[Webkit-unassigned] [Bug 259280] New: [GStreamer] UI process crash in MediaPlayerPrivateGStreamer::codecForStreamId
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Jul 17 11:07:23 PDT 2023
https://bugs.webkit.org/show_bug.cgi?id=259280
Bug ID: 259280
Summary: [GStreamer] UI process crash in
MediaPlayerPrivateGStreamer::codecForStreamId
Product: WebKit
Version: WebKit Nightly Build
Hardware: PC
OS: Linux
Status: NEW
Severity: Normal
Priority: P2
Component: Media
Assignee: webkit-unassigned at lists.webkit.org
Reporter: mcatanzaro at redhat.com
CC: bugs-noreply at webkitgtk.org
I hit this UI process crash randomly on the homepage of youtube.com. Notice the scary this=0x0 in frame 3 indicating we're calling methods of a destroyed MediaPlayerPrivateGStreamer:
(gdb) bt full
#0 WTF::HashTable<WTF::String, WTF::KeyValuePair<WTF::String, WTF::String>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String, WTF::String> >, WTF::DefaultHash<WTF::String>, WTF::HashMap<WTF::String, WTF::String, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<WTF::String> >::contains<WTF::IdentityHashTranslator<WTF::HashMap<WTF::String, WTF::String, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTableTraits>::KeyValuePairTraits, WTF::DefaultHash<WTF::String> >, WTF::String>(WTF::String const&) const (this=0x3c8, key=<optimized out>)
at WTF/Headers/wtf/HashTable.h:1039
#1 WTF::HashTable<WTF::String, WTF::KeyValuePair<WTF::String, WTF::String>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String, WTF::String> >, WTF::DefaultHash<WTF::String>, WTF::HashMap<WTF::String, WTF::String, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<WTF::String> >::contains(WTF::String const&) const (this=0x3c8, key=<optimized out>)
at WTF/Headers/wtf/HashTable.h:489
#2 WTF::HashMap<WTF::String, WTF::String, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTableTraits>::contains(WTF::String const&) const (this=0x3c8, key=<optimized out>)
at WTF/Headers/wtf/HashMap.h:323
#3 WebCore::MediaPlayerPrivateGStreamer::codecForStreamId(WTF::String const&)
(this=0x0, streamId="6bd23d7859548e56dbfcc7e408694057/001:001")
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:4443
#4 0x00007ff9ceaf1797 in WebCore::AudioTrackPrivateGStreamer::capsChanged(WTF::String const&, WTF::GRefPtr<_GstCaps> const&) (this=0x7ff9b2437600, streamId="6bd23d7859548e56dbfcc7e408694057/001:001", caps=<optimized out>)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/platform/graphics/gstreamer/AudioTrackPrivateGStreamer.cpp:86
codec = Python Exception <class 'gdb.MemoryError'>: Cannot access memory at address 0x3
#5 0x00007ff9ceb23b66 in WebCore::TrackPrivateBaseGStreamer::setPad(WTF::GRefPtr<_GstPad>&&)::$_0::operator()(_GstPad*, _GstPadProbeInfo*, WebCore::TrackPrivateBaseGStreamer*) const::{lambda()#1}::operator()() const
(this=<optimized out>)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:136
caps = <optimized out>
#6 WTF::Detail::CallableWrapper<WebCore::TrackPrivateBaseGStreamer::setPad(WTF::GRefPtr<_GstPad>&&)::$_0::operator()(_GstPad*, _GstPadProbeInfo*, WebCore::TrackPrivateBaseGStreamer*) const::{lambda()#1}, void>::call()
(this=<optimized out>) at WTF/Headers/wtf/Function.h:53
#7 0x00007ff9cbab59fb in WTF::Function<void ()>::operator()() const (this=<optimized out>)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/Function.h:82
function = {m_callableWrapper = std::unique_ptr<WTF::Detail::CallableWrapperBase<void>> = {get() = 0x7ff7f6a14100}}
