Bug 304130
| Summary: | [Debug][GStreamer] Several tests crashing due to RiceBackendClient deref'd from wrong thread | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Claudio Saavedra <csaavedra> |
| Component: | WebKitGTK | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | aboya, bugs-noreply, calvaris, eocanha, philn |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Claudio Saavedra
At least the following tests are crashing in Debug (and with assertions enabled) as of 304401@main:
imported/w3c/web-platform-tests/webrtc/protocol/dtls-fingerprint-validation.html
fast/mediastream/RTCPeerConnection-media-setup-callbacks-single-dialog.html
imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-parameterless.https.html
imported/w3c/web-platform-tests/webrtc/protocol/split.https.html
imported/w3c/web-platform-tests/webrtc/protocol/handover.html
Thread 1 (Thread 0x7faf497fa6c0 (LWP 1163070)):
#0 WTFCrash () at ../../../Source/WTF/wtf/Assertions.cpp:380
#1 0x00007fc36e2a85ec in WTF::RefCountDebugger::applyRefDerefThreadingCheck (this=0x7fc347d5cdd0, refCount=2, isThreadSafe=WTF::RefCountDebugger::RefCountIsThreadSafe::No) at WTF/Headers/wtf/RefCountDebugger.h:114
#2 0x00007fc36e2a8649 in WTF::RefCountDebugger::willDeref (this=0x7fc347d5cdd0, refCount=2, isThreadSafe=WTF::RefCountDebugger::RefCountIsThreadSafe::No) at WTF/Headers/wtf/RefCountDebugger.h:146
#3 0x00007fc36e2aa836 in WTF::RefCountedBase::derefBase (this=0x7fc347d5cdd0) at WTF/Headers/wtf/RefCounted.h:53
#4 0x00007fc370c18a4e in WTF::RefCounted<WebCore::RiceBackendClient>::deref (this=0x7fc347d5cdd0) at WTF/Headers/wtf/RefCounted.h:75
#5 0x00007fc370c12ec7 in WTF::DefaultRefDerefTraits<WebCore::RiceBackendClient>::derefIfNotNull (ptr=0x7fc347d5cdd0) at WTF/Headers/wtf/Ref.h:64
#6 0x00007fc370c0f128 in WTF::RefPtr<WebCore::RiceBackendClient, WTF::RawPtrTraits<WebCore::RiceBackendClient>, WTF::DefaultRefDerefTraits<WebCore::RiceBackendClient> >::~RefPtr (this=0x560e38978120, __in_chrg=<optimized out>) at WTF/Headers/wtf/RefPtr.h:66
#7 0x00007fc374366384 in _WebKitGstIceAgentPrivate::~_WebKitGstIceAgentPrivate (this=0x560e38978120, __in_chrg=<optimized out>) at ../../../Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp:81
#8 0x00007fc3743663cd in webkit_gst_webrtc_ice_backend_finalize (object=0x560e389781f0) at ../../../Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp:122
#9 0x00007fc35ecae61d in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#10 0x00007fc1e7eb5587 in gst_webrtc_bin_dispose (object=0x560e39290450) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c:8783
#11 0x00007fc35ecae3fe in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#12 0x00007fc35831959f in gst_bin_remove_func (bin=0x560e38f9aed0, element=<optimized out>) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstbin.c:1817
#13 0x00007fc3583186af in gst_bin_remove (bin=bin@entry=0x560e38f9aed0, element=0x560e39290450) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstbin.c:1868
#14 0x00007fc3583189b3 in gst_bin_dispose (object=0x560e38f9aed0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstbin.c:527
#15 0x00007fc35ecae3fe in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#16 0x00007fc35833c469 in gst_element_call_async_func (data=0x560e39294160, user_data=<optimized out>) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstelement.c:3842
#17 0x00007fc358ce0532 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007fc358cdad92 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#19 0x00007fc36008aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#20 0x00007fc360117c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304401@main%20(17729)/imported/w3c/web-platform-tests/webrtc/protocol/handover-crash-log.txt
https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304401@main%20(17729)/imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-parameterless.https-crash-log.txt
etc
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Claudio Saavedra
This seems to be very recent:
03661@main CRASH (Expected: PASS)
[303662@main-304172@main] UNKNOWN
304173@main NOERROR
[304174@main-304186@main] UNKNOWN
304187@main NOERROR
[304188@main-304400@main] UNKNOWN
304401@main CRASH (Expected: PASS)
Claudio Saavedra
Gardened in https://commits.webkit.org/304427@main
Claudio Saavedra
Also
fast/mediastream/RTCPeerConnection-onnegotiationneeded.html
fast/mediastream/RTCPeerConnection-setLocalDescription-offer.html
are crashing with the same stacktrace. I might garden them later when I have a moment.
Philippe Normand
(In reply to Claudio Saavedra from comment #3)
> Also
>
> fast/mediastream/RTCPeerConnection-onnegotiationneeded.html
> fast/mediastream/RTCPeerConnection-setLocalDescription-offer.html
>
> are crashing with the same stacktrace. I might garden them later when I have
> a moment.
I think this is a dupe of bug 304065 fwiw.
Philippe Normand
*** This bug has been marked as a duplicate of bug 304065 ***