210983 2020-04-24 12:10:26 -0700 ASSERTION FAILED: m_wrapper under HTMLMediaElement::setIsPlayingToWirelessTarget 2020-04-24 19:11:34 -0700 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez calvaris eric.carlson esprehn+autocc ews-watchlist glenn gyuyoung.kim jer.noble philipj sergio webkit-bug-importer youennf oldest_to_newest 1645312 0 cdumez 2020-04-24 12:10:26 -0700 ASSERTION FAILED: m_wrapper under HTMLMediaElement::setIsPlayingToWirelessTarget: ASSERTION FAILED: m_wrapper ./bindings/js/JSEventListener.h(123) : JSC::JSObject *WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext &) const 1 0x106bf70b9 WTFCrash 2 0x11d80388b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x11f9be9f8 WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext&) const 4 0x11f9bdd1b WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) 5 0x12000b87c WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) 6 0x120007b12 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) 7 0x1200834ba WebCore::Node::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) 8 0x11fff6180 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const 9 0x11fff6b97 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) 10 0x11fff6795 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) 11 0x12008350d WebCore::Node::dispatchEvent(WebCore::Event&) 12 0x1203eeb31 WebCore::HTMLMediaElement::dispatchEvent(WebCore::Event&) 13 0x120426b95 WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)::$_35::operator()() const 14 0x120426999 WTF::Detail::CallableWrapper<WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)::$_35, void>::call() The issue is that we are trying to fire a JS event as a result of ActiveDOMObject getting called, which is not allowed: 1 0x12799f3a4 WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool) 2 0x12799f1bb WebCore::HTMLMediaElement::clearMediaPlayer() 3 0x12799f913 WebCore::HTMLMediaElement::stop() 4 0x12769ddbd auto WebCore::ScriptExecutionContext::stopActiveDOMObjects()::$_9::operator()<WebCore::ActiveDOMObject>(WebCore::ActiveDOMObject&) const 5 0x12769dd73 WTF::Detail::CallableWrapper<WebCore::ScriptExecutionContext::stopActiveDOMObjects()::$_9, WebCore::ScriptExecutionContext::ShouldContinue, WebCore::ActiveDOMObject&>::call(WebCore::ActiveDOMObject&) 6 0x12767c22a WTF::Function<WebCore::ScriptExecutionContext::ShouldContinue (WebCore::ActiveDOMObject&)>::operator()(WebCore::ActiveDOMObject&) const 7 0x12767c080 WebCore::ScriptExecutionContext::forEachActiveDOMObject(WTF::Function<WebCore::ScriptExecutionContext::ShouldContinue (WebCore::ActiveDOMObject&)> const&) const 8 0x12767c487 WebCore::ScriptExecutionContext::stopActiveDOMObjects() 9 0x1274a42ff WebCore::Document::stopActiveDOMObjects() 10 0x1274a40bc WebCore::Document::commonTeardown() 11 0x1274b0253 WebCore::Document::prepareForDestruction() 1645314 1 cdumez 2020-04-24 12:10:36 -0700 <rdar://problem/61611994> 1645316 2 397481 cdumez 2020-04-24 12:12:32 -0700 Created attachment 397481 Patch 1645326 3 397481 ap 2020-04-24 12:27:13 -0700 Comment on attachment 397481 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=397481&action=review > Source/WebCore/ChangeLog:14 > + No new tests, already covered by: > + media/modern-media-controls/placard-support/placard-support-airplay-fullscreen.html Is there any observable behavior change here in addition to not running into the GC issue? 