didSuspendFunctions = false
#8 WTF::RunLoop::performWork() (this=0x7ff9b20100e0)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/RunLoop.cpp:147
function = {m_callableWrapper = std::unique_ptr<WTF::Detail::CallableWrapperBase<void>> = {get() = 0x7ff7f6a14100}}
didSuspendFunctions = false
#9 0x00007ff9cbb149dd in WTF::RunLoop::RunLoop()::$_0::operator()(void*) const (userData=0x7ffe5b402888,
userData at entry=0x7ff9b20100e0, this=<optimized out>)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:80
#10 WTF::RunLoop::RunLoop()::$_0::__invoke(void*) (userData=0x7ffe5b402888)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:79
#11 0x00007ff9cbb13de1 in WTF::RunLoop::$_0::operator()(_GSource*, int (*)(void*), void*) const
(source=0x564246804eb0, callback=0x7ff9cbb149d0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>, userData=0x7ff9b20100e0, this=<optimized out>) at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:53
name = 0x5642467bd7b0 "[WebKit] RunLoop work"
runLoopSource = @0x564246804eb0: {source = {callback_data = 0x5642467e6da0, callback_funcs = 0x7ff9c85882e0 <g_source_callback_funcs>, source_funcs = 0x7ff9cbfb53d0 <WTF::RunLoop::s_runLoopSourceFunctions>, ref_count = 3, context = 0x5642467c4ab0, priority = 100, flags = 35, source_id = 2, poll_fds = 0x0, prev = 0x0, next = 0x564246962c30, name--Type <RET> for more, q to quit, c to continue without paging--c
= 0x5642467bd7b0 "[WebKit] RunLoop work", priv = 0x56424678b740}, runLoop = 0x7ff9b20100e0}
returnValue = <optimized out>
#12 WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*)
(source=0x564246804eb0, callback=0x7ff9cbb149d0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>, userData=0x7ff9b20100e0) at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:45
#13 0x00007ff9c849ba47 in g_main_dispatch (context=context at entry=0x5642467c4ab0) at ../glib/gmain.c:3476
dispatch = 0x7ff9cbb13d90 <WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*)>
prev_source = 0x0
begin_time_nsec = 16422526645309
was_in_call = 0
user_data = 0x7ff9b20100e0
callback = 0x7ff9cbb149d0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>
cb_funcs = 0x7ff9c85882e0 <g_source_callback_funcs>
cb_data = 0x5642467e6da0
need_destroy = <optimized out>
source = 0x564246804eb0
current = 0x5642467d6b60
i = 0
__func__ = "g_main_dispatch"
#14 0x00007ff9c849db57 in g_main_context_dispatch_unlocked (context=0x5642467c4ab0) at ../glib/gmain.c:4286
max_priority = 100
timeout = 0
some_ready = 1
nfds = 11
allocated_nfds = <optimized out>
fds = 0x56424708fa40
begin_time_nsec = 16422526614170
#15 g_main_context_iterate_unlocked
(context=0x5642467c4ab0, block=block at entry=1, dispatch=dispatch at entry=1, self=<optimized out>)
at ../glib/gmain.c:4351
max_priority = 100
timeout = 0
some_ready = 1
nfds = 11
allocated_nfds = <optimized out>
fds = 0x56424708fa40
begin_time_nsec = 16422526614170
#16 0x00007ff9c849e567 in g_main_loop_run (loop=0x564246804e00) at ../glib/gmain.c:4553
__func__ = "g_main_loop_run"
#17 0x00007ff9cbb143b1 in WTF::RunLoop::run() ()
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:108
