[Webkit-unassigned] [Bug 183632] New: Race Condition in MediaPlayerPrivateMediaStreamAVFObjC::requestNotificationWhenReadyForVideoData causes crash/segfault.

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Mar 14 08:06:05 PDT 2018


https://bugs.webkit.org/show_bug.cgi?id=183632

            Bug ID: 183632
           Summary: Race Condition in
                    MediaPlayerPrivateMediaStreamAVFObjC::requestNotificat
                    ionWhenReadyForVideoData causes crash/segfault.
           Product: WebKit
           Version: Safari 11
          Hardware: Macintosh
                OS: macOS 10.13
            Status: NEW
          Severity: Major
          Priority: P2
         Component: Media Elements
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jthomas at hirevue.com

I have a web application that makes heavy use of HTML5 video elements.

It appears that when creating/destroying these video elements leads to an intermittent crash in Safari that looks like it's related to the callback in
requestNotificationWhenReadyForVideo:

```
    [m_sampleBufferDisplayLayer requestMediaDataWhenReadyOnQueue:dispatch_get_main_queue() usingBlock:^ {
        [m_sampleBufferDisplayLayer stopRequestingMediaData];

```

I assume what is happening is it is trying to dispatch stopRequestingMediaData on the main thread, but by the time the callback occurs, m_sampleBufferDisplayLayer has been released.

I am very reliably seeing it crash for multiple users in the exact location of the callback that is getting dispatched on main:

Process:               com.apple.WebKit.WebContent [4915]
Path:                  /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
Identifier:            com.apple.WebKit.WebContent
Version:               13604 (13604.5.6)
Build Info:            WebKit2-7604005006000000~4
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Safari [4896]
User ID:               501

Date/Time:             2018-02-16 12:59:48.599 -0700
OS Version:            Mac OS X 10.13.3 (17D47)
Report Version:        12
Anonymous UUID:        C456DFCB-0DBD-6CEE-2F31-1DA484FBE3DE

Sleep/Wake UUID:       E2FA000B-532E-4FA4-8DF1-CA99531A8A76

Time Awake Since Boot: 560000 seconds
Time Since Wake:       5200 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000100000018
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [0]

VM Regions Near 0x100000018:
--> 
    __TEXT                 0000000102707000-0000000102709000 [    8K] r-x/rwx SM=COW    [/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent]

Application Specific Information:
objc_msgSend() selector name: stopRequestingMediaData
Bundle controller class:
BrowserBundleController


Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib                     0x00007fff6e424e9d objc_msgSend + 29
1   com.apple.WebCore                   0x00007fff554c01b6 invocation function for block in WebCore::MediaPlayerPrivateMediaStreamAVFObjC::requestNotificationWhenReadyForVideoData() + 38
2   com.apple.avfoundation              0x00007fff439df9d5 -[AVMediaDataRequester _requestMediaDataIfReady] + 106
3   libdispatch.dylib                   0x00007fff6eff0591 _dispatch_call_block_and_release + 12
4   libdispatch.dylib                   0x00007fff6efe8d50 _dispatch_client_callout + 8
5   libdispatch.dylib                   0x00007fff6eff432d _dispatch_main_queue_callback_4CF + 1148
6   com.apple.CoreFoundation            0x00007fff4774d929 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 9
7   com.apple.CoreFoundation            0x00007fff4770fbea __CFRunLoopRun + 2586
8   com.apple.CoreFoundation            0x00007fff4770ef43 CFRunLoopRunSpecific + 483
9   com.apple.HIToolbox                 0x00007fff46a26e26 RunCurrentEventLoopInMode + 286
10  com.apple.HIToolbox                 0x00007fff46a26b96 ReceiveNextEventCommon + 613
11  com.apple.HIToolbox                 0x00007fff46a26914 _BlockUntilNextEventMatchingListInModeWithFilter + 64
12  com.apple.AppKit                    0x00007fff44cf1f5f _DPSNextEvent + 2085
13  com.apple.AppKit                    0x00007fff45487b4c -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044
14  com.apple.AppKit                    0x00007fff44ce6d6d -[NSApplication run] + 764
15  com.apple.AppKit                    0x00007fff44cb5f1a NSApplicationMain + 804
16  libxpc.dylib                        0x00007fff6f2ef42f _xpc_objc_main + 580
17  libxpc.dylib                        0x00007fff6f2ee082 xpc_main + 417
18  com.apple.WebKit.WebContent         0x00000001027086a1 0x102707000 + 5793
19  libdyld.dylib                       0x00007fff6f022115 start + 1

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180314/f67f1f64/attachment-0001.html>


More information about the webkit-unassigned mailing list