304834 2026-01-01 17:19:16 -0800 REGRESSION(274853@main): nullopt dereference of m_seekTargetPromise in MediaSource::waitForTarget for imported/w3c/web-platform-tests/media-source/mediasource-seek-beyond-duration.html 2026-01-05 02:32:12 -0800 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=269461 InRadar P2 Normal --- 1 fujii webkit-unassigned jean-yves.avenard webkit-bug-importer oldest_to_newest 2168837 0 fujii 2026-01-01 17:19:16 -0800 REGRESSION(274853@main): nullopt dereference of m_seekTargetPromise in MediaSource::waitForTarget for imported/w3c/web-platform-tests/media-source/mediasource-seek-beyond-duration.html History: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fmedia-source%2Fmediasource-seek-beyond-duration.html https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304985@main%20(17781)/imported/w3c/web-platform-tests/media-source/mediasource-seek-beyond-duration-crash-log.txt Thread 1 (Thread 0x7f6abc796ec0 (LWP 3751308)): #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007f6acae3327e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007f6acae168ff in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007f6ac0d6190d in std::__glibcxx_assert_fail(char const*, int, char const*, char const*) () at /lib/x86_64-linux-gnu/libstdc++.so.6 #6 0x00007f6adefc5a89 in std::_Optional_base_impl<WTF::NativePromiseProducer<WTF::MediaTime, WebCore::PlatformMediaError, 16u>, std::_Optional_base<WTF::NativePromiseProducer<WTF::MediaTime, WebCore::PlatformMediaError, 16u>, false, false> >::_M_get (this=0x7f6ab2404b40) at /usr/include/c++/13/optional:479 #7 0x00007f6adefbf512 in std::optional<WTF::NativePromiseProducer<WTF::MediaTime, WebCore::PlatformMediaError, 16u> >::operator-> (this=0x7f6ab2404b40) at /usr/include/c++/13/optional:968 #8 0x00007f6adefb5d7a in WebCore::MediaSource::waitForTarget (this=0x7f6ab2404a60, target=...) at ../../../Source/WebCore/Modules/mediasource/MediaSource.cpp:409 #9 0x00007f6adefb4077 in WebCore::MediaSourceClientImpl::waitForTarget(WebCore::SeekTarget const&)::{lambda(WebCore::MediaSource&)#1}::operator()(WebCore::MediaSource&) (__closure=0x7f6ab2403608, parent=...) at ../../../Source/WebCore/Modules/mediasource/MediaSource.cpp:163 #10 0x00007f6adefef2f2 in WTF::Detail::CallableWrapper<WebCore::MediaSourceClientImpl::waitForTarget(WebCore::SeekTarget const&)::{lambda(WebCore::MediaSource&)#1}, void, WebCore::MediaSource&>::call(WebCore::MediaSource&) (this=0x7f6ab2403600, in#0=...) at WTF/Headers/wtf/Function.h:59 #11 0x00007f6adefbded1 in WTF::Function<void (WebCore::MediaSource&)>::operator()(WebCore::MediaSource&) const (this=0x7f6ab2364b48, in#0=...) at WTF/Headers/wtf/Function.h:103 #12 0x00007f6adefb3a54 in WebCore::MediaSourceClientImpl::ensureWeakOnDispatcher(WTF::Function<void (WebCore::MediaSource&)>&&, bool) const::{lambda()#1}::operator()() const (__closure=0x7f6ab2364b48) at ../../../Source/WebCore/Modules/mediasource/MediaSource.cpp:119 #13 0x00007f6adefee16e in WebCore::MediaSourceClientImpl::ensureWeakOnDispatcher(WTF::Function<void (WebCore::MediaSource&)>&&, bool) const::{lambda(auto:1&)#1}::operator()<WebCore::ScriptExecutionContext>(WebCore::ScriptExecutionContext&) const (__closure=0x7f6ab2364b48) at ../../../Source/WebCore/Modules/mediasource/MediaSource.cpp:122 #14 0x00007f6adefee1a6 in WTF::Detail::CallableWrapper<WebCore::MediaSourceClientImpl::ensureWeakOnDispatcher(WTF::Function<void (WebCore::MediaSource&)>&&, bool) const::{lambda(auto:1&)#1}, void, WebCore::ScriptExecutionContext&>::call(WebCore::ScriptExecutionContext&) (this=0x7f6ab2364b40, in#0=...) at WTF/Headers/wtf/Function.h:59 #15 0x00007f6adec03759 in WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const (this=0x7ffef6d4ba00, in#0=...) at WTF/Headers/wtf/Function.h:103 #16 0x00007f6adf5e82ad in WebCore::ScriptExecutionContext::Task::performTask (this=0x7ffef6d4ba00, context=...) at WebCore/PrivateHeaders/WebCore/ScriptExecutionContext.h:279 #17 0x00007f6ae0e317f1 in WebCore::ScriptExecutionContext::ensureOnContextThread (identifier=..., task=...) at ../../../Source/WebCore/dom/ScriptExecutionContext.cpp:808 #18 0x00007f6adefb3d1e in WebCore::MediaSourceClientImpl::ensureWeakOnDispatcher(WTF::Function<void (WebCore::MediaSource&)>&&, bool) const (this=0x7f6ab23578a0, function=..., forceRun=false) at ../../../Source/WebCore/Modules/mediasource/MediaSource.cpp:121 #19 0x00007f6adefb428a in WebCore::MediaSourceClientImpl::waitForTarget (this=0x7f6ab23578a0, target=...) at ../../../Source/WebCore/Modules/mediasource/MediaSource.cpp:162 #20 0x00007f6ae249e4f0 in WebCore::MediaSourcePrivate::waitForTarget (this=0x7f6ab2384960, target=...) at ../../../Source/WebCore/platform/graphics/MediaSourcePrivate.cpp:103 #21 0x00007f6ae2790a61 in WebCore::MediaPlayerPrivateGStreamerMSE::doSeek (this=0x7f6ab000c000, target=..., rate=1, isAsync=false, isSegment=false) at ../../../Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:314 #22 0x00007f6ae278fdeb in WebCore::MediaPlayerPrivateGStreamerMSE::seekToTarget (this=0x7f6ab000c000, target=...) at ../../../Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:247 #23 0x00007f6ae2479da5 in WebCore::MediaPlayer::seekToTarget (this=0x7f6ab223e080, target=...) at ../../../Source/WebCore/platform/graphics/MediaPlayer.cpp:864 #24 0x00007f6ae122fe26 in WebCore::HTMLMediaElement::seekTask (this=0x7f6ab0222800) at ../../../Source/WebCore/html/HTMLMediaElement.cpp:4040 #25 0x00007f6ae125fea0 in operator()<WebCore::HTMLMediaElement> (__closure=0x7f6ab261b348, element=warning: RTTI symbol not found for class 'WebCore::HTMLVideoElement' ...) at ../../../Source/WebCore/html/HTMLMediaElement.cpp:3941 #26 0x00007f6ae125fed0 in operator() (__closure=0x7f6ab261b348) at WebCore/PrivateHeaders/WebCore/ActiveDOMObject.h:123 #27 0x00007f6ae12c9a80 in WTF::Detail::CallableWrapper<WebCore::ActiveDOMObject::queueCancellableTaskKeepingObjectAlive<WebCore::HTMLMediaElement, WebCore::HTMLMediaElement::seekWithTolerance(const WebCore::SeekTarget&, bool)::<lambda(auto:614&)> >(WebCore::HTMLMediaElement&, WebCore::TaskSource, WTF::TaskCancellationGroup&, WebCore::HTMLMediaElement::seekWithTolerance(const WebCore::SeekTarget&, bool)::<lambda(auto:614&)>&&)::<lambda()>, void>::call(void) (this=0x7f6ab261b340) at WTF/Headers/wtf/Function.h:59 #28 0x00007f6ad9039f7d in WTF::Function<void ()>::operator()() const (this=0x7f6ab23649b0) at WTF/Headers/wtf/Function.h:103 #29 0x00007f6adf89f8fa in WTF::CancellableTask::operator() (this=0x7f6ab23649a0) at WTF/Headers/wtf/CancellableTask.h:100 #30 0x00007f6ae125ff14 in