[Mp4-tech] [video] Error concealment - unreferenced memory error

[Steve]

Hi experts,
I have been working with JM93 to look at error concealment, specifically the
way that the decoder tries to hide any missing data. In order to achieve
this I have been adding something similar to:
  img->mb_data[207].ei_flag = 1;
in image.c after line 1206:
  ...
  //! mark the start of the first segment
  if (!dec_picture->MbaffFrameFlag)
  {
    ercStartSegment(0, ercSegment, 0 , erc_errorVar);  // <-- 1206
  ...
For the most part this method seems to work extremely well however under
some circumstances the decoder is throwing an unreferenced memory error due
to the Motion Vector reference slice being set to -1. One such example of
this is in a cif version of mobile.yuv when ProfileIDC = 100 (High) is used
at macroblock 207 (w=9, h=9), frame 18 (all frames up to 15 in the decode
sequence work ok).
>From what I can tell there are only two lines that ever set the mv[2]
variable to anything other than 0 and these are again in image.c:
  pRegion->mv[2] = (dec_picture->ref_idx[idx][ii][jj]);
or
  pRegion->mv[2] = dec_picture->ref_idx[LIST_0][ii][jj];
depending on the type of slice (non-B or B).
I'm wondering if anybody can shed any light onto why this variable would
ever be set to -1, judging by the rest of the EC code it looks like it
assumes that this variable is always going to contain a valid number as no
checking appears to be done. One working theory I currently have is that it
could be referencing a slice that has either not yet been decoded or is no
longer in the decode buffer. Also can anybody suggest where to find the
information to detect if the returned value is valid or not and what action
should be taken in the cases where it is invalid?
If it is the case that I'm barking up the wrong tree here (which is more
than possible) then can anyone suggest a better method of forcefully adding
errors at the decoder?
Many thanks in advance,
Steve Beesley