| Summary: | [GStreamer] Crash in gst_buffer_get_meta when playing reddit video | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Michael Catanzaro <mcatanzaro> | ||||||
| Component: | Media | Assignee: | Nobody <webkit-unassigned> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | bugs-noreply, mcatanzaro, pnormand, webkit-bug-importer | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | PC | ||||||||
| OS: | Linux | ||||||||
| Attachments: |
|
||||||||
|
Description
Michael Catanzaro
2021-11-09 16:15:38 PST
Created attachment 443748 [details]
Full backtrace
To take the GStreamer debug log, I copy/pasted this line from https://trac.webkit.org/wiki/WebKitGTK/Debugging#Debuggingmultimediastuff: $ export GST_DEBUG="3,webkit*:6" GST_DEBUG_FILE="$HOME/gst.log" GST_DEBUG_NO_COLOR=1 WEBKIT_FORCE_SANDBOX=0 Then realized it doesn't work because the log is being generated in the sandboxed home directory, so I decided to run using --filesystem=home: $ flatpak run --filesystem=home org.gnome.Epiphany.Devel -p Irritatingly, adding --filesystem=home somehow avoids the crash. O_O Created attachment 443753 [details]
GStreamer log
I wound up writing the log under ~/.var/app/org.gnome.Epiphany.Devel/config in order to exfiltrate it from the sandbox without using --filesystem=home or -d, which for some reason causes the video to play properly.
Note there are a bunch of FIXMEs at the bottom of the log immediately before the crash:
0:00:03.947285498 345 0x5616fd08f920 FIXME decodebin3 gstdecodebin3.c:1422:handle_stream_collection:<decodebin3-0> New collection but already had one ...
0:00:03.947313491 345 0x5616fd08f920 DEBUG webkitmediaplayer MediaPlayerPrivateGStreamer.cpp:1503:handleStreamCollectionMessage:<MSE-media-player-2> Ignoring redundant STREAM_COLLECTION from <decodebin3-0>
0:00:03.947339070 345 0x5616fd08f920 FIXME decodebin3 gstdecodebin3.c:1103:update_requested_selection:<decodebin3-0> Implement EXPOSE_ALL_MODE
0:00:03.947365761 345 0x5616fd08f920 FIXME decodebin3 gstdecodebin3.c:1156:update_requested_selection:<decodebin3-0> Replacing non-NULL requested_selection, what should we do ??
I can't reproduce this, but I think I see what the problem is... 1. In gst_h264_parse_pre_push_frame() a local buffer variable is set to the frame->out_buffer pointer 2. When gst_h264_parse_handle_sps_pps_nals() is called with that buffer, the frame->out_buffer pointer is updated (gst_buffer_replace() call) and now buffer is dangling 3. buffer pointer is accessed (un-modified) after the gst_h264_parse_handle_sps_pps_nals() BOOM Can you cherry-pick this commit in your SDK? I think it might fix the problem. If so, I'll ask to have it in 1.18.6 if that ever happens. https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/0f084d46247f9009584b482cea8196b5b871cc73 (In reply to Philippe Normand from comment #4) > Can you cherry-pick this commit in your SDK? I think it might fix the > problem. If so, I'll ask to have it in 1.18.6 if that ever happens. > > https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/ > 0f084d46247f9009584b482cea8196b5b871cc73 Sure, I'll plan to add it to freedesktop-sdk, then update GNOME runtime to a newer freedesktop-sdk. It's still crashing 100% for me so I'll know whether it's fixed or not. Backports: https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/merge_requests/6596 https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/merge_requests/6597 > * Visit https://www.reddit.com/r/StLouis/comments/qqc4tk/explosions_rocked_a_home_in_belleville_this/ (probably any reddit video would suffice)
> * Try to play the video
Works fine in Ephy TP. Closing.
(In reply to Michael Catanzaro from comment #6) > Backports: > > https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/merge_requests/6596 > https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/merge_requests/6597 I think this probably fixed it. |