Bug 204848 – [GStreamer] Crashes in MediaPlayerPrivateGStreamer::ensureGstGLContext

• Component: Media
• Status: RESOLVED FIXED

[Michael Catanzaro]

When WebKit has somehow gotten itself into the "bad state" described in bug #201507, webpages that use GStreamerGL crash instead of falling back to non-AC mode. Once the mysterious bad state is achieved, it becomes 100% reproducible by loading https://riot.igalia.com.

Program terminated with signal SIGSEGV, Segmentation fault.
#0  WebCore::MediaPlayerPrivateGStreamer::ensureGstGLContext (
    this=0x7f8c214d5700)
    at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1916
1916	    GstGLPlatform glPlatform = webkitContext->isEGLContext() ? GST_GL_PLATFORM_EGL : GST_GL_PLATFORM_GLX;

(gdb) bt full
#0  0x00007f8ca4020e5a in WebCore::MediaPlayerPrivateGStreamer::ensureGstGLContext() (this=0x7f8c214d5700)
    at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1916
        sharedDisplay = <optimized out>
        shouldAdoptRef = true
        webkitContext = 0x0
        glPlatform = <optimized out>
        glAPI = <optimized out>
        contextHandle = <optimized out>
        previousActiveContext = <optimized out>
#1  0x00007f8ca4020e5a in WebCore::MediaPlayerPrivateGStreamer::ensureGstGLContext() (this=0x7f8c214d5700)
    at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1861
#2  0x00007f8ca40213f9 in WebCore::MediaPlayerPrivateGStreamer::requestGLContext(char const*)
    (this=0x7f8c214d5700, contextType=0x7f8ca42e2725 "gst.gl.GLDisplay")
    at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1838
#3  0x00007f8ca402382c in WebCore::MediaPlayerPrivateGStreamer::ensureGLVideoSinkContext() (this=this@entry=0x7f8c214d5700)
    at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:3700
#4  0x00007f8ca4023af8 in WebCore::MediaPlayerPrivateGStreamer::changePipelineState(GstState) (this=0x7f8c214d5700, newState=GST_STATE_PAUSED) at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:1187
        currentState = GST_STATE_NULL
        pending = GST_STATE_VOID_PENDING
        __FUNCTION__ = "changePipelineState"
        setStateResult = <optimized out>
        pausedOrPlaying = <optimized out>
#5  0x00007f8ca401eff5 in WebCore::MediaPlayerPrivateGStreamer::commitLoad() (this=0x7f8c214d5700) at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:591
        __FUNCTION__ = "commitLoad"
#6  0x00007f8ca402f498 in WebCore::MediaPlayerPrivateGStreamer::loadFull(WTF::String const&, WTF::String const&) (this=0x7f8c214d5700, urlString=..., pipelineName=...) at ../Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:550
        url = {m_string = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >::isRefPtr".>, m_ptr = 0x7f8c318f96f0}}, m_isValid = 1, m_protocolIsInHTTPFamily = 1, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 5, m_userStart = 8, m_userEnd = 8, m_passwordEnd = 8, m_hostEnd = 23, m_pathAfterLastSlash = 30, m_pathEnd = 41, m_queryEnd = 41}
        __FUNCTION__ = "loadFull"
#7  0x00007f8ca402f588 in WebCore::MediaPlayerPrivateGStreamer::load(WTF::String const&) (this=<optimized out>, urlString=...) at DerivedSources/ForwardingHeaders/wtf/RefPtr.h:56
#8  0x00007f8ca39d5033 in WebCore::MediaPlayer::loadWithNextMediaEngine(WebCore::MediaPlayerFactory const*) (this=this@entry=0x7f8c31721398, current=current@entry=0x0) at DerivedSources/ForwardingHeaders/wtf/URL.h:94
        engine = <optimized out>
#9  0x00007f8ca39d533e in WebCore::MediaPlayer::load(WTF::URL const&, WebCore::ContentType const&, WTF::String const&) (this=0x7f8c31721398, url=..., contentType=..., keySystem=...) at ../Source/WebCore/platform/graphics/MediaPlayer.cpp:410
        protectedThis = {static isRef = <error reading variable: Missing ELF symbol "WTF::Ref<WebCore::MediaPlayer, WTF::DumbPtrTraits<WebCore::MediaPlayer> >::isRef".>, m_ptr = 0x7f8c31721398}
#10 0x00007f8ca3530a22 in WebCore::HTMLMediaElement::loadResource(WTF::URL const&, WebCore::ContentType&, WTF::String const&) (this=this@entry=0x7f8c4a82f390, initialURL=..., contentType=..., keySystem=...) at ../Source/WebCore/html/HTMLMediaElement.cpp:1618
        frame = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WebCore::Frame, WTF::DumbPtrTraits<WebCore::Frame> >::isRefPtr".>, m_ptr = 0x7f8c9ad87000}
        page = <optimized out>
