[Webkit-unassigned] [Bug 242395] New: [Media] Destroy media player on fatal playback error

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=242395

            Bug ID: 242395
           Summary: [Media] Destroy media player on fatal playback error
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Media
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: eocanha at igalia.com

Under some circumstances, the SourceBuffer.append() can generate an EOS internally in glib ports, which reaches HTMLMediaElement as DecodeError. This triggers detachMediaSource() while the player is still playing fine (it's not aware of any issue). Eventually, the player reaches EOS when running out of samples and the playback is ended. The JavaScript app may try to resume video with video.play(), triggering seek(0), which triggers other internal operations. One of those operations was a MediaPlayerPrivateGStreamerMSE::sourceSetup() call that was trying to setPrivateAndOpen() on the MediaSource that was already detached and this was crashing. The crash itself was fixed in https://bugs.webkit.org/show_bug.cgi?id=220091 by reopening MediaSource on load() only, but the player private still keeps this detached MediaSource that may cause different issues.

The proper way to avoid this invalid state where a reference to MediaSource is kept by the player private is to ensure that the player is destroyed on error. It will be recreated again if needed if a fresh src is set in the future.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220706/ccb4f407/attachment.htm>