[Webkit-unassigned] [Bug 214073] New: [MediaStream][GStreamer] MediaStreamTrackPrivate unref'ed from streaming thread

Wed Jul 8 01:33:55 PDT 2020

https://bugs.webkit.org/show_bug.cgi?id=214073

            Bug ID: 214073
           Summary: [MediaStream][GStreamer] MediaStreamTrackPrivate
                    unref'ed from streaming thread
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKitGTK
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: aboya at igalia.com
                CC: bugs-noreply at webkitgtk.org

This is the code:

struct ProbeData {
    WTF_MAKE_STRUCT_FAST_ALLOCATED;
    ProbeData(GstElement* element, GstStaticPadTemplate* padTemplate, RefPtr<MediaStreamTrackPrivate> track)
        : element(element)
        , padTemplate(padTemplate)
        , track(track) { }

    GRefPtr<GstElement> element;
    GstStaticPadTemplate* padTemplate;
    RefPtr<MediaStreamTrackPrivate> track;
};

[...]

        gst_pad_add_probe(pad.get(), GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM, reinterpret_cast<GstPadProbeCallback>(webkitMediaStreamSrcPadProbeCb), data, [](gpointer data) {
            delete reinterpret_cast<ProbeData*>(data);
        });

MediaStreamTrackPrivate is not ThreadSafeRefCounted, so it is not safe to unref from non-main thread.

If MediaStreamTrackPrivate is guaranteed to be alive by the time the probe runs, use a plain old pointer instead of RefPtr for MediaStreamTrackPrivate. Otherwise, if holding a reference inside the probe (which will run in the streaming thread) is desirable, make MediaStreamTrackPrivate inherit from ThreadSafeRefCounted.

STDERR: ASSERTION FAILED: Unsafe to ref/deref from different threadsASSERTION FAILED: Unsafe to ref/deref from different threads
STDERR: m_isOwnedByMainThread == isMainThread()

Thread 1 (Thread 0x7f43318fe700 (LWP 640)):
#0  0x00007f438b7bdfc2 in WTFCrash() () at ../../Source/WTF/wtf/Assertions.cpp:295
#1  0x00007f4399b41453 in WTF::RefCountedBase::applyRefDerefThreadingCheck() const (this=0x7f433073ec48) at DerivedSources/ForwardingHeaders/wtf/RefCounted.h:114
#2  0x00007f4399b414f0 in WTF::RefCountedBase::derefBase() const (this=0x7f433073ec48) at DerivedSources/ForwardingHeaders/wtf/RefCounted.h:130
#3  0x00007f439b2738a5 in WTF::RefCounted<WebCore::MediaStreamTrackPrivate, std::default_delete<WebCore::MediaStreamTrackPrivate> >::deref() const (this=0x7f433073ec48) at DerivedSources/ForwardingHeaders/wtf/RefCounted.h:189
#4  0x00007f439b273290 in WTF::derefIfNotNull<WebCore::MediaStreamTrackPrivate>(WebCore::MediaStreamTrackPrivate*) (ptr=0x7f433073ec30) at DerivedSources/ForwardingHeaders/wtf/RefPtr.h:44
#5  0x00007f439b2726ce in WTF::RefPtr<WebCore::MediaStreamTrackPrivate, WTF::DumbPtrTraits<WebCore::MediaStreamTrackPrivate> >::~RefPtr() (this=0x7f433074e118, __in_chrg=<optimized out>) at DerivedSources/ForwardingHeaders/wtf/RefPtr.h:70
#6  0x00007f439b272118 in ProbeData::~ProbeData() (this=0x7f433074e108, __in_chrg=<optimized out>) at ../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:450
#7  0x00007f439b26f8a6 in <lambda(gpointer)>::operator()(gpointer) const (__closure=0x0, data=0x7f433074e108) at ../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:500
#8  0x00007f439b26f8d3 in <lambda(gpointer)>::_FUN(gpointer) () at ../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:501
#9  0x00007f4384ba1f7d in g_hook_free (hook_list=0x5634ab9565e8, hook=0x5634ab5d3240) at ../glib/ghook.c:302
#10 0x00007f4384ba2486 in g_hook_next_valid (hook_list=<optimized out>, hook=<optimized out>, may_be_in_call=<optimized out>) at ../glib/ghook.c:757
#11 0x00007f4384ba28ae in g_hook_list_marshal (hook_list=hook_list at entry=0x5634ab9565e8, may_recurse=may_recurse at entry=1, marshaller=marshaller at entry=0x7f43854d2440 <probe_hook_marshal>, data=data at entry=0x7f43318fd800) at ../glib/ghook.c:676
#12 0x00007f43854d1ede in do_probe_callbacks (pad=pad at entry=0x5634ab956550 [GstPad|src], info=<optimized out>, defaultval=defaultval at entry=GST_FLOW_OK) at ../gst/gstpad.c:3728
#13 0x00007f43854d5617 in gst_pad_push_event_unchecked (pad=pad at entry=0x5634ab956550 [GstPad|src], event=0x7f4320007df0 [GstEvent], type=type at entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../gst/gstpad.c:5376
#14 0x00007f43854d5bca in push_sticky (pad=pad at entry=0x5634ab956550 [GstPad|src], ev=ev at entry=0x7f43318fda10, user_data=user_data at entry=0x7f43318fda80) at ../gst/gstevent.h:438
#15 0x00007f43854d3520 in events_foreach (pad=pad at entry=0x5634ab956550 [GstPad|src], func=func at entry=0x7f43854d5b70 <push_sticky>, user_data=user_data at entry=0x7f43318fda80) at ../gst/gstpad.c:608
#16 0x00007f43854de491 in check_sticky (event=0x7f4320007df0 [GstEvent], pad=0x5634ab956550 [GstPad|src]) at ../gst/gstpad.c:3986
#17 0x00007f43854de491 in gst_pad_push_event (pad=0x5634ab956550 [GstPad|src], event=event at entry=0x7f4320007df0 [GstEvent]) at ../gst/gstpad.c:5542
#18 0x00007f43855d8a38 in gst_base_src_send_stream_start (src=src at entry=0x5634ab17b610 [GstAppSrc|appsrc1]) at ../libs/gst/base/gstbasesrc.c:916
#19 0x00007f43855d92e8 in gst_base_src_send_stream_start (src=0x5634ab17b610 [GstAppSrc|appsrc1]) at ../libs/gst/base/gstbasesrc.c:3401
#20 0x00007f43855d92e8 in gst_base_src_loop (pad=0x5634ab956550 [GstPad|src]) at ../libs/gst/base/gstbasesrc.c:2797
#21 0x00007f438550bbe7 in gst_task_func (task=0x5634ab586a70 [GstTask|appsrc1:src]) at ../gst/gsttask.c:328
#22 0x00007f4384bdd004 in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:354
#23 0x00007f4384bdc761 in g_thread_proxy (data=0x5634ab42cb60) at ../glib/gthread.c:807
#24 0x00007f4385c305e2 in start_thread (arg=<optimized out>) at pthread_create.c:479
#25 0x00007f43838c0473 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200708/cb4e00e3/attachment.htm>