1645334 4 cdumez 2020-04-24 12:32:56 -0700 (In reply to Alexey Proskuryakov from comment #3) > Comment on attachment 397481 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=397481&action=review > > > Source/WebCore/ChangeLog:14 > > + No new tests, already covered by: > > + media/modern-media-controls/placard-support/placard-support-airplay-fullscreen.html > > Is there any observable behavior change here in addition to not running > into the GC issue? No. In release, we would fail to fire the event in this case and return early. In debug we would hit the assertion. Now we don't even try to fire the event so that we no longer hit the assertion in this case. No behavior change since we don't fire the event either way. 1645388 5 ews-feeder 2020-04-24 14:11:05 -0700 Committed r260669: <https://trac.webkit.org/changeset/260669> All reviewed patches have been landed. Closing bug and clearing flags on attachment 397481. 1645515 6 ap 2020-04-24 19:11:34 -0700 > No. In release, we would fail to fire the event in this case and return > early. In debug we would hit the assertion. Now we don't even try to fire > the event so that we no longer hit the assertion in this case. No behavior > change since we don't fire the event either way. We would hit the assertion (or return in release) in the case where the wrapper was already GC collected. What about the case where it was not? 397481 2020-04-24 12:12:32 -0700 2020-04-24 14:11:06 -0700 Patch bug-210983-20200424121231.patch text/plain 2007 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjYwNjQyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZjhiMmMyZTNmNTM2NThh MmE0ZDFkNDY5OWVkMjg2ODM4ZjA5YjdkYi4uNTUwMjlkNWZkZGNiYjUwNzE3MGE5NTExNmMxNWJk MTIzYTFjOTRiNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDIwLTA0LTI0ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgQVNTRVJUSU9OIEZBSUxFRDog bV93cmFwcGVyIHVuZGVyIEhUTUxNZWRpYUVsZW1lbnQ6OnNldElzUGxheWluZ1RvV2lyZWxlc3NU YXJnZXQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIx MDk4MworICAgICAgICA8cmRhcjovL3Byb2JsZW0vNjE2MTE5OTQ+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlIGlzc3VlIHdhcyB0aGF0IHdlIHdl cmUgdHJ5aW5nIHRvIGZpcmUgYSBKUyBldmVudCBhcyBhIHJlc3VsdCBvZiBBY3RpdmVET01PYmpl Y3Q6OnN0b3AoKQorICAgICAgICBnZXR0aW5nIGNhbGxlZCwgd2hpY2ggaXMgbm90IGFsbG93ZWQu IFRvIGFkZHJlc3MgdGhlIGlzc3VlLCB3ZSBhdm9pZCBmaXJpbmcgdGhlIGV2ZW50IGlmCisgICAg ICAgIHRoZSBjb250ZXh0IGlzIGFscmVhZHkgc3RvcHBlZC4KKworICAgICAgICBObyBuZXcgdGVz dHMsIGFscmVhZHkgY292ZXJlZCBieToKKyAgICAgICAgbWVkaWEvbW9kZXJuLW1lZGlhLWNvbnRy b2xzL3BsYWNhcmQtc3VwcG9ydC9wbGFjYXJkLXN1cHBvcnQtYWlycGxheS1mdWxsc2NyZWVuLmh0 bWwKKworICAgICAgICAqIGh0bWwvSFRNTE1lZGlhRWxlbWVudC5jcHA6CisgICAgICAgIChXZWJD b3JlOjpIVE1MTWVkaWFFbGVtZW50OjpzZXRJc1BsYXlpbmdUb1dpcmVsZXNzVGFyZ2V0KToKKwog MjAyMC0wNC0yNCAgQWRyaWFuIFBlcmV6IGRlIENhc3RybyAgPGFwZXJlekBpZ2FsaWEuY29tPgog CiAgICAgICAgIEFkZCBtaXNzaW5nIEhUTUxOYW1lczo6IG5hbWVzcGFjZSBwcmVmaXggdG8gdXNh Z2Ugb2YgbGlUYWcgb2JqZWN0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxN ZWRpYUVsZW1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MTWVkaWFFbGVtZW50LmNw cAppbmRleCA2OTVkNGVlNTEyNWE1NjYzZjM0YmE5ODg5MzQ0OGQ4NTdmNDBhMmRhLi45NmI4YjBl ZmM3MDEyNjQ1NmFiNjllYzdiZWUxY2YyNzkwOWRmMTc0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi Q29yZS9odG1sL0hUTUxNZWRpYUVsZW1lbnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0bWwv SFRNTE1lZGlhRWxlbWVudC5jcHAKQEAgLTU3OTgsNyArNTc5OCw4IEBAIHZvaWQgSFRNTE1lZGlh RWxlbWVudDo6c2V0SXNQbGF5aW5nVG9XaXJlbGVzc1RhcmdldChib29sIGlzUGxheWluZ1RvV2ly ZWxlc3NUYXJnCiAgICAgICAgIG1fZmFpbGVkVG9QbGF5VG9XaXJlbGVzc1RhcmdldCA9IGZhbHNl OwogICAgICAgICBzY2hlZHVsZUNoZWNrUGxheWJhY2tUYXJnZXRDb21wYXRhYmlsaXR5KCk7CiAK LSAgICAgICAgZGlzcGF0Y2hFdmVudChFdmVudDo6Y3JlYXRlKGV2ZW50TmFtZXMoKS53ZWJraXRj dXJyZW50cGxheWJhY2t0YXJnZXRpc3dpcmVsZXNzY2hhbmdlZEV2ZW50LCBFdmVudDo6Q2FuQnVi YmxlOjpObywgRXZlbnQ6OklzQ2FuY2VsYWJsZTo6WWVzKSk7CisgICAgICAgIGlmICghaXNDb250 ZXh0U3RvcHBlZCgpKQorICAgICAgICAgICAgZGlzcGF0Y2hFdmVudChFdmVudDo6Y3JlYXRlKGV2 ZW50TmFtZXMoKS53ZWJraXRjdXJyZW50cGxheWJhY2t0YXJnZXRpc3dpcmVsZXNzY2hhbmdlZEV2 ZW50LCBFdmVudDo6Q2FuQnViYmxlOjpObywgRXZlbnQ6OklzQ2FuY2VsYWJsZTo6WWVzKSk7CiAg ICAgfSk7CiB9CiAK