Bug 275205 – [GStreamer] Crash in WebCore::VideoFrameGStreamer::createWrappedSample when used by ImageDecoderGStreamer

• Component: Media
• Status: RESOLVED FIXED

[Michael Catanzaro]

Created attachment 471605 [details]
Full backtrace

Splitting this from bug #275178. Load https://www.vox.com/future-perfect/352359/milk-dairy-schools and it will usually crash.

I'll attach a full backtrace, but notably, in frame 10:

#10 0x00007feb6be1ce48 in WebCore::ImageDecoderGStreamer::ImageDecoderGStreamer (this=0x7fea73d94480, data=..., mimeType=Python Exception <class 'gdb.error'>: No symbol "operator&" in current context.
)
    at /home/mcatanzaro/Projects/WebKit/Source/WebCore/platform/graphics/gstreamer/ImageDecoderGStreamer.cpp:151
        parsebin = {m_ptr = 0x0 [_GstElement]} <-- that looks bad

[Michael Catanzaro]

Created attachment 471606 [details]
GStreamer log

[Michael Catanzaro]

Created attachment 471607 [details]
dots

[Philippe Normand]

All I get here is the bug 260455 crash.

[Philippe Normand]

That's the weird thing:

GStreamerElementHarness.cpp:368:outputCaps:<openh264dec0:src>[00m Output caps: audio/mpeg, mpegversion=(int)4, framed=(boolean)true, stream-format=(string)raw, level=(string)1, base-profile=(string)lc, profile=(string)lc, codec_data=(buffer)1390, rate=(int)22050, channels=(int)2

We somehow end-up with a video decoder harness configured to output raw audio...

[Philippe Normand]

Can you get harness dumps? With this env var, WEBKIT_GST_HARNESS_DUMP_DIR=/some/path you should get .mmd files in /some/path

[Philippe Normand]

And webkit*:9 GST_DEBUG please :)

[Philippe Normand]

Either my harness to mermaid graphing is bugged, or we have a big issue in the harness :/

