[Webkit-unassigned] [Bug 125411] [GTK] media/video-preload.html is flakily crashing on WK2

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=125411





--- Comment #8 from Brendan Long <b.long at cablelabs.com>  2013-12-09 10:12:11 PST ---
I added some locking, copy the GstTagList before returning it, and added a bunch of ASSERTs, and still get the same messages. Even with something like this:

        static void webkitTextCombinerPadGetProperty(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
        {
            WebKitTextCombinerPad* pad = WEBKIT_TEXT_COMBINER_PAD(object);
            switch (propertyId) {
            case PROP_PAD_TAGS: {
                GST_OBJECT_LOCK(object);
                ASSERT(GST_IS_TAG_LIST(pad->tags));
                ASSERT(GST_OBJECT_REFCOUNT(pad->tags) > 0);
                GstTagList* tags = gst_tag_list_copy(pad->tags);
                ASSERT(GST_IS_TAG_LIST(tags));
                ASSERT(GST_OBJECT_REFCOUNT(tags) > 0);
                g_value_set_boxed(value, tags);
                GST_OBJECT_UNLOCK(object);
                break;
            }
            default:
                G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyId, pspec);
                break;
            }
        }

I'll get an error message in g_object_unset in g_object_get_valist:

    (DumpRenderTree:541): GStreamer-CRITICAL **: __gst_tag_list_free: assertion 'GST_IS_TAG_LIST (list)' failed

How can that possibly not be a GstTagList?

The relevant snippet in g_object_get_valist is:

      object_get_property (object, pspec, &value);

      G_VALUE_LCOPY (&value, var_args, 0, &error);
      if (error)
    {
      g_warning ("%s: %s", G_STRFUNC, error);
      g_free (error);
      g_value_unset (&value);
      break;
    }

      g_value_unset (&value);

And object_get_property just runs some checks and then runs:

    class->get_property (object, param_id, value, pspec);

So, somehow things are going run somewhere around here.

Since nothing makes sense, maybe it's stack smashing, but I don't see anywhere where the stack could get smashed :\

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.