191876 2018-11-21 00:12:26 -0800 [MSE] MediaSource is leaked if the video element is removed while a SourceBuffer is updating 2018-11-23 03:33:10 -0800 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified NEW P2 Normal --- 1 aboya webkit-unassigned jer.noble oldest_to_newest 1480687 0 aboya 2018-11-21 00:12:26 -0800 How to reproduce: 1. Build debug WebKit. 2. Copy the attached testcase to LayoutTests/imported/w3c/web-platform-tests/media-source/mediasource-leak-if-removed-updating.html 3. Run run-webkit-httpd 4. Open http://localhost:8800/media-source/mediasource-leak-if-removed-updating.html in the minibrowser with WEBKIT_DEBUG=MediaSource,Media 5. Look at the log. Last lines of the log: PlatformMediaSessionManager::addSession - 0x7f7690dd4258 MediaSource::MediaSource 0x7f7690dae2b0 MediaSource::setReadyState(0x7f7690dae2b0) : closed -> open MediaSource::addSourceBuffer(video/mp4; codecs="mp4a.40.2,avc1.4d400d") 0x7f7690dae2b0 MediaSource::isTypeSupported(video/mp4; codecs="mp4a.40.2,avc1.4d400d") http://localhost:8800/media-source/mediasource-leak-if-removed-updating.html:49:20: CONSOLE LOG Tearing down... http://localhost:8800/media-source/mediasource-leak-if-removed-updating.html:51:20: CONSOLE LOG Test done. PlatformMediaSessionManager::sessionWillEndPlayback - 0x7f7690dd4258 SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment(0x7f7690dcb600) SourceBuffer::monitorBufferingRate(0x7f7690dcb600) - m_avegareBufferRate: 0,666891 SourceBuffer::provideMediaData(0x7f7690dcb600) - Enqueued 193 samples, 0 remaining SourceBuffer::sourceBufferPrivateAppendComplete(0x7f7690dcb600) - buffered = [{0/1000000 = 0,000000}..{6423332/1000000 = 6,423332}] UNIMPLEMENTED: ../../Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp(393) : virtual void WebCore::MediaPlayerPrivateGStreamerMSE::updatePlaybackRate() Expected result: The MediaSource should be destroyed shortly after the <video> element was removed from the DOM, but instead it survives until the document is unloaded. You can verify this by setting "about:blank" in the address bar and looking at the logs again, only then the MediaSource is destroyed: PlatformMediaSessionManager::removeSession - 0x7f7690dd4258 MediaSource::setReadyState(0x7f7690dae2b0) : open -> closed MediaSource::removeSourceBuffer() 0x7f7690dae2b0 SourceBuffer::provideMediaData(0x7f7690dcb600) - Enqueued 0 samples, 0 remaining SourceBuffer::sourceBufferPrivateAppendComplete(0x7f7690dcb600) - buffered = [{0/1000000 = 0,000000}..{6423332/1000000 = 6,423332}] PlatformMediaSessionManager::removeSession - 0x7f7690dd4258 PlatformMediaSessionManager::removeSession - 0x7f7690dd4258 MediaSource::~MediaSource 0x7f7690dae2b0 ~MediaSourceClientGStreamerMSE() The bug is reproducible every time. Only tested in WebKitGTK so far. 1480689 1 aboya 2018-11-21 00:16:43 -0800 Can someone confirm whether this also happens in non-GStreamer ports, e.g. AVFoundation? 1480690 2 355391 aboya 2018-11-21 00:17:49 -0800 Created attachment 355391 Test case 1481098 3 aboya 2018-11-23 03:33:10 -0800 Strangely enough, the last reference to MediaSource is actually released and the object destroyed... only after 10 forced GC cycles. That's too many GC cycles. The MediaSource is promptly destroyed if the video element is removed when no SourceBuffer is 'updating' on the other hand. 355391 2018-11-21 00:17:49 -0800 2018-11-21 00:17:49 -0800 Test case mediasource-leak-if-removed-updating.html text/html 1846 aboya PCFET0NUWVBFIGh0bWw+CjxtZXRhIGNoYXJzZXQ9InV0Zi04Ij4KPHNjcmlwdD4KICAgIGZ1bmN0 aW9uIHdhaXRFdmVudFByb21pc2Uob2JqZWN0LCBldmVudE5hbWUpIHsKICAgICAgICByZXR1cm4g bmV3IFByb21pc2UocmVzb2x2ZSA9PiB7CiAgICAgICAgICAgIGZ1bmN0aW9uIGxpc3RlbmVyKCkg ewogICAgICAgICAgICAgICAgcmVzb2x2ZSgpOwogICAgICAgICAgICAgICAgb2JqZWN0LnJlbW92 ZUV2ZW50TGlzdGVuZXIoZXZlbnROYW1lLCBsaXN0ZW5lcik7CiAgICAgICAgICAgIH0KICAgICAg ICAgICAgb2JqZWN0LmFkZEV2ZW50TGlzdGVuZXIoZXZlbnROYW1lLCBsaXN0ZW5lcik7CiAgICAg ICAgfSk7CiAgICB9CgogICAgZnVuY3Rpb24gZG93bmxvYWRCaW5hcnkodXJsKSB7CiAgICAgICAg cmV0dXJuIG5ldyBQcm9taXNlKChyZXNvbHZlLCByZWplY3QpID0+IHsKICAgICAgICAgICAgY29u c3QgeGhyID0gbmV3IFhNTEh0dHBSZXF1ZXN0KCk7CiAgICAgICAgICAgIHhoci5vcGVuKCJHRVQi LCB1cmwsIHRydWUpOwogICAgICAgICAgICB4aHIucmVzcG9uc2VUeXBlID0gImFycmF5YnVmZmVy IjsKICAgICAgICAgICAgeGhyLm9ubG9hZCA9ICgpID0+IHsKICAgICAgICAgICAgICAgIGlmICh4 aHIuc3RhdHVzICE9PSAyMDApCiAgICAgICAgICAgICAgICAgICAgcmVqZWN0KGBVbmV4cGVjdGVk IHN0YXR1cyBjb2RlOiAke3hoci5zdGF0dXN9YCk7CiAgICAgICAgICAgICAgICBlbHNlCiAgICAg ICAgICAgICAgICAgICAgcmVzb2x2ZSh4aHIucmVzcG9uc2UpOwogICAgICAgICAgICB9OwogICAg ICAgICAgICB4aHIub25lcnJvciA9IHJlamVjdDsKICAgICAgICAgICAgeGhyLnNlbmQoKTsKICAg ICAgICB9KTsKICAgIH0KCiAgICBhc3luYyBmdW5jdGlvbiBjcmVhdGVBbmREZXN0cm95TWVkaWFT b3VyY2UoKQogICAgewogICAgICAgIGNvbnN0IG1pbWVUeXBlID0gInZpZGVvL21wNDsgY29kZWNz PVwibXA0YS40MC4yLGF2YzEuNGQ0MDBkXCIiOwogICAgICAgIGNvbnN0IGNhY2hlZFNlZ21lbnRC dWZmZXIgPSBhd2FpdCBkb3dubG9hZEJpbmFyeSgibXA0L3Rlc3QubXA0Iik7CgogICAgICAgIGNv bnN0IG1lZGlhRWxlbWVudCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoInZpZGVvIik7CiAgICAg ICAgZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChtZWRpYUVsZW1lbnQpOwoKICAgICAgICBjb25z dCBtZWRpYVNvdXJjZSA9IG5ldyBNZWRpYVNvdXJjZSgpOwogICAgICAgIGNvbnN0IG1lZGlhU291 cmNlVVJMID0gVVJMLmNyZWF0ZU9iamVjdFVSTChtZWRpYVNvdXJjZSk7CiAgICAgICAgbWVkaWFF bGVtZW50LnNyYyA9IG1lZGlhU291cmNlVVJMOwogICAgICAgIGF3YWl0IHdhaXRFdmVudFByb21p c2UobWVkaWFTb3VyY2UsICJzb3VyY2VvcGVuIik7CiAgICAgICAgVVJMLnJldm9rZU9iamVjdFVS TChtZWRpYVNvdXJjZVVSTCk7CgogICAgICAgIGNvbnN0IHNvdXJjZUJ1ZmZlciA9IG1lZGlhU291 cmNlLmFkZFNvdXJjZUJ1ZmZlcihtaW1lVHlwZSk7CiAgICAgICAgc291cmNlQnVmZmVyLmFwcGVu ZEJ1ZmZlcihjYWNoZWRTZWdtZW50QnVmZmVyKTsKICAgICAgICBpZiAoIXNvdXJjZUJ1ZmZlci51 cGRhdGluZykKICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKCJTb3VyY2VCdWZmZXIgc2hvdWxk IGJlIHVwZGF0aW5nIik7CgogICAgICAgIGNvbnNvbGUubG9nKCJUZWFyaW5nIGRvd24uLi4iKTsK ICAgICAgICBkb2N1bWVudC5ib2R5LnJlbW92ZUNoaWxkKG1lZGlhRWxlbWVudCk7CiAgICAgICAg Y29uc29sZS5sb2coIlRlc3QgZG9uZS4iKTsKICAgIH0KCiAgICBjcmVhdGVBbmREZXN0cm95TWVk aWFTb3VyY2UoKTsKPC9zY3JpcHQ+Cg==