Bug 191876 – [MSE] MediaSource is leaked if the video element is removed while a SourceBuffer is updating

• Component: Media
• Status: NEW

[Alicia Boya García]

How to reproduce:

1. Build debug WebKit.
2. Copy the attached testcase to LayoutTests/imported/w3c/web-platform-tests/media-source/mediasource-leak-if-removed-updating.html
3. Run run-webkit-httpd
4. Open http://localhost:8800/media-source/mediasource-leak-if-removed-updating.html in the minibrowser with WEBKIT_DEBUG=MediaSource,Media
5. Look at the log.

Last lines of the log:

PlatformMediaSessionManager::addSession - 0x7f7690dd4258
MediaSource::MediaSource 0x7f7690dae2b0
MediaSource::setReadyState(0x7f7690dae2b0) : closed -> open
MediaSource::addSourceBuffer(video/mp4; codecs="mp4a.40.2,avc1.4d400d") 0x7f7690dae2b0
MediaSource::isTypeSupported(video/mp4; codecs="mp4a.40.2,avc1.4d400d")
http://localhost:8800/media-source/mediasource-leak-if-removed-updating.html:49:20: CONSOLE LOG Tearing down...
http://localhost:8800/media-source/mediasource-leak-if-removed-updating.html:51:20: CONSOLE LOG Test done.
PlatformMediaSessionManager::sessionWillEndPlayback - 0x7f7690dd4258
SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment(0x7f7690dcb600)
SourceBuffer::monitorBufferingRate(0x7f7690dcb600) - m_avegareBufferRate: 0,666891
SourceBuffer::provideMediaData(0x7f7690dcb600) - Enqueued 193 samples, 0 remaining
SourceBuffer::sourceBufferPrivateAppendComplete(0x7f7690dcb600) - buffered = [{0/1000000 = 0,000000}..{6423332/1000000 = 6,423332}] 
UNIMPLEMENTED: 
../../Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp(393) : virtual void WebCore::MediaPlayerPrivateGStreamerMSE::updatePlaybackRate()

Expected result:

The MediaSource should be destroyed shortly after the <video> element was removed from the DOM, but instead it survives until the document is unloaded.

You can verify this by setting "about:blank" in the address bar and looking at the logs again, only then the MediaSource is destroyed:

PlatformMediaSessionManager::removeSession - 0x7f7690dd4258
MediaSource::setReadyState(0x7f7690dae2b0) : open -> closed
MediaSource::removeSourceBuffer() 0x7f7690dae2b0
SourceBuffer::provideMediaData(0x7f7690dcb600) - Enqueued 0 samples, 0 remaining
SourceBuffer::sourceBufferPrivateAppendComplete(0x7f7690dcb600) - buffered = [{0/1000000 = 0,000000}..{6423332/1000000 = 6,423332}] 
PlatformMediaSessionManager::removeSession - 0x7f7690dd4258
PlatformMediaSessionManager::removeSession - 0x7f7690dd4258
MediaSource::~MediaSource 0x7f7690dae2b0
~MediaSourceClientGStreamerMSE()

The bug is reproducible every time. Only tested in WebKitGTK so far.

[Alicia Boya García]

Can someone confirm whether this also happens in non-GStreamer ports, e.g. AVFoundation?

[Alicia Boya García]

Created attachment 355391 [details]
Test case

[Alicia Boya García]

Strangely enough, the last reference to MediaSource is actually released and the object destroyed... only after 10 forced GC cycles. That's too many GC cycles.

The MediaSource is promptly destroyed if the video element is removed when no SourceBuffer is 'updating' on the other hand.