[webkit-changes] [WebKit/WebKit] f91aeb: [GStreamer][MSE] Crash in webKitMediaSrcStreamFlush

[Carlos Bentzen]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f91aeb92bd8ee8b8f6d7242afad4e07d5bfff6f3
      https://github.com/WebKit/WebKit/commit/f91aeb92bd8ee8b8f6d7242afad4e07d5bfff6f3
  Author: Carlos Bentzen <cadubentzen at igalia.com>
  Date:   2024-03-28 (Thu, 28 Mar 2024)

  Changed paths:
    A LayoutTests/media/media-source/media-source-muted-scroll-and-seek-crash-expected.txt
    A LayoutTests/media/media-source/media-source-muted-scroll-and-seek-crash.html
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  [GStreamer][MSE] Crash in webKitMediaSrcStreamFlush
https://bugs.webkit.org/show_bug.cgi?id=260455

Reviewed by Alicia Boya Garcia.

Fix crash and playback of video on https://www.apple.com/apple-watch-ultra-2/.
The video starts outside of the viewport and is played via MSE.

The issue was caused due to failing to transition the pipeline to PAUSED in
MediaPlayerPrivateGStreamer::setVisibleInViewport when an MSE video starts initially
outside of the viewport. That, in turn, is caused because we try to set playbin
to PAUSED without an URL set. Then, the media player pipeline gets stuck in READY,
while webkitmediasrc is in the PAUSED state. With this, the video never starts playing
back.

Moreover, scrolling the page for the video to be in and out of the viewport, it triggers
a downgrade state in webkitmediasrc to READY, which if coupled with a seek attempt then
causes a crash in WebKitMediaSourceGStreamer when flushing.

The fix is two-fold:
1. Avoid setting the state to PAUSED if no playbin URL has been set.
2. Avoid setting the state of the pipeline to READY in
   MediaPlayerPrivateGStreamer::setVisibleInViewport if the media player is MSE.

Added a test that triggers the described behavior and crashes without the fix. It scrolls
the page to move a video in and out of the viewport, while also seeking to the start on
every scroll. Currently, part of the code to trigger the crash isn't executed
due to WEBKIT_GST_ALLOW_PLAYBACK_OF_INVISIBLE_VIDEOS=1 being set in the test driver in
Tools/Scripts/webkitpy/port/glib.py (264017 at main), which needs to be commented manually.
We should find a way to add a test preference for this code path to be enabled.

* LayoutTests/media/media-source/media-source-muted-scroll-and-seek-crash-expected.txt: Added.
* LayoutTests/media/media-source/media-source-muted-scroll-and-seek-crash.html: Added.
* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::load): Set playbin URL before calling setVisibleInViewport.
(WebCore::MediaPlayerPrivateGStreamer::setVisibleInViewport): Avoid state transitions to READY if MSE
and avoid setting the pipeline to PAUSED if playbin URL is not set.

Canonical link: https://commits.webkit.org/276798@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications