200530 2019-08-07 23:58:16 -0700 [GTK] WebKitWebProcess crashes when viewing an HTML with a <video> element referencing unknown file 2019-08-08 05:08:58 -0700 1 1 1 Unclassified WebKit WebKitGTK Other Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mcrha cturner bugs-noreply calvaris commit-queue cturner oldest_to_newest 1559444 0 mcrha 2019-08-07 23:58:16 -0700 Moving this from a downstream bug report: https://gitlab.gnome.org/GNOME/evolution/issues/558 When viewing a message in Evolution, whose body contains a video link, WebKitWebProcess either crashes or keeps showing runtime warning: > (WebKitWebProcess:2100): GStreamer-CRITICAL **: 19:18:18.041: gst_element_query: assertion 'GST_IS_ELEMENT (element)' failed depending on user settings (either how glib had been compiled, or when fatal-warnings/fatal-criticals had been used). Example of such HTML: <html><body><video src="evo-https://gitlab.gnome.org/GNOME/gtk/uploads/a3998120d6283183158157e981e1cdaf/recording-jitter-3.mp4"></video></body></html> Save it as a file, then open it in the MiniBrowser. Note the src of the video link is slightly modified, it uses a different schema, which mimics what Evolution does - it rejects to download it, unless user allows it. It's a new behaviour in 2.24.3. More information can be found in the upstream bug. Backtrace of the crash: #0 0x00007f30dbbd588e in gst_element_query (element=0x0, query=0x7f30c40060f0 [None]) at ../gstreamer/gst/gstelement.c:1955 klass = <optimized out> res = 0 __func__ = "gst_element_query" #1 0x00007f30e17dd2b8 in WebCore::MediaPlayerPrivateGStreamer::fillTimerFired() (this=0x7f306b61f700) at /usr/src/debug/webkitgtk-2.24.3/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1662 query = {m_ptr = 0x7f30c40060f0 [None]} fillStatus = 100 mode = GST_BUFFERING_DOWNLOAD __FUNCTION__ = "fillTimerFired" #2 0x00007f30e113fc04 in WebCore::ThreadTimers::sharedTimerFiredInternal() (this=0x7f30d248cfc8) at /usr/src/debug/webkitgtk-2.24.3/Source/WebCore/platform/ThreadTimers.h:101 item = {static isRef = <optimized out>, m_ptr = 0x7f306b613000} timer = <optimized out> interval = <optimized out> timeToQuit = {static clockType = WTF::ClockType::Monotonic, m_value = 1624734.0698240001} #3 0x00007f30e113fc04 in WebCore::ThreadTimers::sharedTimerFiredInternal() (this=0x7f30d248cfc8) at /usr/src/debug/webkitgtk-2.24.3/Source/WebCore/platform/ThreadTimers.cpp:101 #4 0x00007f30dd842f14 in WTF::RunLoop::TimerBase::<lambda(gpointer)>::operator() (__closure=0x0, userData=0x7f30e24ac9b0 <WebCore::MainThreadSharedTimer::singleton()::instance+16>) at /usr/src/debug/webkitgtk-2.24.3/Source/WTF/wtf/glib/RunLoopGLib.cpp:171 timer = 0x7f30e24ac9b0 <WebCore::MainThreadSharedTimer::singleton()::instance+16> source = 0x5627f7813fd0 #5 0x00007f30dd842f14 in WTF::RunLoop::TimerBase::<lambda(gpointer)>::_FUN(gpointer) () at /usr/src/debug/webkitgtk-2.24.3/Source/WTF/wtf/glib/RunLoopGLib.cpp:177 #6 0x00007f30dde7b34f in g_main_dispatch (context=0x5627f7362d40) at ../glib/glib/gmain.c:3189 dispatch = 0x7f30dd842880 <WTF::<lambda(GSource*, GSourceFunc, gpointer)>::_FUN(GSource *, GSourceFunc, gpointer)> prev_source = 0x0 was_in_call = 0 user_data = 0x7f30e24ac9b0 <WebCore::MainThreadSharedTimer::singleton()::instance+16> callback = 0x7f30dd842f00 <WTF::RunLoop::TimerBase::<lambda(gpointer)>::_FUN(gpointer)> cb_funcs = <optimized out> cb_data = 0x5627f78190b0 need_destroy = <optimized out> source = 0x5627f7813fd0 current = 0x5627f73ca5d0 i = 0 #7 0x00007f30dde7b34f in g_main_context_dispatch (context=context@entry=0x5627f7362d40) at ../glib/glib/gmain.c:3854 #8 0x00007f30dde7d240 in g_main_context_iterate (context=0x5627f7362d40, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:3927 max_priority = 2147483647 timeout = 21 some_ready = 1 nfds = <optimized out> allocated_nfds = <optimized out> fds = 0x5627f79502b0 #9 0x00007f30dde7e123 in g_main_loop_run (loop=0x5627f74e0d30) at ../glib/glib/gmain.c:4123 __FUNCTION__ = "g_main_loop_run" #10 0x00007f30dd843358 in WTF::RunLoop::run() () at /usr/src/debug/webkitgtk-2.24.3/Source/WTF/wtf/glib/RunLoopGLib.cpp:96 runLoop = @0x7f30d24fa000: {<WTF::FunctionDispatcher> = {<WTF::ThreadSafeRefCounted<WTF::FunctionDispatcher, (WTF::DestructionThread)0>> = {<WTF::ThreadSafeRefCountedBase> = {m_refCount = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 19}, <No data fields>}}, <No data fields>}, _vptr.FunctionDispatcher = 0x7f30ddafce40 <vtable for WTF::RunLoop+16>}, m_functionQueueLock = {static isHeldBit = 1 '\001', static hasParkedBit = 2 '\002', m_byte = {value = {<std::__atomic_base<unsigned char>> = {static _S_alignment = 1, _M_i = 0 '\000'}, <No data fields>}}}, m_functionQueue = {m_start = 5, m_end = 5, m_buffer = {<WTF::VectorBufferBase<WTF::Function<void()> >> = {m_buffer = 0x7f30d24e5100, m_capacity = 16, m_size = 0}, <No data fields>}}, m_mainContext = {m_ptr = 0x5627f7362d40}, m_mainLoops = {<WTF::VectorBuffer<WTF::GRefPtr<_GMainLoop>, 0>> = {<WTF::VectorBufferBase<WTF::GRefPtr<_GMainLoop> >> = {m_buffer = 0x7f30d24fd180, m_capacity = 16, m_size = 1}, <No data fields>}, <No data fields>}, m_source = {m_ptr = 0x5627f742a400}} mainContext = 0x5627f7362d40 innermostLoop = 0x5627f74e0d30 nestedMainLoop = <optimized out> #11 0x00007f30e00f6f1a in WebKit::AuxiliaryProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) (argv=<optimized out>, argc=3) at /usr/src/debug/webkitgtk-2.24.3/Source/WebKit/Shared/unix/AuxiliaryProcessMain.h:47 auxiliaryMain = {<WebKit::AuxiliaryProcessMainBase> = {_vptr.AuxiliaryProcessMainBase = 0x7f30e22db9c0 <vtable for WebKit::WebProcessMain+16>, m_parameters = {uiProcessName = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, clientIdentifier = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, processIdentifier = {<WTF::constexpr_Optional_base<WTF::ObjectIdentifier<WebCore::ProcessIdentifierType> >> = {init_ = true, storage_ = {dummy_ = 14 '\016', value_ = {<WTF::ObjectIdentifierBase> = {<No data fields>}, m_identifier = 14}}}, <No data fields>}, connectionIdentifier = 35, extraInitializationData = {m_impl = {static m_maxLoad = 2, static m_minLoad = 6, m_table = 0x0, m_tableSize = 0, m_tableSizeMask = 0, m_keyCount = 0, m_deletedCount = 0}}, processType = WebKit::AuxiliaryProcess::ProcessType::WebContent}}, <No data fields>} #12 0x00007f30e00f6f1a in WebKit::WebProcessMainUnix(int, char**) (argc=3, argv=<optimized out>) at /usr/src/debug/webkitgtk-2.24.3/Source/WebKit/WebProcess/gtk/WebProcessMainGtk.cpp:67 #13 0x00007f30df36fee3 in __libc_start_main () at /usr/lib/libc.so.6 #14 0x00005627f6f6f8ae in _start () 1559462 1 cturner 2019-08-08 02:15:22 -0700 I can confirm this, looks like the fill timer is not being made aware of an erroneous load. Will take a look. 1559464 2 375793 cturner 2019-08-08 02:29:17 -0700 Created attachment 375793 Patch 1559467 3 375793 calvaris 2019-08-08 03:22:04 -0700 Comment on attachment 375793 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=375793&action=review > Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1659 > + if (m_errorOccured) { > + GST_DEBUG_OBJECT(pipeline(), "[Buffering] An error occurred, disabling the fill timer"); > + m_fillTimer.stop(); > + return; > + } > + You can move this piece of code to the beginning of the method. We don't need to initialize anything if we're going to bail out. 1559470 4 375795 cturner 2019-08-08 04:25:15 -0700 Created attachment 375795 Patch for landing 1559473 5 375795 commit-queue 2019-08-08 05:08:56 -0700 Comment on attachment 375795 Patch for landing Clearing flags on attachment: 375795 Committed r248405: <https://trac.webkit.org/changeset/248405> 1559474 6 commit-queue 2019-08-08 05:08:58 -0700 All reviewed patches have been landed. Closing bug. 375793 2019-08-08 02:29:17 -0700 2019-08-08 04:25:12 -0700 Patch bug-200530-20190808102916.patch text/plain 1732 cturner U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ4MjY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTliZjZiYmFiYjllOWJj YWJkNzUzNmViNjJmZjE4NWRlM2VjZjdiYS4uZTZiMTY0OGUwZmJhZjcyN2Q1YTg4ZTU3YmY3M2Jh MzIyZGY1YmYzMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDE5LTA4LTA4ICBDaGFy bGllIFR1cm5lciAgPGN0dXJuZXJAaWdhbGlhLmNvbT4KKworICAgICAgICBbR1RLXSBXZWJLaXRX ZWJQcm9jZXNzIGNyYXNoZXMgd2hlbiB2aWV3aW5nIGFuIEhUTUwgd2l0aCBhIDx2aWRlbz4gZWxl bWVudCByZWZlcmVuY2luZyB1bmtub3duIGZpbGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMDUzMAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIE5vdCBhbWVuYWJsZSB0byB1bml0IHRlc3RpbmcuCisKKyAg ICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9nc3RyZWFtZXIvTWVkaWFQbGF5ZXJQcml2YXRlR1N0 cmVhbWVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6Ok1lZGlhUGxheWVyUHJpdmF0ZUdTdHJlYW1l cjo6ZmlsbFRpbWVyRmlyZWQpOgorCiAyMDE5LTA4LTA1ICBUYWthc2hpIEtvbW9yaSAgPFRha2Fz aGkuS29tb3JpQHNvbnkuY29tPgogCiAgICAgICAgIFtDdXJsXSBpbXBsZW1lbnQgQ2VydGlmaWNh dGVJbmZvOjpzdW1tYXJ5SW5mbwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0v Z3JhcGhpY3MvZ3N0cmVhbWVyL01lZGlhUGxheWVyUHJpdmF0ZUdTdHJlYW1lci5jcHAgYi9Tb3Vy Y2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9nc3RyZWFtZXIvTWVkaWFQbGF5ZXJQcml2YXRl R1N0cmVhbWVyLmNwcAppbmRleCA2ZDcxMDVlOWExYTI3MWJhNGE4ZWY4ZGU0NDVlMGE5ODY2Yjdh OWFjLi5lZDM3ZDM5OWIyYjA3MWUwYWY1YzNkZTg5YjZiOTc0M2U4YTg2ZWQzIDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9nc3RyZWFtZXIvTWVkaWFQbGF5ZXJQ cml2YXRlR1N0cmVhbWVyLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGlj cy9nc3RyZWFtZXIvTWVkaWFQbGF5ZXJQcml2YXRlR1N0cmVhbWVyLmNwcApAQCAtMTY1MSw2ICsx NjUxLDEyIEBAIHZvaWQgTWVkaWFQbGF5ZXJQcml2YXRlR1N0cmVhbWVyOjpmaWxsVGltZXJGaXJl ZCgpCiAgICAgZG91YmxlIGZpbGxTdGF0dXMgPSAxMDAuMDsKICAgICBHc3RCdWZmZXJpbmdNb2Rl IG1vZGUgPSBHU1RfQlVGRkVSSU5HX0RPV05MT0FEOwogCisgICAgaWYgKG1fZXJyb3JPY2N1cmVk KSB7CisgICAgICAgIEdTVF9ERUJVR19PQkpFQ1QocGlwZWxpbmUoKSwgIltCdWZmZXJpbmddIEFu IGVycm9yIG9jY3VycmVkLCBkaXNhYmxpbmcgdGhlIGZpbGwgdGltZXIiKTsKKyAgICAgICAgbV9m aWxsVGltZXIuc3RvcCgpOworICAgICAgICByZXR1cm47CisgICAgfQorCiAgICAgaWYgKGdzdF9l bGVtZW50X3F1ZXJ5KG1fc291cmNlLmdldCgpLCBxdWVyeS5nZXQoKSkpIHsKICAgICAgICAgZ3N0 X3F1ZXJ5X3BhcnNlX2J1ZmZlcmluZ19zdGF0cyhxdWVyeS5nZXQoKSwgJm1vZGUsIG51bGxwdHIs IG51bGxwdHIsIG51bGxwdHIpOwogCg== 375795 2019-08-08 04:25:15 -0700 2019-08-08 05:08:56 -0700 Patch for landing bug-200530-20190808122514.patch text/plain 1763 cturner U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ4MjY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTliZjZiYmFiYjllOWJj YWJkNzUzNmViNjJmZjE4NWRlM2VjZjdiYS4uZThkYzAwMjg3YmNjM2VmZDA3NmQwMDMwNmJlN2Uy OTI0MDM5N2ZiNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDE5LTA4LTA4ICBDaGFy bGllIFR1cm5lciAgPGN0dXJuZXJAaWdhbGlhLmNvbT4KKworICAgICAgICBbR1RLXSBXZWJLaXRX ZWJQcm9jZXNzIGNyYXNoZXMgd2hlbiB2aWV3aW5nIGFuIEhUTUwgd2l0aCBhIDx2aWRlbz4gZWxl bWVudCByZWZlcmVuY2luZyB1bmtub3duIGZpbGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMDUzMAorCisgICAgICAgIFJldmlld2VkIGJ5IFhhYmll ciBSb2RyaWd1ZXotQ2FsdmFyLgorCisgICAgICAgIE5vdCBhbWVuYWJsZSB0byB1bml0IHRlc3Rp bmcuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9nc3RyZWFtZXIvTWVkaWFQbGF5ZXJQ cml2YXRlR1N0cmVhbWVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6Ok1lZGlhUGxheWVyUHJpdmF0 ZUdTdHJlYW1lcjo6ZmlsbFRpbWVyRmlyZWQpOgorCiAyMDE5LTA4LTA1ICBUYWthc2hpIEtvbW9y aSAgPFRha2FzaGkuS29tb3JpQHNvbnkuY29tPgogCiAgICAgICAgIFtDdXJsXSBpbXBsZW1lbnQg Q2VydGlmaWNhdGVJbmZvOjpzdW1tYXJ5SW5mbwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUv cGxhdGZvcm0vZ3JhcGhpY3MvZ3N0cmVhbWVyL01lZGlhUGxheWVyUHJpdmF0ZUdTdHJlYW1lci5j cHAgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9nc3RyZWFtZXIvTWVkaWFQbGF5 ZXJQcml2YXRlR1N0cmVhbWVyLmNwcAppbmRleCA2ZDcxMDVlOWExYTI3MWJhNGE4ZWY4ZGU0NDVl MGE5ODY2YjdhOWFjLi40ZjM2NDMzM2Y3ZGRlZmMyZTQ0MWY3ZjM0YmViYjdkMjRkN2ZjYjViIDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9nc3RyZWFtZXIvTWVk aWFQbGF5ZXJQcml2YXRlR1N0cmVhbWVyLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y bS9ncmFwaGljcy9nc3RyZWFtZXIvTWVkaWFQbGF5ZXJQcml2YXRlR1N0cmVhbWVyLmNwcApAQCAt MTY0Nyw2ICsxNjQ3LDEyIEBAIHZvaWQgTWVkaWFQbGF5ZXJQcml2YXRlR1N0cmVhbWVyOjpwdXJn ZUludmFsaWRUZXh0VHJhY2tzKFZlY3RvcjxTdHJpbmc+IHZhbGlkVHJhCiAKIHZvaWQgTWVkaWFQ bGF5ZXJQcml2YXRlR1N0cmVhbWVyOjpmaWxsVGltZXJGaXJlZCgpCiB7CisgICAgaWYgKG1fZXJy b3JPY2N1cmVkKSB7CisgICAgICAgIEdTVF9ERUJVR19PQkpFQ1QocGlwZWxpbmUoKSwgIltCdWZm ZXJpbmddIEFuIGVycm9yIG9jY3VycmVkLCBkaXNhYmxpbmcgdGhlIGZpbGwgdGltZXIiKTsKKyAg ICAgICAgbV9maWxsVGltZXIuc3RvcCgpOworICAgICAgICByZXR1cm47CisgICAgfQorCiAgICAg R1JlZlB0cjxHc3RRdWVyeT4gcXVlcnkgPSBhZG9wdEdSZWYoZ3N0X3F1ZXJ5X25ld19idWZmZXJp bmcoR1NUX0ZPUk1BVF9QRVJDRU5UKSk7CiAgICAgZG91YmxlIGZpbGxTdGF0dXMgPSAxMDAuMDsK ICAgICBHc3RCdWZmZXJpbmdNb2RlIG1vZGUgPSBHU1RfQlVGRkVSSU5HX0RPV05MT0FEOwo=