[webkit-changes] [WebKit/WebKit] 9a18e4: [ Sonoma Debug arm64]: ASSERTION FAILED: m_clients...

[Jean-Yves Avenard]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 9a18e435893e9e063fcfa1670952c0e9eedfe76f
      https://github.com/WebKit/WebKit/commit/9a18e435893e9e063fcfa1670952c0e9eedfe76f
  Author: Jean-Yves Avenard <jya at apple.com>
  Date:   2024-10-13 (Sun, 13 Oct 2024)

  Changed paths:
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/Modules/mediasource/MediaSource.cpp
    M Source/WebCore/Modules/mediasource/MediaSource.h
    M Source/WebCore/Modules/mediasource/MediaSourceInterfaceMainThread.cpp
    M Source/WebCore/Modules/mediasource/MediaSourceInterfaceMainThread.h
    M Source/WebCore/Modules/mediasource/MediaSourceInterfaceProxy.h
    M Source/WebCore/Modules/mediasource/MediaSourceInterfaceWorker.cpp
    M Source/WebCore/Modules/mediasource/MediaSourceInterfaceWorker.h
    M Source/WebCore/html/HTMLMediaElement.cpp

  Log Message:
  -----------
  [ Sonoma Debug arm64]: ASSERTION FAILED: m_clients.contains(client) in imported/w3c/web-platform-tests/media-source/URL-createObjectURL-null.html
https://bugs.webkit.org/show_bug.cgi?id=278659
rdar://134709579

Reviewed by Youenn Fablet.

This has been a long standing issue.
When the HTMLMediaElement was being destructed, it would call MediaSource::detachElement.
MediaSource::detachElement then goes through the official steps of detaching
all source buffers, which then detach the various tracks from the media element.
However, by that time the HTMLMediaElement is already mid-destruction. Its tracks
have already been detached.
Attempting to detach the tracks again would cause the assertion.

To disambiguate between when the MediaSource is being detached from the element
when the src/srcObject are being cleared from when the HTMLMediaElement is being
destructed, we add a new MediaSource::elementIsShuttingDown method which will
clear the MediaSource's link to the HTMLMediaElement. This will stop the MediaSource
from making re-entrant call into the media element while it's being destroyed.

Covered by existing tests.

* LayoutTests/platform/mac-wk2/TestExpectations:
* Source/WebCore/Modules/mediasource/MediaSource.cpp:
(WebCore::MediaSource::elementIsShuttingDown):
* Source/WebCore/Modules/mediasource/MediaSource.h:
* Source/WebCore/Modules/mediasource/MediaSourceInterfaceMainThread.cpp:
(WebCore::MediaSourceInterfaceMainThread::elementIsShuttingDown):
* Source/WebCore/Modules/mediasource/MediaSourceInterfaceMainThread.h:
* Source/WebCore/Modules/mediasource/MediaSourceInterfaceProxy.h:
* Source/WebCore/Modules/mediasource/MediaSourceInterfaceWorker.cpp:
(WebCore::MediaSourceInterfaceWorker::elementIsShuttingDown):
* Source/WebCore/Modules/mediasource/MediaSourceInterfaceWorker.h:
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::~HTMLMediaElement):

Canonical link: https://commits.webkit.org/285110@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications