Bug 303366

Summary: [GTK] webrtc/datachannel/multiple-connections.html flaky crashes in RiceBackendProxy::create()
Product: WebKit Reporter: Claudio Saavedra <csaavedra>
Component: WebKitGTKAssignee: Philippe Normand <philn>
Status: RESOLVED FIXED    
Severity: Normal CC: bugs-noreply, philn
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=303372

Claudio Saavedra
Reported 2025-12-01 22:59:12 PST
I only checked one stacktrace, but this started crashing recently (around Time: 11/28/2025, 5:17:28 PM) https://build.webkit.org/results/GTK-Linux-64-bit-Release-Tests/303696@main%20(22347)/webrtc/datachannel/multiple-connections-crash-log.txt Thread 1 (Thread 0x7fca0b050440 (LWP 2716693)): #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fca1603327e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fca160168ff in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fca0f619ff5 in ??? () at /lib/x86_64-linux-gnu/libstdc++.so.6 #6 0x00007fca0f62f0da in ??? () at /lib/x86_64-linux-gnu/libstdc++.so.6 #7 0x00007fca0f619a55 in std::terminate() () at /lib/x86_64-linux-gnu/libstdc++.so.6 #8 0x00007fca189f6d05 in WebKit::RiceBackendProxy::create(WTF::ObjectIdentifierGeneric<WebKit::WebPageProxyIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long>, WebCore::RiceBackendClient&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #9 0x00007fca189b008c in WebKit::WebSocketProvider::createRiceBackend(WebCore::RiceBackendClient&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #10 0x00007fca19d27a29 in webkitGstWebRTCCreateIceAgent(WTF::String const&, WebCore::ScriptExecutionContext*) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #11 0x00007fca19d3c56e in WebCore::GStreamerMediaEndpoint::initializePipeline() () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #12 0x00007fca19d3cfc4 in WebCore::GStreamerPeerConnectionBackend::GStreamerPeerConnectionBackend(WebCore::RTCPeerConnection&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #13 0x00007fca19d483c7 in WebCore::createGStreamerPeerConnectionBackend(WebCore::RTCPeerConnection&, WebCore::MediaEndpointConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #14 0x00007fca19cfd1af in WebCore::RTCPeerConnection::initializeWithConfiguration(WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #15 0x00007fca19d03bec in WebCore::RTCPeerConnection::create(WebCore::Document&, WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #16 0x00007fca19502ac8 in WebCore::JSDOMConstructor<WebCore::JSRTCPeerConnection>::construct(JSC::JSGlobalObject*, JSC::CallFrame*) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #17 0x00007fc9be60c3e7 in ??? () #18 0x00007ffe3cf77300 in ??? () #19 0x00007fc9be675528 in ??? () #20 0x0000000000000000 in ??? ()
Attachments
Add attachment proposed patch, testcase, etc.
Claudio Saavedra
Comment 1 2025-12-02 01:30:55 PST
Gardened in https://commits.webkit.org/303742@main
Philippe Normand
Comment 2 2025-12-03 01:40:48 PST
I cannot reproduce this but I'll send a patch hardening this code a bit...
Philippe Normand
Comment 3 2025-12-03 01:45:41 PST
Pull request: https://github.com/WebKit/WebKit/pull/54761
EWS
Comment 4 2025-12-09 07:05:54 PST
Committed 304159@main (1c1bd26fae15): <https://commits.webkit.org/304159@main> Reviewed commits have been landed. Closing PR #54761 and removing active labels.
Claudio Saavedra
Comment 5 2025-12-10 05:36:19 PST
I'm afraid that this is still crashing. From https://build.webkit.org/results/GTK-Linux-64-bit-Release-Tests/304194@main%20(22435)/results.html (which is from after your changes landed): Thread 1 (Thread 0x7f7dc1d33440 (LWP 713438)): #0 0x00007f7dc91cb6b1 in g_logv () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #1 0x00007f7dc91cb963 in g_log () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #2 0x00007f7dcba7196a in g_object_set () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0 #3 0x00007f7dd097a0ea in WebCore::GStreamerMediaEndpoint::setConfiguration(WebCore::MediaEndpointConfiguration&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #4 0x00007f7dd097a8e3 in WebCore::createGStreamerPeerConnectionBackend(WebCore::RTCPeerConnection&, WebCore::MediaEndpointConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #5 0x00007f7dd092e3ff in WebCore::RTCPeerConnection::initializeWithConfiguration(WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #6 0x00007f7dd093503c in WebCore::RTCPeerConnection::create(WebCore::Document&, WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #7 0x00007f7dd012f958 in WebCore::JSDOMConstructor<WebCore::JSRTCPeerConnection>::construct(JSC::JSGlobalObject*, JSC::CallFrame*) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4 #8 0x00007f7d7520c3e7 in ??? () #9 0x00007ffd362fa2a0 in ??? () #10 0x00007f7dc9b18eea in llint_op_construct () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libjavascriptcoregtk-6.0.so.1 #11 0x0000000000000000 in ??? () Full trace is in https://build.webkit.org/results/GTK-Linux-64-bit-Release-Tests/304194@main%20(22435)/webrtc/datachannel/multiple-connections-crash-log.txt
Claudio Saavedra
Comment 6 2025-12-10 05:36:49 PST
(ok it's a different crash but since it's the same test I think it's ok to reuse this)
Claudio Saavedra
Comment 7 2025-12-10 05:38:59 PST
There is also a Debug crash (or release with assertions enabled), but this is in the web process instead: STDERR: ASSERTION FAILED: Unsafe to ref/deref from different threads STDERR: m_isOwnedByMainThread == isMainThread() STDERR: WTF/Headers/wtf/RefCountDebugger.h(114) : void WTF::RefCountDebugger::applyRefDerefThreadingCheck(unsigned int, RefCountIsThreadSafe) const STDERR: 1 0x7fa49d6050a1 WTF::RefCountedBase::derefBase() const STDERR: 2 0x7fa4a0430ed8 webkit_gst_webrtc_ice_backend_finalize(_GObject*) STDERR: 3 0x7fa497f4061d g_object_unref STDERR: 4 0x7fa41c0ba587 gst_webrtc_bin_dispose STDERR: 5 0x7fa497f403fe g_object_unref STDERR: 6 0x7fa493df559f gst_bin_remove_func STDERR: 7 0x7fa493df46af gst_bin_remove STDERR: 8 0x7fa493df49b3 gst_bin_dispose STDERR: 9 0x7fa497f403fe g_object_unref STDERR: 10 0x7fa493e18469 gst_element_call_async_func STDERR: 11 0x7fa494777532 ??? STDERR: 12 0x7fa494771d92 ??? STDERR: 13 0x7fa49928aaa4 start_thread STDERR: 14 0x7fa499317c6c clone3 https://ews-build.s3-us-west-2.amazonaws.com/GTK-WK2-Tests-EWS/8f2d446c-111453/webrtc/datachannel/multiple-connections-crash-log.txt
Philippe Normand
Comment 8 2025-12-10 06:54:07 PST
(In reply to Claudio Saavedra from comment #7) > There is also a Debug crash (or release with assertions enabled), but this > is in the web process instead: > > STDERR: ASSERTION FAILED: Unsafe to ref/deref from different threads > STDERR: m_isOwnedByMainThread == isMainThread() > STDERR: WTF/Headers/wtf/RefCountDebugger.h(114) : void > WTF::RefCountDebugger::applyRefDerefThreadingCheck(unsigned int, > RefCountIsThreadSafe) const > STDERR: 1 0x7fa49d6050a1 WTF::RefCountedBase::derefBase() const > STDERR: 2 0x7fa4a0430ed8 webkit_gst_webrtc_ice_backend_finalize(_GObject*) > STDERR: 3 0x7fa497f4061d g_object_unref > STDERR: 4 0x7fa41c0ba587 gst_webrtc_bin_dispose > STDERR: 5 0x7fa497f403fe g_object_unref > STDERR: 6 0x7fa493df559f gst_bin_remove_func > STDERR: 7 0x7fa493df46af gst_bin_remove > STDERR: 8 0x7fa493df49b3 gst_bin_dispose > STDERR: 9 0x7fa497f403fe g_object_unref > STDERR: 10 0x7fa493e18469 gst_element_call_async_func > STDERR: 11 0x7fa494777532 ??? > STDERR: 12 0x7fa494771d92 ??? > STDERR: 13 0x7fa49928aaa4 start_thread > STDERR: 14 0x7fa499317c6c clone3 > > https://ews-build.s3-us-west-2.amazonaws.com/GTK-WK2-Tests-EWS/8f2d446c- > 111453/webrtc/datachannel/multiple-connections-crash-log.txt That's https://bugs.webkit.org/show_bug.cgi?id=303919 no?
Claudio Saavedra
Comment 9 2025-12-10 07:11:44 PST
Right, just sharing it here in case it is useful (e.g. if a process crash causing another process to terminate crashing as well, etc).
Philippe Normand
Comment 10 2025-12-10 07:26:06 PST
Pull request: https://github.com/WebKit/WebKit/pull/55171
EWS
Comment 11 2025-12-11 03:46:05 PST
Committed 304288@main (e1c64e854142): <https://commits.webkit.org/304288@main> Reviewed commits have been landed. Closing PR #55171 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.