Bug 233352

Summary:	HTMLTrackElement is not always kept alive until HTMLTrackElement::didCompleteLoad is called
Product:	WebKit	Reporter:	youenn fablet <youennf>
Component:	Media	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Normal	CC:	eric.carlson, jer.noble, peng.liu6, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description youenn fablet 2021-11-18 23:03:51 PST

From https://ews-build.s3-us-west-2.amazonaws.com/macOS-Catalina-Debug-WK1-Tests-EWS/r444685-20219/media/track/track-id-crash-log.txt
Application Specific Information:
CRASHING TEST: media/track/track-id.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000114cdcd1e WTFCrash + 14 (Assertions.cpp:322)
1   com.apple.WebCore             	0x0000000136ba5d8b WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   com.apple.WebCore             	0x00000001398104f8 WebCore::JSEventListener::ensureJSFunction(WebCore::ScriptExecutionContext&) const + 632
3   com.apple.WebCore             	0x000000013980f7f4 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 212
4   com.apple.WebCore             	0x000000013a0847c7 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 1063
5   com.apple.WebCore             	0x000000013a084224 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 356
6   com.apple.WebCore             	0x000000013a05811a WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const + 938
7   com.apple.WebCore             	0x000000013a07ad05 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 149
8   com.apple.WebCore             	0x000000013a07a57e WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 1134
9   com.apple.WebCore             	0x000000013a11211d WebCore::Node::dispatchEvent(WebCore::Event&) + 29
10  com.apple.WebCore             	0x000000013a5af127 WebCore::HTMLTrackElement::didCompleteLoad(WebCore::HTMLTrackElement::LoadStatus) + 135
11  com.apple.WebCore             	0x000000013a7dce35 WebCore::LoadableTextTrack::scheduleLoad(WTF::URL const&)::$_1::operator()() + 309
12  com.apple.WebCore             	0x000000013a7dccae WTF::Detail::CallableWrapper<WebCore::LoadableTextTrack::scheduleLoad(WTF::URL const&)::$_1, void>::call() + 30
13  com.apple.WebCore             	0x0000000136bbec92 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
14  com.apple.WebCore             	0x000000013a5bbb75 WebCore::HTMLTrackElement::scheduleTask(WTF::Function<void ()>&&)::$_3::operator()() + 21
15  com.apple.WebCore             	0x000000013a5bbaae WTF::Detail::CallableWrapper<WebCore::HTMLTrackElement::scheduleTask(WTF::Function<void ()>&&)::$_3, void>::call() + 30
16  com.apple.WebCore             	0x0000000136bbec92 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
17  com.apple.WebCore             	0x000000013a5bb2ce void WebCore::ActiveDOMObject::queueTaskKeepingObjectAlive<WebCore::HTMLTrackElement>(WebCore::HTMLTrackElement&, WebCore::TaskSource, WTF::Function<void ()>&&)::'lambda'()::operator()() const + 30
18  com.apple.WebCore             	0x000000013a5baf1e WTF::Detail::CallableWrapper<void WebCore::ActiveDOMObject::queueTaskKeepingObjectAlive<WebCore::HTMLTrackElement>(WebCore::HTMLTrackElement&, WebCore::TaskSource, WTF::Function<void ()>&&)::'lambda'(), void>::call() + 30
19  com.apple.WebCore             	0x0000000136bbec92 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
20  com.apple.WebCore             	0x000000013a08844e WebCore::EventLoopFunctionDispatchTask::execute() + 30
21  com.apple.WebCore             	0x000000013a07dc05 WebCore::EventLoop::run() + 373

Comment 1 youenn fablet 2021-11-18 23:06:26 PST

One possibility is that HTMLTrackElement::textTrackModeChanged is calling scheduleLoad and TextTrack was GCed before as it readyState was None.

Comment 2 Radar WebKit Bug Importer 2021-11-25 23:04:19 PST

<rdar://problem/85760489>