			trace(event.info.code);
		}
		
		private function getMetaVideo(mdata:Object):void {
			trace("getMetaVideo");
		}

		private function onPlayStatusVideo(infoObject:Object):void {
			trace("onPlayStatusVideoTexture", infoObject.code);
		}
		
	}
}

Actual Result:
Application crash on start:

received crash request for pid 18282
performing dump of process 17600 (target tid = 18282)
pcf : 0x1012, 0 ,2 ,0 ,0 ,0 ,2, 5.1.0.12
thread id : 2, preenroll_flag : 0, nd cnt : 1, cso : 0, et : 0
FPBAuthService, 11619
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'samsung/a40ser/a40:11/RP1A.200720.012/A405FMPUU4CVK1:user/release-keys'
Revision: '4'
ABI: 'arm'
Timestamp: 2023-09-12 17:56:12+0300
pid: 17600, tid: 18282, name: ALooper  >>> android.videotexture.argumenterror3672 <<<
uid: 10444
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x174
Cause: null pointer dereference
    r0  00000000  r1  00000780  r2  00000438  r3  b563762d
    r4  b6416fc0  r5  00000001  r6  d95a0f8c  r7  b15ccfc8
    r8  b6416fc0  r9  d95a11c8  r10 00000780  r11 000ff000
    ip  e706b20c  sp  b15ccf98  lr  b567c68f  pc  b560496a
limitGPUFreq:: freq = -1
limitCPUFreq:: freq = -1
backtrace:
      #00 pc 000ea96a  /data/app/~~7dPrpyh_K06yoK2QyYNxOA==/android.videotexture.argumenterror3672-YZ7LSbU9D4chmiDcT-6ZLA==/lib/arm/libCore.so (BuildId: fcaa98c9abc3284b9a5d8feb7d1bd60aa2a7a088)
      #01 pc 0016268b  /data/app/~~7dPrpyh_K06yoK2QyYNxOA==/android.videotexture.argumenterror3672-YZ7LSbU9D4chmiDcT-6ZLA==/lib/arm/libCore.so (BuildId: fcaa98c9abc3284b9a5d8feb7d1bd60aa2a7a088)
      #02 pc 0016251f  /data/app/~~7dPrpyh_K06yoK2QyYNxOA==/android.videotexture.argumenterror3672-YZ7LSbU9D4chmiDcT-6ZLA==/lib/arm/libCore.so (BuildId: fcaa98c9abc3284b9a5d8feb7d1bd60aa2a7a088)
      #03 pc 0001654d  /system/lib/libwilhelm.so (player_handleMediaPlayerEventNotifications(int, int, int, void*)+720) (BuildId: 15986f865c61d64d5b2571f203b14b0e)
      #04 pc 0001b2df  /system/lib/libwilhelm.so (android::GenericPlayer::onNotify(android::sp<android::AMessage> const&)+246) (BuildId: 15986f865c61d64d5b2571f203b14b0e)
      #05 pc 000107dd  /system/lib/libstagefright_foundation.so (android::AHandler::deliverMessage(android::sp<android::AMessage> const&)+24) (BuildId: 346f4006de27286579979ace55b8b97a)
scanning sources haveAudio=0, haveVideo=1
instantiateDecoder() decoder is not NULL, return OK
      #06 pc 00012cf7  /system/lib/libstagefright_foundation.so (android::AMessage::deliver()+86) (BuildId: 346f4006de27286579979ace55b8b97a)
      #07 pc 00010f75  /system/lib/libstagefright_foundation.so (android::ALooper::loop()+520) (BuildId: 346f4006de27286579979ace55b8b97a)
      #08 pc 0000ef0d  /system/lib/libutils.so (android::Thread::_threadLoop(void*)+304) (BuildId: 0daf5815b0702b548cc37d1bcb708ffb)
      #09 pc 0006fc2f  /system/lib/libandroid_runtime.so (android::AndroidRuntime::javaThreadShell(void*)+86) (BuildId: 6987fb930734c5a0031b8ccf4471b588)
      #10 pc 0000e9cd  /system/lib/libutils.so (thread_data_t::trampoline(thread_data_t const*)+256) (BuildId: 0daf5815b0702b548cc37d1bcb708ffb)
      #11 pc 000aaf33  /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+40) (BuildId: fef5b751123147ea65bf3f4f798c9518)
      #12 pc 000642e3  /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30) (BuildId: fef5b751123147ea65bf3f4f798c9518)

Expected Result:
Application playback video in a loop.

Known Workarounds

none
Do not use VideoTexture.

[itlancer]

The same issue without using <disableMediaCodec>true</disableMediaCodec>:

 A/DEBUG: pid: 16216, tid: 16247, name: Thread-2  >>> android.videotexture.argumenterror3672 <<<
 A/DEBUG:     #00 pc 00108d22  /data/app/android.videotexture.argumenterror3672-H9GNd9pBQ0815lAD78HJFw==/lib/arm/libCore.so
 A/DEBUG:     #01 pc 0016df95  /data/app/android.videotexture.argumenterror3672-H9GNd9pBQ0815lAD78HJFw==/lib/arm/libCore.so
 A/DEBUG:     #02 pc 00164851  /data/app/android.videotexture.argumenterror3672-H9GNd9pBQ0815lAD78HJFw==/lib/arm/libCore.so
 A/DEBUG:     #03 pc 0011b585  /data/app/android.videotexture.argumenterror3672-H9GNd9pBQ0815lAD78HJFw==/lib/arm/libCore.so
 A/DEBUG:     #04 pc 00124135  /data/app/android.videotexture.argumenterror3672-H9GNd9pBQ0815lAD78HJFw==/lib/arm/libCore.so
 A/DEBUG:     #05 pc 003acc0b  /data/app/android.videotexture.argumenterror3672-H9GNd9pBQ0815lAD78HJFw==/lib/arm/libCore.so
W/ActivityManager: crash : android.videotexture.argumenterror3672,0

[itlancer]

Fixed with latest AIR 50.2.3.7.
Thanks!