diff --git a/media/liboggplay/README_MOZILLA b/media/liboggplay/README_MOZILLA
index aa86850e2efa..64dfe3ac548f 100644
--- a/media/liboggplay/README_MOZILLA
+++ b/media/liboggplay/README_MOZILLA
@@ -36,6 +36,8 @@ handle-read-errors.patch: Make oggplay_initialise() handle closing of stream
                           while reading. Prevents infinite loop. Further fix
                           to 17ef4ca82df28.
 
+bug515217.patch: Fix crash where presentation thread releases a buffer just
+                 before decode thread tries to set that buffer as the last at EOF.
 bug504843.patch: Abort when decoding video excessively large video frames.
 
 fishsound_reset.patch: Fixes bug 516323.
diff --git a/media/liboggplay/bug515217.patch b/media/liboggplay/bug515217.patch
new file mode 100644
index 000000000000..74accd7b0d73
--- /dev/null
+++ b/media/liboggplay/bug515217.patch
@@ -0,0 +1,98 @@
+diff --git a/media/liboggplay/src/liboggplay/oggplay.c b/media/liboggplay/src/liboggplay/oggplay.c
+--- a/media/liboggplay/src/liboggplay/oggplay.c
++++ b/media/liboggplay/src/liboggplay/oggplay.c
+@@ -746,29 +746,27 @@ read_more_data:
+         * set all of the tracks to inactive
+         */
+         for (i = 0; i < me->num_tracks; i++) {
+           me->decode_data[i]->active = 0;
+         }
+         me->active_tracks = 0;
+ 
+         if (info != NULL) {
++          /* ensure all tracks have their final data packet set to end_of_stream */
++          OggPlayCallbackInfo *p = info[0];
++          for (i = 0; i < me->num_tracks; i++) {
++            p->stream_info = OGGPLAY_STREAM_LAST_DATA;
++            p++;
++          }
++
+           me->callback (me, num_records, info, me->callback_user_ptr);
+           oggplay_callback_info_destroy(me, info);
+         }
+ 
+-        /*
+-        * ensure all tracks have their final data packet set to end_of_stream
+-        * But skip doing this if we're shutting down --- me->buffer may not
+-        * be in a safe state.
+-        */
+-        if (me->buffer != NULL && !me->shutdown) {
+-          oggplay_buffer_set_last_data(me, me->buffer);
+-        }
+-
+         /* we reached the end of the stream */
+         return E_OGGPLAY_OK;
+               
+       case OGGZ_ERR_HOLE_IN_DATA:
+         /* there was a whole in the data */
+         return E_OGGPLAY_BAD_INPUT;
+ 
+       case OGGZ_ERR_STOP_ERR:
+diff --git a/media/liboggplay/src/liboggplay/oggplay_buffer.c b/media/liboggplay/src/liboggplay/oggplay_buffer.c
+--- a/media/liboggplay/src/liboggplay/oggplay_buffer.c
++++ b/media/liboggplay/src/liboggplay/oggplay_buffer.c
+@@ -138,38 +138,16 @@ oggplay_buffer_is_full(volatile OggPlayB
+       buffer->buffer_list[WRAP_INC(buffer->last_filled, buffer->buffer_size)]
+       !=
+       NULL
+     )
+   );
+ 
+ }
+ 
+-void
+-oggplay_buffer_set_last_data(OggPlay *me, volatile OggPlayBuffer *buffer) 
+-{
+-
+-  int                   i;
+-  OggPlayCallbackInfo   *p;
+-
+-  /*
+-   * we're at last data before we've even started!
+-   */
+-  if (buffer->last_filled == -1) {
+-    return;
+-  }
+-
+-  p = (OggPlayCallbackInfo *)buffer->buffer_list[buffer->last_filled];
+-
+-  for (i = 0; i < me->num_tracks; i++) {
+-    p->stream_info = OGGPLAY_STREAM_LAST_DATA;
+-    p++;
+-  }
+-}
+-
+ int
+ oggplay_buffer_callback(OggPlay *me, int tracks,
+                         OggPlayCallbackInfo **track_info, void *user) {
+ 
+   int                   i;
+   int                   j;
+   int                   k;
+   OggPlayDataHeader  ** headers;
+diff --git a/media/liboggplay/src/liboggplay/oggplay_buffer.h b/media/liboggplay/src/liboggplay/oggplay_buffer.h
+--- a/media/liboggplay/src/liboggplay/oggplay_buffer.h
++++ b/media/liboggplay/src/liboggplay/oggplay_buffer.h
+@@ -53,12 +53,9 @@ int
+ oggplay_buffer_is_full(volatile OggPlayBuffer *buffer);
+ 
+ void
+ oggplay_buffer_shutdown(OggPlay *me, volatile OggPlayBuffer *buffer);
+ 
+ void
+ oggplay_buffer_prepare(OggPlay *me);
+ 
+-void
+-oggplay_buffer_set_last_data(OggPlay *me, volatile OggPlayBuffer *buffer);
+-
+ #endif
diff --git a/media/liboggplay/src/liboggplay/oggplay.c b/media/liboggplay/src/liboggplay/oggplay.c
index 6849a4b185ba..54899ea41789 100644
--- a/media/liboggplay/src/liboggplay/oggplay.c
+++ b/media/liboggplay/src/liboggplay/oggplay.c
@@ -757,19 +757,17 @@ read_more_data:
         me->active_tracks = 0;
 