https://mermaid.live/view#pako:eNrtWN2OnDYUfhVEb4MWG_YnaLVSm23aSr1Is1Fvwgh5wcyg5S9gNruKIvVp-mB9ktowDLaxwVNNG2nVuZiBw3c-n-8c22POFzuuEmwHdppXn-Mdaoj16_uwbLv7bYPqnZUVaIudBDNU49SoaemPG7nWx-sYlwQ3Nz-15B0z_5CVYVhetwXK8xu124YjRijuzTACAtf3KO7pJq4DUu3eZuWD9ZF90-e4TNSgJqaYJh4hkrvjOCI4LHNqvyPPObZcqyVN9YCdz1lCdoFbP-1J4hy1rSAE57igSt6wB4o4QAQNtYKN0t1AK9BqBXOtQNYKzLQyISta3cgz1KqcFq6JVler1Z1rdWWt0EwrE6LRGqO6TbOcKnQjX1D7hj552z-Z9HLojYZkQbMAk1TPKJhuyYFX7i0rF2VptO_ghb_Pz7kg_Wf6QKr0hN2oGRZ08yhJtkzAVItwXrS_LFrQo9H8iSS46J7c6EJQ_NuHW2ae9I64jcp3QesB85gluGKb7P5Cj0RdkvXI_cUaEoxIsIaEIxKOSFECy7YcMJ_v8-V8c7nUZJs81zjNyiS6FLL9gZrfUvOPg9eU9RG_UXEsZH3CSPNLdGZ6eSiv9WJZK6dEo1XzN7sQNTNGdVM9PdcoofU_XM6QOu4mZvOm_5mzM-uBHk708Bh6MNADJT040HsTvXcMPRzooZIeHuj9id4_ht4b6D0lvXegP5_oz0foUjnZPFoqCT-vLnXzaiV-hx7kSty2jjyljf30E-8Rsa2SerrRlbAwf0ds67_F8bQkJ-xGzWA2jqxCJmApFeF8Eq-WF6egR7M8J8x6ZlXYmUqT9FNVN5qRT1JIumWXJCPPIHot1PGXvZ07zY_IjdLdaAw5X5J7vyp4MF_B18sV5IXo9tcRYrAy5tB_Xj7luCetHn3tcA3LBzdKf6NBdOWD8_LNXqCAa1a_XspKAaF5AeEpCwj_tQJ6EQCGBfQ2Sn-jQXQF9OYF9GYFBGYF7KWsFNAzL6B3ygJ6YgGFt_0gCOj3O5T0QVO_0O6PvmdFjbfX983ZDbt4xE2bVWVg-b0pbVCBk8AiTYd7A00RRoWTVk2BSGA16HNvzvEjzgML9jf3qMUOPS7Q1yscWHncG-V7pimOEkRQYAEI3N7YIEIRvg_c4T7eobLEeTsyhzZTKx1NmDCaiVGZ0At4abK5A59WtvvyZHPH6JlsqQWgEN6_t509OeyQoZKFHocgUZ5tS7asqanjhXqipgJl5UyVC_zEdwFOU0z1AA9eDvforz_-7MHDrmJd-IPYHc62OzqSfzXc19kTzh3U1jgmDs1MVtFMnYH9OHnVZAUmzTPNTeAH5wFXsCGN7gGb4MSps5h0DXao0q6_Cqweu89zUxXoIN8PYDDEcJ8RutvUZOfkXUE1XUnWwXG095ONny1Tvbi3qlm9xObF_-X6xuWS22qzesntj29fMfe_q9iQI6kHp0_Rvj_1cjZfsdW8Jhy8POHASDh8ecKhWjjfHNTuBJ-6LH4gWcHvM0JfdUYrNvpmxNRf6FPO_Bd6URS73VUtueMcBsqlQfWU7O_twClHaXBin2tf_MNc4tUGsxg9OHn0-uPZavTg2OjhyaPXn6lXo4fHRu-dPHr9i9Bq9N4R0fMvlket-yNXptj3VIylaReq0qNuKy4zarYXvmmnIlD30_Q8awGJjUMtD1yLB5rFA03jgcvxeGvxeGbxeKbxeOp4-o7NLU4t3pH-Q-bBd2mK6IeH8EtmwDBEmnKY2ZIduRL6meHmhAwmEPL9o8OgLLSwtF_Z9CWBHoETO7C_hKVlhTbZUXhoB_QywSnqchLaYfmVQlFHqrvnMrYDdop4ZTdVt93ZQYrylt51NT0D4NsMbelRY4B8_Rubgqpr

[Michael Catanzaro]

Created attachment 471618 [details]
Even more debug log

[Michael Catanzaro]

Well I hit the crash probably at least 5 times just now, but each time I did something wrong (forgot to disable sandbox, used the wrong path in WEBKIT_GST_HARNESS_DUMP_DIR=, used Epiphany rather than MiniBrowser causing the web process to crash due to the gst-editing-services critical when setting GST_DEBUG=) and in each case failed to get the requested dumps.

Now that I've got the command right and can create the .mmd files, the crash has disappeared and I'm hitting the crash from bug #260723 instead, almost every time. Sometimes I also see bug #260455 or I hit a different crash in skia, but I'm not going to report a bug for the skia crash because I'm pretty sure it's caused by running out of file descriptors, so bug #260723 again. I also see MediaPlayerPrivateGStreamer.cpp error messages indicating that TextureMapperPlatformLayerProxyDMABuf is broken, but again I'm pretty confident that's caused by running out of file descriptors, so won't post them.

Finally I figured out that this bug #275205 never occurs when the sandbox is disabled. That's strange. That means there is also no good way to get the requested .mmd files. I will try to sabotage the sandbox a bit.

[Michael Catanzaro]

Created attachment 471619 [details]
Dump 1

[Michael Catanzaro]

Created attachment 471620 [details]
Dump 2

[Philippe Normand]

Pull request: https://github.com/WebKit/WebKit/pull/29706

[EWS]

Committed 279942@main (2d3841081a44): <https://commits.webkit.org/279942@main>

Reviewed commits have been landed. Closing PR #29706 and removing active labels.