[Webkit-unassigned] [Bug 213197] [GStreamer] Rare racy crash when a sync bus message is handled during pipeline destruction

Thu Jun 25 02:32:50 PDT 2020

https://bugs.webkit.org/show_bug.cgi?id=213197

--- Comment #1 from Alicia Boya García <aboya at igalia.com> ---
I found another instance of this crash, albeit this time not from a bus message handler, but from the GL video sink preroll handler. The underlying issue is the same though, m_notifier being used on the background while MediaPlayerPrivateGStreamer destructor is running.

Thread 1 (Thread 0x7f255e55a700 (LWP 17949)):
#0  0x00007f260848e3b2 in WTFCrash() () at ../../Source/WTF/wtf/Assertions.cpp:295
#1  0x00007f2616705732 in CRASH_WITH_INFO(...) () at DerivedSources/ForwardingHeaders/wtf/Assertions.h:713
#2  0x00007f261af6d7cc in WebCore::MainThreadNotifier<WebCore::MediaPlayerPrivateGStreamer::MainThreadNotification>::notify<WebCore::MediaPlayerPrivateGStreamer::triggerRepaint(GstSample*)::<lambda()> >(WebCore::MediaPlayerPrivateGStreamer::MainThreadNotification, WebCore::MediaPlayerPrivateGStreamer::<lambda()> &&) (this=0x7f258637b1c0, notificationType=WebCore::MediaPlayerPrivateGStreamer::SizeChanged, callbackFunctor=...) at ../../Source/WebCore/platform/graphics/gstreamer/MainThreadNotifier.h:48
#3  0x00007f261af69880 in WebCore::MediaPlayerPrivateGStreamer::triggerRepaint(_GstSample*) (this=0x7f2586359c00, sample=0x561b879ed670 [GstSample]) at ../../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:3012
#4  0x00007f261af4f589 in <lambda(GstElement*, WebCore::MediaPlayerPrivateGStreamer*)>::operator()(GstElement *, WebCore::MediaPlayerPrivateGStreamer *) const (__closure=0x0, sink=0x561b87ff9e10 [GstAppSink|webkit-gl-video-appsink], player=0x7f2586359c00) at ../../Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp:231
#5  0x00007f261af4f5dc in <lambda(GstElement*, WebCore::MediaPlayerPrivateGStreamer*)>::_FUN(GstElement *, WebCore::MediaPlayerPrivateGStreamer *) () at ../../Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp:231
#6  0x00007f260006eb78 in ffi_call_unix64 () at ../src/x86/unix64.S:76
#7  0x00007f260006e374 in ffi_call (cif=cif at entry=0x7f255e558180, fn=fn at entry=0x7f261af4f5b7 <<lambda(GstElement*, WebCore::MediaPlayerPrivateGStreamer*)>::_FUN(GstElement *, WebCore::MediaPlayerPrivateGStreamer *)>, rvalue=<optimized out>, avalue=avalue at entry=0x7f255e5580b0) at ../src/x86/ffi64.c:525
#8  0x00007f26019da866 in g_cclosure_marshal_generic_va (closure=<optimized out>, return_value=<optimized out>, instance=<optimized out>, args_list=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=<optimized out>) at ../gobject/gclosure.c:1614
#9  0x00007f26019d9ab6 in _g_closure_invoke_va (closure=0x561b87ad6780, return_value=0x7f255e558370, instance=0x561b87ff9e10, args=0x7f255e558420, n_params=0, param_types=0x0) at ../gobject/gclosure.c:873
#10 0x00007f26019f8b68 in g_signal_emit_valist (instance=0x561b87ff9e10, signal_id=<optimized out>, detail=0, var_args=var_args at entry=0x7f255e558420) at ../gobject/gsignal.c:3407
#11 0x00007f26019f9113 in g_signal_emit (instance=instance at entry=0x561b87ff9e10, signal_id=<optimized out>, detail=detail at entry=0) at ../gobject/gsignal.c:3554
#12 0x00007f260235a8b8 in gst_app_sink_preroll (psink=0x561b87ff9e10 [GstAppSink|webkit-gl-video-appsink], buffer=<optimized out>) at ../gst-libs/gst/app/gstappsink.c:806
#13 0x00007f260230a751 in gst_base_sink_do_preroll (sink=sink at entry=0x561b87ff9e10 [GstAppSink|webkit-gl-video-appsink], obj=obj at entry=0x7f255409d7e0 [GstBuffer]) at ../libs/gst/base/gstbasesink.c:2447
#14 0x00007f260230b1c4 in gst_base_sink_do_sync (basesink=basesink at entry=0x561b87ff9e10 [GstAppSink|webkit-gl-video-appsink], obj=obj at entry=0x7f255409d7e0 [GstBuffer], late=late at entry=0x7f255e558730, step_end=step_end at entry=0x7f255e558734) at ../libs/gst/base/gstbasesink.c:2667
#15 0x00007f260230c85d in gst_base_sink_chain_unlocked (basesink=basesink at entry=0x561b87ff9e10 [GstAppSink|webkit-gl-video-appsink], obj=obj at entry=0x7f255409d7e0, is_list=is_list at entry=0, pad=<optimized out>) at ../libs/gst/base/gstbasesink.c:3616
#16 0x00007f260230db08 in gst_base_sink_chain_main (basesink=0x561b87ff9e10 [GstAppSink|webkit-gl-video-appsink], pad=<optimized out>, obj=0x7f255409d7e0, is_list=0) at ../libs/gst/base/gstbasesink.c:3775
#17 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f25380270a0 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#18 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f255409ae40 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#19 0x00007f2602217493 in gst_pad_push (pad=0x7f255409ae40 [GstPad|src], buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#20 0x00007f2602318420 in gst_base_transform_chain (pad=<optimized out>, parent=0x561b87f1cb30 [GstGLColorConvertElement|glcolorconvertelement10], buffer=<optimized out>) at ../libs/gst/base/gstbasetransform.c:2330
#21 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f2538093860 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#22 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f2538183a10 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#23 0x00007f2602217493 in gst_pad_push (pad=0x7f2538183a10 [GstPad|src], buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#24 0x00007f2602318420 in gst_base_transform_chain (pad=<optimized out>, parent=0x561b87f1c7c0 [GstGLUploadElement|gluploadelement10], buffer=<optimized out>) at ../libs/gst/base/gstbasetransform.c:2330