         if (info != NULL) {
+          /* ensure all tracks have their final data packet set to end_of_stream */
+          OggPlayCallbackInfo *p = info[0];
+          for (i = 0; i < me->num_tracks; i++) {
+            p->stream_info = OGGPLAY_STREAM_LAST_DATA;
+            p++;
+          }
+
           me->callback (me, num_records, info, me->callback_user_ptr);
           oggplay_callback_info_destroy(me, info);
         }
 
-        /*
-        * ensure all tracks have their final data packet set to end_of_stream
-        * But skip doing this if we're shutting down --- me->buffer may not
-        * be in a safe state.
-        */
-        if (me->buffer != NULL && !me->shutdown) {
-          oggplay_buffer_set_last_data(me, me->buffer);
-        }
-
         /* we reached the end of the stream */
         return E_OGGPLAY_OK;
               
diff --git a/media/liboggplay/src/liboggplay/oggplay_buffer.c b/media/liboggplay/src/liboggplay/oggplay_buffer.c
index 34667ac29b7e..b51d8be4ddf3 100644
--- a/media/liboggplay/src/liboggplay/oggplay_buffer.c
+++ b/media/liboggplay/src/liboggplay/oggplay_buffer.c
@@ -143,28 +143,6 @@ oggplay_buffer_is_full(volatile OggPlayBuffer *buffer) {
 
 }
 
-void
-oggplay_buffer_set_last_data(OggPlay *me, volatile OggPlayBuffer *buffer) 
-{
-
-  int                   i;
-  OggPlayCallbackInfo   *p;
-
-  /*
-   * we're at last data before we've even started!
-   */
-  if (buffer->last_filled == -1) {
-    return;
-  }
-
-  p = (OggPlayCallbackInfo *)buffer->buffer_list[buffer->last_filled];
-
-  for (i = 0; i < me->num_tracks; i++) {
-    p->stream_info = OGGPLAY_STREAM_LAST_DATA;
-    p++;
-  }
-}
-
 int
 oggplay_buffer_callback(OggPlay *me, int tracks,
                         OggPlayCallbackInfo **track_info, void *user) {
diff --git a/media/liboggplay/src/liboggplay/oggplay_buffer.h b/media/liboggplay/src/liboggplay/oggplay_buffer.h
index 7a389769aa03..76ffb5a3dfee 100644
--- a/media/liboggplay/src/liboggplay/oggplay_buffer.h
+++ b/media/liboggplay/src/liboggplay/oggplay_buffer.h
@@ -58,7 +58,4 @@ oggplay_buffer_shutdown(OggPlay *me, volatile OggPlayBuffer *buffer);
 void
 oggplay_buffer_prepare(OggPlay *me);
 
-void
-oggplay_buffer_set_last_data(OggPlay *me, volatile OggPlayBuffer *buffer);
-
 #endif
diff --git a/media/liboggplay/update.sh b/media/liboggplay/update.sh
index 833f8e4e2042..d129e4e62012 100644
--- a/media/liboggplay/update.sh
+++ b/media/liboggplay/update.sh
@@ -61,3 +61,4 @@ patch -p3 < handle-read-errors.patch
 patch -p3 < fishsound_reset.patch
 patch -p3 < bug504843.patch
 patch -p3 < bug520493.patch
+patch -p3 < bug515217.patch