        url = {m_string = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >::isRefPtr".>, m_ptr = 0x7f8c318f96f0}}, m_isValid = 1, m_protocolIsInHTTPFamily = 1, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 5, m_userStart = 8, m_userEnd = 8, m_passwordEnd = 8, m_hostEnd = 23, m_pathAfterLastSlash = 30, m_pathEnd = 41, m_queryEnd = 41}
        resource = 0x0
        loadAttempted = false
#11 0x00007f8ca3531325 in WebCore::HTMLMediaElement::loadNextSourceChild() (this=0x7f8c4a82f390) at ../Source/WebCore/html/HTMLMediaElement.cpp:1499
        contentType = {m_type = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >::isRefPtr".>, m_ptr = 0x7f8c495cf2c0}}}
        keySystem = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >::isRefPtr".>, m_ptr = 0x0}}
        mediaURL = {m_string = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >::isRefPtr".>, m_ptr = 0x7f8c318f96f0}}, m_isValid = 1, m_protocolIsInHTTPFamily = 1, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 5, m_userStart = 8, m_userEnd = 8, m_passwordEnd = 8, m_hostEnd = 23, m_pathAfterLastSlash = 30, m_pathEnd = 41, m_queryEnd = 41}
#12 0x00007f8ca3531715 in WebCore::HTMLMediaElement::<lambda()>::operator() (__closure=<optimized out>) at ../Source/WebCore/html/HTMLMediaElement.cpp:1481
        mode = WebCore::HTMLMediaElement::<lambda()>::Children
#13 0x00007f8ca3531715 in WTF::Detail::CallableWrapper<WebCore::HTMLMediaElement::selectMediaResource()::<lambda()>, void>::call(void) (this=0x7f8c214ccf78) at DerivedSources/ForwardingHeaders/wtf/Function.h:52
#14 0x00007f8ca3922b4d in WTF::Function<void ()>::operator()() const (this=<synthetic pointer>) at DerivedSources/ForwardingHeaders/wtf/Function.h:76
        task = {m_callableWrapper = std::unique_ptr<WTF::Detail::CallableWrapperBase<void>> = {get() = 0x7f8c214ccf90}}
#15 0x00007f8ca3922b4d in WebCore::TaskDispatcher<WebCore::Timer>::dispatchOneTask() (this=0x7f8c4a82f798) at ../Source/WebCore/platform/GenericTaskQueue.cpp:110
        task = {m_callableWrapper = std::unique_ptr<WTF::Detail::CallableWrapperBase<void>> = {get() = 0x7f8c214ccf90}}
#16 0x00007f8ca3922c1e in WebCore::TaskDispatcher<WebCore::Timer>::sharedTimerFired() () at ../Source/WebCore/platform/GenericTaskQueue.cpp:85
        queuedDispatchers = {m_start = 1, m_end = 5, m_buffer = {<WTF::VectorBufferBase<WTF::WeakPtr<WebCore::TaskDispatcher<WebCore::Timer> > >> = {m_buffer = 0x7f8c22482c00, m_capacity = 16, m_size = <optimized out>}, <No data fields>}}
#17 0x00007f8ca394df74 in WebCore::ThreadTimers::sharedTimerFiredInternal() (this=0x7f8c9ad8e370) at ../Source/WebCore/platform/ThreadTimers.h:104
        item = {static isRef = <error reading variable: Missing ELF symbol "WTF::Ref<WebCore::ThreadTimerHeapItem, WTF::DumbPtrTraits<WebCore::ThreadTimerHeapItem> >::isRef".>, m_ptr = 0x7f8c214a4600}
        timer = <optimized out>
        interval = <optimized out>
        timeToQuit = <optimized out>
#18 0x00007f8ca394df74 in WebCore::ThreadTimers::sharedTimerFiredInternal() (this=0x7f8c9ad8e370) at ../Source/WebCore/platform/ThreadTimers.cpp:101
#19 0x00007f8ca0341448 in WTF::RunLoop::TimerBase::<lambda(gpointer)>::operator() (__closure=0x0, userData=0x7f8ca4e6a9d0 <WebCore::MainThreadSharedTimer::singleton()::instance+16>) at ../Source/WTF/wtf/glib/RunLoopGLib.cpp:177
        timer = 0x7f8ca4e6a9d0 <WebCore::MainThreadSharedTimer::singleton()::instance+16>
        source = 0x55ad6cd8fb10
#20 0x00007f8ca0341448 in WTF::RunLoop::TimerBase::<lambda(gpointer)>::_FUN(gpointer) () at ../Source/WTF/wtf/glib/RunLoopGLib.cpp:183
#21 0x00007f8ca09c358e in g_main_context_remove_poll (context=0x55ad6cad3d90, fd=0x55ad6cd8fae0) at ../glib/gmain.c:4456
        __func__ = "g_main_context_remove_poll"
#22 0xffffffff06278ef0 in  ()
#23 0x0000000000000001 in  ()
#24 0x0000000000000000 in  ()

[Michael Catanzaro]

This also causes every article page on https://vox.com to crash (again, only after the bad UI process state has been achieved).

[Philippe Normand]

Created attachment 384903 [details]
Patch

[Philippe Normand]

Untested, since I can't reproduce your bugs. :)
So please. Test!

[Michael Catanzaro]

I can't reproduce it either, Phil. This just seems to happen once every few days. I'll let you know if I still see the crashes in 2.27.4.

[Philippe Normand]

Committed r253284: <https://trac.webkit.org/changeset/253284>