Bug 304134

Summary:	[GTK] imported/w3c/web-platform-tests/webrtc-stats/outbound-rtp.https.html is crashing in a Skia codepath
Product:	WebKit	Reporter:	Claudio Saavedra <csaavedra>
Component:	WebKitGTK	Assignee:	Nikolas Zimmermann <zimmermann>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	aperez, bugs-noreply, cgarcia, spena, zimmermann
Priority:	P2
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Claudio Saavedra

Reported 2025-12-13 11:41:39 PST

This started relatively recently. The stacktrace below belongs to a single recent run (for 304401@main ). So the test itself might be irrelevant. 303622@main NOERROR [303623@main-303650@main] UNKNOWN 303651@main CRASH (Expected: PASS) [303652@main-303660@main] UNKNOWN 303661@main NOERROR [303662@main-303921@main] UNKNOWN 303922@main TEXT (Expected: PASS) [303923@main-303985@main] UNKNOWN 303986@main TEXT (Expected: PASS) [303987@main-304025@main] UNKNOWN 304026@main TEXT (Expected: PASS) [304027@main-304172@main] UNKNOWN 304173@main NOERROR [304174@main-304186@main] UNKNOWN 304187@main NOERROR [304188@main-304400@main] UNKNOWN 304401@main CRASH (Expected: PASS) Thread 1 (Thread 0x7fc0a27fc6c0 (LWP 1181101)): #0 sk_collection_check_bounds<int> (i=5, size=5) at ../../../Source/ThirdParty/skia/include/private/base/SkAssert.h:152 #1 0x00007fc34769875d in SkTDArray<GrGpuResource*>::operator[] (this=0x55b4e7acd1b8, index=5) at ../../../Source/ThirdParty/skia/include/private/base/SkTDArray.h:156 #2 0x00007fc347699592 in SkTDPQueue<GrGpuResource*, &GrResourceCache::CompareTimestamp, &GrResourceCache::AccessResourceIndex>::percolateUpIfNecessary (this=0x55b4e7acd1b8, index=5) at ../../../Source/ThirdParty/skia/src/base/SkTDPQueue.h:146 #3 0x00007fc347698460 in SkTDPQueue<GrGpuResource*, &GrResourceCache::CompareTimestamp, &GrResourceCache::AccessResourceIndex>::insert (this=0x55b4e7acd1b8, entry=0x55b4eb8aa8a0) at ../../../Source/ThirdParty/skia/src/base/SkTDPQueue.h:74 #4 0x00007fc347696ae6 in GrResourceCache::notifyARefCntReachedZero (this=0x55b4e7acd1a0, resource=0x55b4eb8aa8a0, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrResourceCache.cpp:350 #5 0x00007fc34766fb2c in GrResourceCache::ResourceAccess::notifyARefCntReachedZero (this=0x7fc0a27faaf8, resource=0x55b4eb8aa8a0, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrResourceCache.h:449 #6 0x00007fc34767077e in GrGpuResource::notifyARefCntIsZero (this=0x55b4eb8aa8a0, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrGpuResource.cpp:180 #7 0x00007fc347601b3a in GrIORef<GrGpuResource>::notifyWillBeZero (this=0x55b4eb8aa8a8, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrGpuResource.h:102 #8 0x00007fc3475fffb4 in GrIORef<GrGpuResource>::unref (this=0x55b4eb8aa8a8) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrGpuResource.h:65 #9 0x00007fc3476923c2 in SkSafeUnref<GrSurface> (obj=0x55b4eb8aa8a0) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:151 #10 0x00007fc347692664 in sk_sp<GrSurface>::reset (this=0x55b4ec247930, ptr=0x0) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:316 #11 0x00007fc3476a919f in sk_sp<GrSurface>::operator=(decltype(nullptr)) (this=0x55b4ec247930) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:260 #12 0x00007fc3476aac0e in GrTextureProxy::~GrTextureProxy (this=0x55b4ec2478c0, __vtt_parm=0x7fc348b6f558 <VTT for GrTextureRenderTargetProxy+24>, __in_chrg=<optimized out>) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrTextureProxy.cpp:110 #13 0x00007fc3476ac88b in GrTextureRenderTargetProxy::~GrTextureRenderTargetProxy (this=0x55b4ec247890, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrTextureRenderTargetProxy.h:44 #14 0x00007fc3476ac8f0 in GrTextureRenderTargetProxy::~GrTextureRenderTargetProxy (this=0x55b4ec247890, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/GrTextureRenderTargetProxy.h:44 #15 0x00007fc3476036b1 in SkNVRefCnt<GrSurfaceProxy>::unref (this=0x55b4ec247928) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:181 #16 0x00007fc347601aed in SkSafeUnref<GrSurfaceProxy> (obj=0x55b4ec247920) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:151 #17 0x00007fc3475fff2f in sk_sp<GrSurfaceProxy>::~sk_sp (this=0x55b4ec242010, __in_chrg=<optimized out>) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:256 #18 0x00007fc347791204 in SkImage_Ganesh::ProxyChooser::~ProxyChooser (this=0x55b4ec242008, __in_chrg=<optimized out>) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/image/SkImage_Ganesh.cpp:76 #19 0x00007fc347791f22 in SkImage_Ganesh::~SkImage_Ganesh (this=0x55b4ec241fd0, __in_chrg=<optimized out>) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/image/SkImage_Ganesh.cpp:244 #20 0x00007fc347791f4e in SkImage_Ganesh::~SkImage_Ganesh (this=0x55b4ec241fd0, __in_chrg=<optimized out>) at ../../../Source/ThirdParty/skia/src/gpu/ganesh/image/SkImage_Ganesh.cpp:244 #21 0x00007fc3472fe752 in SkRefCntBase::internal_dispose (this=0x55b4ec241fd0) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:99 #22 0x00007fc33c6a853c in SkRefCntBase::unref (this=0x55b4ec241fd0) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:78 #23 0x00007fc33c6a8e47 in SkSafeUnref<SkImage> (obj=0x55b4ec241fd0) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:151 #24 0x00007fc33c6a8a5d in sk_sp<SkImage>::~sk_sp (this=0x7fc316ba1228, __in_chrg=<optimized out>) at ../../../Source/ThirdParty/skia/include/core/SkRefCnt.h:256 #25 0x00007fc3459f2f75 in WebCore::NativeImage::~NativeImage (this=0x7fc316ba1210, __in_chrg=<optimized out>) at ../../../Source/WebCore/platform/graphics/NativeImage.cpp:63 #26 0x00007fc3459f284b in WebCore::NativeImage::operator delete (object=0x7fc316ba1210, size=80) at ../../../Source/WebCore/platform/graphics/NativeImage.h:50 #27 0x00007fc3459f2fd3 in WebCore::NativeImage::~NativeImage (this=0x7fc316ba1210, __in_chrg=<optimized out>) at ../../../Source/WebCore/platform/graphics/NativeImage.cpp:63 #28 0x00007fc33c6a909f in WTF::ThreadSafeRefCounted<WebCore::NativeImage, (WTF::DestructionThread)0>::deref (this=0x7fc316ba1218) at WTF/Headers/wtf/ThreadSafeRefCounted.h:92 #29 0x00007fc33c6a8fac in WTF::DefaultRefDerefTraits<WebCore::NativeImage>::derefIfNotNull (ptr=0x7fc316ba1210) at WTF/Headers/wtf/Ref.h:64 #30 0x00007fc33d413267 in WTF::Ref<WebCore::NativeImage, WTF::RawPtrTraits<WebCore::NativeImage>, WTF::DefaultRefDerefTraits<WebCore::NativeImage> >::~Ref (this=0x7fc316c1c528, __in_chrg=<optimized out>) at WTF/Headers/wtf/Ref.h:85 #31 0x00007fc33f78b028 in WebCore::CoordinatedPlatformLayerBufferNativeImage::~CoordinatedPlatformLayerBufferNativeImage (this=0x7fc316c1c500, __in_chrg=<optimized out>) at ../../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferNativeImage.cpp:91 #32 0x00007fc33f78b054 in WebCore::CoordinatedPlatformLayerBufferNativeImage::~CoordinatedPlatformLayerBufferNativeImage (this=0x7fc316c1c500, __in_chrg=<optimized out>) at ../../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferNativeImage.cpp:91 #33 0x00007fc33ed0d55c in std::default_delete<WebCore::CoordinatedPlatformLayerBuffer>::operator() (this=0x7fc3164ba2c0, __ptr=0x7fc316c1c500) at /usr/include/c++/13/bits/unique_ptr.h:99 #34 0x00007fc33f787488 in std::__uniq_ptr_impl<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >::reset (this=0x7fc3164ba2c0, __p=0x7fc316c1d840) at /usr/include/c++/13/bits/unique_ptr.h:211 #35 0x00007fc33f7862f2 in std::__uniq_ptr_impl<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >::operator= (this=0x7fc3164ba2c0, __u=...) at /usr/include/c++/13/bits/unique_ptr.h:191 #36 0x00007fc33f78182b in std::__uniq_ptr_data<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer>, true, true>::operator= (this=0x7fc3164ba2c0) at /usr/include/c++/13/bits/unique_ptr.h:243 #37 0x00007fc33f781859 in std::unique_ptr<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >::operator= (this=0x7fc3164ba2c0) at /usr/include/c++/13/bits/unique_ptr.h:414 #38 0x00007fc33f7857e2 in WebCore::CoordinatedPlatformLayer::flushCompositingState (this=0x7fc3164ba070, reasons=..., textureMapper=...) at ../../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:1082 #39 0x00007fc33f39aa61 in WebKit::ThreadedCompositor::flushCompositingState (this=0x7fc31605c4a0, reasons=...) at ../../../Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:236 #40 0x00007fc33f39bc15 in WebKit::ThreadedCompositor::renderLayerTree (this=0x7fc31605c4a0) at ../../../Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:371 #41 0x00007fc33f3a2c3f in WTF::RunLoop::Timer::Timer<WebKit::ThreadedCompositor>(WTF::Ref<WTF::RunLoop, WTF::RawPtrTraits<WTF::RunLoop>, WTF::DefaultRefDerefTraits<WTF::RunLoop> >&&, WTF::ASCIILiteral, WebKit::ThreadedCompositor*, void (WebKit::ThreadedCompositor::*)())::{lambda()#1}::operator()() const (__closure=0x7fc3160d63d8) at WTF/Headers/wtf/RunLoop.h:210 #42 0x00007fc33f3be754 in WTF::Detail::CallableWrapper<WTF::RunLoop::Timer::Timer<WebKit::ThreadedCompositor>(WTF::Ref<WTF::RunLoop, WTF::RawPtrTraits<WTF::RunLoop>, WTF::DefaultRefDerefTraits<WTF::RunLoop> >&&, WTF::ASCIILiteral, WebKit::ThreadedCompositor*, void (WebKit::ThreadedCompositor::*)())::{lambda()#1}, void>::call() (this=0x7fc3160d63d0) at WTF/Headers/wtf/Function.h:59 #43 0x00007fc33c6b1aeb in WTF::Function<void ()>::operator()() const (this=0x7fc31605c550) at WTF/Headers/wtf/Function.h:103 #44 0x00007fc33d878dc4 in WTF::RunLoop::Timer::fired (this=0x7fc31605c518) at WTF/Headers/wtf/RunLoop.h:262 #45 0x00007fc32ccd1b75 in operator() (__closure=0x0, userData=0x7fc31605c518) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:252 #46 0x00007fc32ccd1bb9 in _FUN () at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:256 #47 0x00007fc32ccd07c7 in operator() (__closure=0x0, source=0x55b4eb51bff0, callback=0x7fc32ccd1b98 <_FUN(gpointer)>, userData=0x7fc31605c518) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:57 #48 0x00007fc32ccd0819 in _FUN () at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:60 #49 0x00007fc32714349e in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #50 0x00007fc327143710 in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #51 0x00007fc32ccd112f in WTF::RunLoop::runGLibMainLoopIteration (this=0x7fc316118110, mayBlock=WTF::RunLoop::MayBlock::Yes) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:118 #52 0x00007fc32ccd119e in WTF::RunLoop::runGLibMainLoop (this=0x7fc316118110) at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:127 #53 0x00007fc32ccd1266 in WTF::RunLoop::run () at ../../../Source/WTF/wtf/glib/RunLoopGLib.cpp:140 #54 0x00007fc32cae0f6e in operator() (__closure=0x7fc316102bc8) at ../../../Source/WTF/wtf/RunLoop.cpp:111 #55 0x00007fc32cae65e2 in WTF::Detail::CallableWrapper<WTF::RunLoop::create(WTF::ASCIILiteral, WTF::ThreadType, WTF::Thread::QOS)::<lambda()>, void>::call(void) (this=0x7fc316102bc0) at ../../../Source/WTF/wtf/Function.h:59 #56 0x00007fc32af161dd in WTF::Function<void ()>::operator()() const (this=0x7fc0a27fb6f8) at WTF/Headers/wtf/Function.h:103 #57 0x00007fc32cc00b53 in WTF::Thread::entryPoint (newThreadContext=0x7fc316038960) at ../../../Source/WTF/wtf/Threading.cpp:260 #58 0x00007fc32cce5909 in WTF::wtfThreadEntryPoint (context=0x7fc316038960) at ../../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:245 #59 0x00007fc32e48aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447 #60 0x00007fc32e517c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Attachments
Add attachment proposed patch, testcase, etc.

Claudio Saavedra

Comment 1 2025-12-13 11:42:19 PST

https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304401@main%20(17729)/imported/w3c/web-platform-tests/webrtc-stats/outbound-rtp.https-crash-log.txt

Claudio Saavedra

Comment 2 2025-12-13 11:49:42 PST

Gardened in https://commits.webkit.org/304427@main

Nikolas Zimmermann

Comment 3 2025-12-18 06:31:00 PST

*** Bug 286481 has been marked as a duplicate of this bug. ***

Nikolas Zimmermann

Comment 4 2025-12-18 06:40:56 PST

Pull request: https://github.com/WebKit/WebKit/pull/55628

EWS

Comment 5 2025-12-23 07:50:01 PST

Committed 304897@main (02d6be0a697d): <https://commits.webkit.org/304897@main> Reviewed commits have been landed. Closing PR #55628 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.