Bug 304837

Summary: [GStreamer] imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-removetrack.https.html is crashing
Product: WebKit Reporter: Fujii Hironori <fujii.hironori>
Component: PlatformAssignee: Philippe Normand <philn>
Status: RESOLVED FIXED    
Severity: Normal CC: philn, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Fujii Hironori
Reported 2026-01-01 19:54:30 PST
[GStreamer] imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-removetrack.https.html is crashing 305039@main https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/305039@main%20(17793)/imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-removetrack.https-crash-log.txt Thread 1 (Thread 0x7fd98e548ec0 (LWP 1216701)): #0 0x00007fd9aaef9162 in WTF::StringImpl::rawHash (this=0x0) at WTF/Headers/wtf/text/StringImpl.h:355 #1 0x00007fd9aaef9186 in WTF::StringImpl::hasHash (this=0x0) at WTF/Headers/wtf/text/StringImpl.h:358 #2 0x00007fd9aaef91aa in WTF::StringImpl::hash (this=0x0) at WTF/Headers/wtf/text/StringImpl.h:361 #3 0x00007fd9aaef9411 in WTF::StringHash::hash (key=...) at WTF/Headers/wtf/text/StringHash.h:102 #4 0x00007fd9b486e6d4 in WTF::IdentityHashTranslator<WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::DefaultHash<WTF::String> >::hash<WTF::String> (key=...) at WTF/Headers/wtf/HashTable.h:308 #5 0x00007fd9b486df49 in WTF::HashTable<WTF::String, WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > > >, WTF::DefaultHash<WTF::String>, WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::HashTraits<WTF::String>, WTF::FastMalloc>::inlineLookup<WTF::IdentityHashTranslator<WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::DefaultHash<WTF::String> >, (WTF::ShouldValidateKey)1, WTF::String> (this=0x55e962363218, key=...) at WTF/Headers/wtf/HashTable.h:675 #6 0x00007fd9b486abd5 in WTF::HashTable<WTF::String, WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > > >, WTF::DefaultHash<WTF::String>, WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::HashTraits<WTF::String>, WTF::FastMalloc>::lookup<WTF::IdentityHashTranslator<WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::DefaultHash<WTF::String> >, (WTF::ShouldValidateKey)1, WTF::String> (this=0x55e962363218, key=...) at WTF/Headers/wtf/HashTable.h:661 #7 0x00007fd9b4866d85 in WTF::HashTable<WTF::String, WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > > >, WTF::DefaultHash<WTF::String>, WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::HashTraits<WTF::String>, WTF::FastMalloc>::find<WTF::IdentityHashTranslator<WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::DefaultHash<WTF::String> >, (WTF::ShouldValidateKey)1, WTF::String> (this=0x55e962363218, key=...) at WTF/Headers/wtf/HashTable.h:1011 #8 0x00007fd9b48615a6 in WTF::HashTable<WTF::String, WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > > >, WTF::DefaultHash<WTF::String>, WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::KeyValuePairTraits, WTF::HashTraits<WTF::String>, WTF::FastMalloc>::find<(WTF::ShouldValidateKey)1> (this=0x55e962363218, key=...) at WTF/Headers/wtf/HashTable.h:496 #9 0x00007fd9b485bf58 in WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::find (this=0x55e962363218, key=...) at WTF/Headers/wtf/HashMap.h:366 #10 0x00007fd9b4856572 in WTF::HashMap<WTF::String, WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> >, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::RefPtr<InternalSource, WTF::RawPtrTraits<InternalSource>, WTF::DefaultRefDerefTraits<InternalSource> > >, WTF::HashTableTraits, (WTF::ShouldValidateKey)1, WTF::FastMalloc>::take (this=0x55e962363218, key=...) at WTF/Headers/wtf/HashMap.h:582 #11 0x00007fd9b484c434 in WebKitMediaStreamObserver::didRemoveTrack (this=0x7fd9846d9410, track=...) at ../../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:982 #12 0x00007fd9b47b7b05 in operator()<WebCore::MediaStreamPrivateObserver> (__closure=0x7fd9849aca88, observer=...) at ../../../Source/WebCore/platform/mediastream/MediaStreamPrivate.cpp:178 #13 0x00007fd9b47b7b3c in WTF::Detail::CallableWrapper<WebCore::MediaStreamPrivate::removeTrack(WebCore::MediaStreamTrackPrivate&)::<lambda(auto:264&)>, void, WebCore::MediaStreamPrivateObserver&>::call(WebCore::MediaStreamPrivateObserver &) (this=0x7fd9849aca80, in#0=...) at WTF/Headers/wtf/Function.h:59 #14 0x00007fd9b478f531 in WTF::Function<void (WebCore::MediaStreamPrivateObserver&)>::operator()(WebCore::MediaStreamPrivateObserver&) const (this=0x7ffcc5746030, in#0=...) at WTF/Headers/wtf/Function.h:103 #15 0x00007fd9b4788ea8 in WTF::WeakHashSet<WebCore::MediaStreamPrivateObserver, WTF::DefaultWeakPtrImpl>::forEach(WTF::Function<void (WebCore::MediaStreamPrivateObserver&)> const&) (this=0x7fd9845489c8, callback=...) at WTF/Headers/wtf/WeakHashSet.h:197 #16 0x00007fd9b477f0ba in WebCore::MediaStreamPrivate::forEachObserver(WTF::Function<void (WebCore::MediaStreamPrivateObserver&)> const&) (this=0x7fd9845489a0, apply=...) at ../../../Source/WebCore/platform/mediastream/MediaStreamPrivate.cpp:108 #17 0x00007fd9b477f86b in WebCore::MediaStreamPrivate::removeTrack (this=0x7fd9845489a0, track=...) at ../../../Source/WebCore/platform/mediastream/MediaStreamPrivate.cpp:177 #18 0x00007fd9b0edc096 in WebCore::MediaStream::removeTrack (this=0x7fd9845195e0, track=...) at ../../../Source/WebCore/Modules/mediastream/MediaStream.cpp:158 #19 0x00007fd9af556869 in operator() (__closure=0x7ffcc5746190) at WebCore/DerivedSources/JSMediaStream.cpp:483 #20 0x00007fd9af5609f0 in WebCore::toJS<WebCore::IDLUndefined, WebCore::jsMediaStreamPrototypeFunction_removeTrackBody(JSC::JSGlobalObject*, JSC::CallFrame*, IDLOperation<JSMediaStream>::ClassParameter)::<lambda()> >(JSC::JSGlobalObject &, JSC::ThrowScope &, struct {...} &&) (lexicalGlobalObject=..., throwScope=..., valueOrFunctor=...) at WebCore/PrivateHeaders/WebCore/JSDOMConvertBase.h:190 #21 0x00007fd9af556a3b in WebCore::jsMediaStreamPrototypeFunction_removeTrackBody (lexicalGlobalObject=0x7fd982150088, callFrame=0x7ffcc57462f0, castedThis=0x7fd982c242c0) at WebCore/DerivedSources/JSMediaStream.cpp:483 #22 0x00007fd9af560ca1 in WebCore::IDLOperation<WebCore::JSMediaStream>::call<WebCore::jsMediaStreamPrototypeFunction_removeTrackBody> (lexicalGlobalObject=..., callFrame=..., operationName=0x7fd9a0f217f1 "removeTrack") at WebCore/PrivateHeaders/WebCore/JSDOMOperation.h:63 #23 0x00007fd9af556aac in WebCore::jsMediaStreamPrototypeFunction_removeTrack (lexicalGlobalObject=0x7fd982150088, callFrame=0x7ffcc57462f0) at WebCore/DerivedSources/JSMediaStream.cpp:488 #24 0x00007fd941a0c038 in ??? () #25 0x00007ffcc5746370 in ??? () #26 0x00007fd99875091b in llint_op_call_ignore_result () at /sdk/webkit/WebKitBuild/GTK/Debug/lib/libjavascriptcoregtk-6.0.so.1 #27 0x0000000000000000 in ??? () History: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fmediacapture-streams%2FMediaStream-removetrack.https.html&platform=GTK&platform=WPE
Attachments
Add attachment proposed patch, testcase, etc.
Fujii Hironori
Comment 1 2026-01-01 19:56:30 PST
In WebKitMediaStreamObserver::didRemoveTrack, sourceId can be a null string. > auto source = priv->sources.take(sourceId); https://github.com/WebKit/WebKit/blob/283c780414b7c24e4a911c823af665f53a15e8f7/Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp#L982
Fujii Hironori
Comment 2 2026-01-01 20:07:05 PST
This crash can be worked around by the following patch. However, another crash occurs in WebKit::crashAfter10Seconds(). Looks like a similar backtrace with bug#263720. diff --git a/Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp b/Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp index 18fe9a363e68..d9bb65b3ef3f 100644 --- a/Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp +++ b/Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp @@ -979,6 +979,9 @@ void WebKitMediaStreamObserver::didRemoveTrack(MediaStreamTrackPrivate& track) return item->id() == track.id(); }); + if (sourceId.isNull()) + return; + auto source = priv->sources.take(sourceId); // Properly stop data flow. The source stops observing notifications from WebCore. if (!source->signalEndOfStream()) {
Philippe Normand
Comment 3 2026-01-02 01:14:07 PST
(In reply to Fujii Hironori from comment #2) > This crash can be worked around by the following patch. However, another > crash occurs in WebKit::crashAfter10Seconds(). Looks like a similar > backtrace with bug#263720. > That bt means the WebProcess is deadlocked, so all the threads need to be inspected to debug this. Anyway, I'll take a look, thanks for the report!
Philippe Normand
Comment 4 2026-01-02 08:33:15 PST
Pull request: https://github.com/WebKit/WebKit/pull/56004
EWS
Comment 5 2026-01-08 06:53:29 PST
Committed 305276@main (50d9afb8a538): <https://commits.webkit.org/305276@main> Reviewed commits have been landed. Closing PR #56004 and removing active labels.
Radar WebKit Bug Importer
Comment 6 2026-01-08 06:54:13 PST
<rdar://problem/167766317>
Note You need to log in before you can comment on or make changes to this bug.