An ogg_packet can be 0 bytes and apparently this is used in Theora. The keyframe check in theora_dec_chain_reverse doesn't handle this and segfaults.

The input is svt2-44100Hz.ogv from http://bugzilla-attachments.gnome.org/attachment.cgi?id=192617 with a test case like this:

<video src="svt2-44100Hz.ogv" controls></video>
<script>
var v = document.querySelector('video');
v.onsuspend = function() {
  v.currentTime = v.duration;
  v.playbackRate = -1;
  v.play();
};
v.preload = "auto";
</script>

In other words, seek to the end and try playing backwards. There will be a zero-byte buffer on the gather queue.

It doesn't play very well even with this fix, but at least it doesn't crash.