#25 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f25440193a0 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#26 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f2594030a40 [GstProxyPad|proxypad166], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#27 0x00007f2602217493 in gst_pad_push (pad=pad at entry=0x7f2594030a40 [GstProxyPad|proxypad166], buffer=buffer at entry=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#28 0x00007f26021fb69b in gst_proxy_pad_chain_default (pad=<optimized out>, parent=<optimized out>, buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstghostpad.c:127
#29 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f2538194950 [GstGhostPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#30 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f253802e350 [GstProxyPad|proxypad167], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#31 0x00007f2602217493 in gst_pad_push (pad=pad at entry=0x7f253802e350 [GstProxyPad|proxypad167], buffer=buffer at entry=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#32 0x00007f26021fb69b in gst_proxy_pad_chain_default (pad=<optimized out>, parent=<optimized out>, buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstghostpad.c:127
#33 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f2538194e50 [GstGhostPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#34 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f25380955b0 [GstGhostPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#35 0x00007f2602217493 in gst_pad_push (pad=pad at entry=0x7f25380955b0 [GstGhostPad|src], buffer=buffer at entry=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#36 0x00007f26021fb69b in gst_proxy_pad_chain_default (pad=<optimized out>, parent=<optimized out>, buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstghostpad.c:127
#37 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f25380eb8e0 [GstProxyPad|proxypad176], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#38 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f25540e8740 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#39 0x00007f2602217493 in gst_pad_push (pad=0x7f25540e8740 [GstPad|src], buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#40 0x00007f2602318420 in gst_base_transform_chain (pad=<optimized out>, parent=0x7f255400d0d0 [GstVideoConvert|conv2], buffer=<optimized out>) at ../libs/gst/base/gstbasetransform.c:2330
#41 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f25540e84f0 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#42 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f2538093610 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#43 0x00007f2602217493 in gst_pad_push (pad=0x7f2538093610 [GstPad|src], buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#44 0x00007f2602318420 in gst_base_transform_chain (pad=<optimized out>, parent=0x7f25540158e0 [GstVideoBalance|videobalance], buffer=<optimized out>) at ../libs/gst/base/gstbasetransform.c:2330
#45 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f253801cd00 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#46 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f25440185c0 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#47 0x00007f2602217493 in gst_pad_push (pad=0x7f25440185c0 [GstPad|src], buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#48 0x00007f2602318420 in gst_base_transform_chain (pad=<optimized out>, parent=0x7f25541448d0 [GstVideoScale|scale], buffer=<optimized out>) at ../libs/gst/base/gstbasetransform.c:2330
#49 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f255409b2e0 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#50 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f25540e8050 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#51 0x00007f2602217493 in gst_pad_push (pad=0x7f25540e8050 [GstPad|src], buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#52 0x00007f2602318420 in gst_base_transform_chain (pad=<optimized out>, parent=0x7f25540e7c10 [GstVideoConvert|conv], buffer=<optimized out>) at ../libs/gst/base/gstbasetransform.c:2330
#53 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f25540e82a0 [GstPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#54 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f2554024080 [GstProxyPad|proxypad175], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#55 0x00007f2602217493 in gst_pad_push (pad=pad at entry=0x7f2554024080 [GstProxyPad|proxypad175], buffer=buffer at entry=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#56 0x00007f26021fb69b in gst_proxy_pad_chain_default (pad=<optimized out>, parent=<optimized out>, buffer=0x7f255409d7e0 [GstBuffer]) at ../gst/gstghostpad.c:127
#57 0x00007f260220e43f in gst_pad_chain_data_unchecked (pad=pad at entry=0x7f2538095330 [GstGhostPad|sink], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4327
#58 0x00007f26022105a1 in gst_pad_push_data (pad=pad at entry=0x7f255401ae40 [GstPad|src], type=type at entry=4112, data=data at entry=0x7f255409d7e0) at ../gst/gstpad.c:4583
#59 0x00007f2602217493 in gst_pad_push (pad=0x7f255401ae40 [GstPad|src], buffer=buffer at entry=0x7f255409d7e0 [GstBuffer]) at ../gst/gstpad.c:4702
#60 0x00007f25bc2d8d44 in gst_queue_push_one (queue=0x561b87c689b0 [GstQueue|vqueue]) at ../plugins/elements/gstqueue.c:1384
#61 0x00007f25bc2d8d44 in gst_queue_loop (pad=<optimized out>) at ../plugins/elements/gstqueue.c:1537
#62 0x00007f2602245be7 in gst_task_func (task=0x7f255409d170 [GstTask|vqueue:src]) at ../gst/gsttask.c:328
#63 0x00007f2601918004 in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:354
#64 0x00007f2601917761 in g_thread_proxy (data=0x561b87c16d20) at ../glib/gthread.c:807
#65 0x00007f260296a5e2 in start_thread (arg=<optimized out>) at pthread_create.c:479
#66 0x00007f26005fb473 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200625/b007e241/attachment-0001.htm>