runLoop = @0x7ff9b20100e0: {<WTF::SerialFunctionDispatcher> = {<WTF::FunctionDispatcher> = {_vptr$FunctionDispatcher = 0x7ff9cbfa5d68 <vtable for WTF::RunLoop+16>}, <No data fields>}, <WTF::ThreadSafeRefCounted<WTF::RunLoop, (WTF::DestructionThread)0>> = {<WTF::ThreadSafeRefCountedBase> = {m_refCount = std::atomic<unsigned int> = { 417 }}, <No data fields>}, m_currentIteration = {m_start = 4, m_end = 5, m_buffer = {<WTF::VectorBufferBase<WTF::Function<void ()>, WTF::FastMalloc>> = {m_buffer = 0x7ff9b2a74e80, m_capacity = 16, m_size = 0}, <No data fields>}}, m_nextIterationLock = {static isHeldBit = 1 '\001', static hasParkedBit = 2 '\002', m_byte = {value = std::atomic<unsigned char> = { 0 '\000' }}}, m_nextIteration = {m_start = 0, m_end = 2, m_buffer = {<WTF::VectorBufferBase<WTF::Function<void ()>, WTF::FastMalloc>> = {m_buffer = 0x7ff7e6d70980, m_capacity = 16, m_size = 0}, <No data fields>}}, m_isFunctionDispatchSuspended = false, m_hasSuspendedFunctions = false, static s_runLoopSourceFunctions = {prepare = 0x0, check = 0x0, dispatch = 0x7ff9cbb13d90 <WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*)>, finalize = 0x0, closure_callback = 0x0, closure_marshal = 0x0}, m_mainContext = {m_ptr = 0x5642467c4ab0}, m_mainLoops = WTF::Vector of length 1, capacity 16 = {{m_ptr = 0x564246804e00}}, m_source = {m_ptr = 0x564246804eb0}, m_observers = {m_set = {m_impl = {static smallMaxLoadNumerator = 3, static smallMaxLoadDenominator = 4, static largeMaxLoadNumerator = 1, static largeMaxLoadDenominator = 2, static maxSmallTableCapacity = 1024, static minLoad = 6, static tableSizeOffset = -1, static tableSizeMaskOffset = -2, static keyCountOffset = -3, static deletedCountOffset = -4, static metadataSize = 16, {m_table = 0x0, m_tableForLLDB = 0x0}}}, m_operationCountSinceLastCleanup = 0}}
mainContext = 0x5642467c4ab0
innermostLoop = 0x564246804e00
nestedMainLoop = <optimized out>
#18 0x00007ff9cd255857 in WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run(int, char**)
(this=0x7ffe5b402b40, argc=3, argv=<optimized out>)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebKit/Shared/AuxiliaryProcessMain.h:72
auxiliaryMain = {m_storage = {__data = "p\276B\320\371\177", '\000' <repeats 26 times>, "\017\005\000\000\000\000\000\000\001\000\000\000\000\000\000\000r", '\000' <repeats 22 times>, __align = {<No data fields>}}}
#19 WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainGtk>(int, char**) (argc=3, argv=<optimized out>)
at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebKit/Shared/AuxiliaryProcessMain.h:98
auxiliaryMain = {m_storage = {__data = "p\276B\320\371\177", '\000' <repeats 26 times>, "\017\005\000\000\000\000\000\000\001\000\000\000\000\000\000\000r", '\000' <repeats 22 times>, __align = {<No data fields>}}}
#20 0x00007ff9cc23bb8a in __libc_start_call_main
(main=main at entry=0x56424607e150 <main(int, char**)>, argc=argc at entry=3, argv=argv at entry=0x7ffe5b402cd8)
at ../sysdeps/nptl/libc_start_call_main.h:58
self = <optimized out>
result = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140730429353176, -5724701081780959803, 3, 0, 140710921564160, 94842642763168, -5724701081766279739, -5727760185627982395}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x3, 0x7ffe5b402cd0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 3}}}
not_first_call = <optimized out>
#21 0x00007ff9cc23bc4b in __libc_start_main_impl
(main=0x56424607e150 <main(int, char**)>, argc=3, argv=0x7ffe5b402cd8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffe5b402cc8) at ../csu/libc-start.c:360
#22 0x000056424607e085 in _start () at ../sysdeps/x86_64/start.S:115
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230717/a6f6899b/attachment-0001.htm>
More information about the webkit-unassigned
mailing list