operator() (__closure=0x7f6ab2364998) at WebCore/PrivateHeaders/WebCore/ActiveDOMObject.h:128 #31 0x00007f6ae12c9a5c in WTF::Detail::CallableWrapper<WebCore::ActiveDOMObject::queueCancellableTaskKeepingObjectAlive<WebCore::HTMLMediaElement, WebCore::HTMLMediaElement::seekWithTolerance(const WebCore::SeekTarget&, bool)::<lambda(auto:614&)> >(WebCore::HTMLMediaElement&, WebCore::TaskSource, WTF::TaskCancellationGroup&, WebCore::HTMLMediaElement::seekWithTolerance(const WebCore::SeekTarget&, bool)::<lambda(auto:614&)>&&)::<lambda()>, void>::call(void) (this=0x7f6ab2364990) at WTF/Headers/wtf/Function.h:59 #32 0x00007f6ad9039f7d in WTF::Function<void ()>::operator()() const (this=0x7f6ab23649e0) at WTF/Headers/wtf/Function.h:103 #33 0x00007f6ae0d0c6bc in WebCore::EventLoopFunctionDispatchTask::execute (this=0x7f6ab23649c0) at ../../../Source/WebCore/dom/EventLoop.cpp:551 #34 0x00007f6ae0d0b04e in WebCore::EventLoop::run (this=0x7f6ab21d6e00, deadline=std::optional = {...}) at ../../../Source/WebCore/dom/EventLoop.cpp:337 #35 0x00007f6ae0f099ad in WebCore::WindowEventLoop::didReachTimeToRun (this=0x7f6ab21d6e00) at ../../../Source/WebCore/dom/WindowEventLoop.cpp:233 #36 0x00007f6ae0f0e010 in WebCore::Timer::Timer<WebCore::WindowEventLoop, WebCore::WindowEventLoop>(WebCore::WindowEventLoop&, void (WebCore::WindowEventLoop::*)())::{lambda()#1}::operator()() const (__closure=0x7f6ab21c8758) at WebCore/PrivateHeaders/WebCore/Timer.h:167 #37 0x00007f6ae0f21618 in WTF::Detail::CallableWrapper<WebCore::Timer::Timer<WebCore::WindowEventLoop, WebCore::WindowEventLoop>(WebCore::WindowEventLoop&, void (WebCore::WindowEventLoop::*)())::{lambda()#1}, void>::call() (this=0x7f6ab21c8750) at WTF/Headers/wtf/Function.h:59 #38 0x00007f6ad9039f7d in WTF::Function<void ()>::operator()() const (this=0x7f6ab21d6f58) at WTF/Headers/wtf/Function.h:103 #39 0x00007f6ada0b35f4 in WebCore::Timer::fired (this=0x7f6ab21d6f20) at WebCore/PrivateHeaders/WebCore/Timer.h:189 #40 0x00007f6ae217afe5 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x7f6ab20d9a40) at ../../../Source/WebCore/platform/ThreadTimers.cpp:138 #41 0x00007f6ae217a7c9 in operator() (__closure=0x7f6ab20017e8) at ../../../Source/WebCore/platform/ThreadTimers.cpp:74 #42 0x00007f6ae218d0c6 in WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::<lambda()>, void>::call(void) (this=0x7f6ab20017e0) at WTF/Headers/wtf/Function.h:59 #43 0x00007f6ad9039f7d in WTF::Function<void ()>::operator()() const (this=0x7f6ae57bacb0 <WebCore::MainThreadSharedTimer::singleton()::instance+48>) at WTF/Headers/wtf/Function.h:103 #44 0x00007f6ae210ec58 in WebCore::MainThreadSharedTimer::fired (this=0x7f6ae57bac80 <WebCore::MainThreadSharedTimer::singleton()::instance>) at ../../../Source/WebCore/platform/MainThreadSharedTimer.cpp:85 #45 0x00007f6ae2110d68 in WTF::RunLoop::Timer::Timer<WebCore::MainThreadSharedTimer>(WTF::Ref<WTF::RunLoop, WTF::RawPtrTraits<WTF::RunLoop>, WTF::DefaultRefDerefTraits<WTF::RunLoop> >&&, WTF::ASCIILiteral, WebCore::MainThreadSharedTimer*, void (WebCore::MainThreadSharedTimer::*)())::{lambda()#1}::operator()() const (__closure=0x7f6ab20d9a78) at WTF/Headers/wtf/RunLoop.h:220 #46 0x00007f6ae2116922 in WTF::Detail::CallableWrapper<WTF::RunLoop::Timer::Timer<WebCore::MainThreadSharedTimer>(WTF::Ref<WTF::RunLoop, WTF::RawPtrTraits<WTF::RunLoop>, WTF::DefaultRefDerefTraits<WTF::RunLoop> >&&, WTF::ASCIILiteral, WebCore::MainThreadSharedTimer*, void (WebCore::MainThreadSharedTimer::*)())::{lambda()#1}, void>::call() (this=0x7f6ab20d9a70) at WTF/Headers/wtf/Function.h:59 #47 0x00007f6ad9039f7d in WTF::Function<void ()>::operator()() const (this=0x7f6ae57bacf0 <WebCore::MainThreadSharedTimer::singleton()::instance+112>) at WTF/Headers/wtf/Function.h:103 #48 0x00007f6ada24472e in WTF::RunLoop::Timer::fired (this=0x7f6ae57bacb8 <WebCore::MainThreadSharedTimer::singleton()::instance+56>) at WTF/Headers/wtf/RunLoop.h:262 #49 0x00007f6ac9731b5f in operator() (__closure=0x0, userData=0x7f6ae57bacb8 <WebCore::MainThreadSharedTimer::singleton()::instance+56>) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:327 #50 0x00007f6ac9731ba3 in _FUN () at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:331 #51 0x00007f6ac9730728 in operator() (__closure=0x0, source=0x558ca0ddaaa0, callback=0x7f6ac9731b82 <_FUN(gpointer)>, userData=0x7f6ae57bacb8 <WebCore::MainThreadSharedTimer::singleton()::instance+56>) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:115 #52 0x00007f6ac9730795 in _FUN () at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:118 #53 0x00007f6ac3bc649e in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #54 0x00007f6ac3bc6710 in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #55 0x00007f6ac9731119 in WTF::RunLoop::runGLibMainLoopIteration (this=0x7f6ab201c110, mayBlock=WTF::RunLoop::MayBlock::Yes) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:190 #56 0x00007f6ac9731188 in WTF::RunLoop::runGLibMainLoop (this=0x7f6ab201c110) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:199 #57 0x00007f6ac9731250 in WTF::RunLoop::run () at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:212 #58 0x00007f6adbe0c3c2 in WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run (this=0x7ffef6d4c620, argc=4, argv=0x7ffef6d4c7e8) at ../../../Source/WebKit/Shared/AuxiliaryProcessMain.h:77 #59 0x00007f6adbe0ba45 in WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainGtk> (argc=4, argv=0x7ffef6d4c7e8) at ../../../Source/WebKit/Shared/AuxiliaryProcessMain.h:103 #60 0x00007f6adbe0b1aa in WebKit::WebProcessMain (argc=4, argv=0x7ffef6d4c7e8) at ../../../Source/WebKit/WebProcess/gtk/WebProcessMainGtk.cpp:117 #61 0x0000558c8f4417ed in main (argc=4, argv=0x7ffef6d4c7e8) at ../../../Source/WebKit/WebProcess/EntryPoint/unix/WebProcessMain.cpp:31 2168838 1 fujii 2026-01-01 17:20:13 -0800 In MediaSource::waitForTarget, m_seekTargetPromise can be nullopt because above monitorSourceBuffers() may reset m_seekTargetPromise. This code was added by bug#269461. > 407 monitorSourceBuffers(); > 408 > 409 return m_seekTargetPromise->promise(); https://github.com/WebKit/WebKit/blob/283c780414b7c24e4a911c823af665f53a15e8f7/Source/WebCore/Modules/mediasource/MediaSource.cpp#L407-L409 2168843 2 fujii 2026-01-01 17:42:17 -0800 Pull request: https://github.com/WebKit/WebKit/pull/55991 2169251 3 ews-feeder 2026-01-05 02:31:20 -0800 Committed 305103@main (7df9b18a84da): <https://commits.webkit.org/305103@main> Reviewed commits have been landed. Closing PR #55991 and removing active labels. 2169252 4 webkit-bug-importer 2026-01-05 02:32:12 -0800 <rdar://problem/167541932>