[Webkit-unassigned] [Bug 223674] New: REGRESSION(r274870) fast/canvas/webgl/texImage2D-mse-flipY-true.html and fast/canvas/webgl/texImage2D-mse-flipY-false.html are crashing

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=223674

            Bug ID: 223674
           Summary: REGRESSION(r274870)
                    fast/canvas/webgl/texImage2D-mse-flipY-true.html and
                    fast/canvas/webgl/texImage2D-mse-flipY-false.html are
                    crashing
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebGL
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: lmoura at igalia.com
                CC: dino at apple.com, kbr at google.com, kkinnunen at apple.com

Created attachment 424099

  --> https://bugs.webkit.org/attachment.cgi?id=424099&action=review

Debug crash

fast/canvas/webgl/texImage2D-mse-flipY-false.html
fast/canvas/webgl/texImage2D-mse-flipY-true.html

Results dashboard: https://results.webkit.org/?suite=layout-tests&test=fast%2Fcanvas%2Fwebgl%2FtexImage2D-mse-flipY-true.html

Trace from debug test:

Thread 1 (Thread 0x7fb4ba1509c0 (LWP 22835)):
#0  WebCore::PlaybackPipeline::addSourceBuffer(WTF::RefPtr<WebCore::SourceBufferPrivateGStreamer, WTF::RawPtrTraits<WebCore::SourceBufferPrivateGStreamer>, WTF::DefaultRefDerefTraits<WebCore::SourceBufferPrivateGStreamer> >) (this=0x7fb470461000, sourceBufferPrivate=...) at ../../Source/WebCore/platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:106
#1  0x00007fb4c85dbb90 in WebCore::MediaSourcePrivateGStreamer::addSourceBuffer(WebCore::ContentType const&, bool, WTF::RefPtr<WebCore::SourceBufferPrivate, WTF::RawPtrTraits<WebCore::SourceBufferPrivate>, WTF::DefaultRefDerefTraits<WebCore::SourceBufferPrivate> >&) (this=0x7fb4704bcc60, contentType=..., sourceBufferPrivate=...) at ../../Source/WebCore/platform/graphics/gstreamer/mse/MediaSourcePrivateGStreamer.cpp:85
#2  0x00007fb4c61397dd in WebCore::MediaSource::createSourceBufferPrivate(WebCore::ContentType const&) (this=0x7fb47950d6f0, incomingType=...) at ../../Source/WebCore/Modules/mediasource/MediaSource.cpp:1094
#3  0x00007fb4c6138231 in WebCore::MediaSource::addSourceBuffer(WTF::String const&) (this=0x7fb47950d6f0, type=...) at ../../Source/WebCore/Modules/mediasource/MediaSource.cpp:734
#4  0x00007fb4c5703721 in WebCore::jsMediaSourcePrototypeFunction_addSourceBufferBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::IDLOperation<WebCore::JSMediaSource>::ClassParameter) (lexicalGlobalObject=0x7fb4780d5668, callFrame=0x7ffcdcaf43c0, castedThis=0x7fb4704793c8) at DerivedSources/WebCore/JSMediaSource.cpp:467
#5  0x00007fb4c570a5db in WebCore::IDLOperation<WebCore::JSMediaSource>::call<WebCore::jsMediaSourcePrototypeFunction_addSourceBufferBody>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) (lexicalGlobalObject=..., callFrame=..., operationName=0x7fb4ca76d36f "addSourceBuffer") at ../../Source/WebCore/bindings/js/JSDOMOperation.h:55
#6  0x00007fb4c57037d3 in WebCore::jsMediaSourcePrototypeFunction_addSourceBuffer(JSC::JSGlobalObject*, JSC::CallFrame*) (lexicalGlobalObject=0x7fb4780d5668, callFrame=0x7ffcdcaf43c0) at DerivedSources/WebCore/JSMediaSource.cpp:472
#7  0x00007fb4795331d8 in  ()
#8  0x00007ffcdcaf4450 in  ()
#9  0x00007fb4bec98ab3 in llint_op_call () at /app/webkit/Source/JavaScriptCore/llint/LowLevelInterpreter.asm:1093
#10 0x0000000000000000 in  ()

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210324/7a69cd12/attachment-0001.htm>