Bug 308925 – [GStreamer][1.28] media/media-source/media-source-paint-after-display-none.html crashes

• Component: Platform
• Status: RESOLVED FIXED

[Philippe Normand]

In MediaPlayerPrivateGStreamer::flushCurrentBuffer() the buffer deep copy fails, we end-up with a sample with null buffer.

(gdb) bt
#0  0x00007f21624f6ef5 in WTF::adoptRef<WebCore::VideoFrameGStreamer, WTF::RawPtrTraits<WebCore::VideoFrameGStreamer>, WTF::DefaultRefDerefTraits<WebCore::VideoFrameGStreamer> > (reference=...)
    at WTF/Headers/wtf/Ref.h:355
#1  0x00007f21624f59e5 in WebCore::VideoFrameGStreamer::create (sample=..., options=..., colorSpace=...) at /var/home/phil/WebKit/Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:373
#2  0x00007f21624bc465 in WebCore::MediaPlayerPrivateGStreamer::paint (this=0x7f2137006000, context=..., rect=...)
    at /var/home/phil/WebKit/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:4196
#3  0x00007f2162239bc9 in WebCore::MediaPlayerPrivateInterface::setShouldMaintainAspectRatio (this=0x7f2137006000) at /var/home/phil/WebKit/Source/WebCore/platform/graphics/MediaPlayerPrivate.h:243
#4  0x00007f2162232e92 in WebCore::MediaPlayer::bitmapImageForCurrentTimeSync (this=0x7f2139366980) at /var/home/phil/WebKit/Source/WebCore/platform/graphics/MediaPlayer.cpp:1256
#5  0x00007f2161184c60 in WebCore::HTMLVideoElement::bitmapImageForCurrentTimeSync (this=0x7f2139366980) at /var/home/phil/WebKit/Source/WebCore/html/HTMLVideoElement.cpp:421
#6  0x00007f21612473b7 in WebCore::CanvasRenderingContext::checkOrigin<WebCore::HTMLVideoElement> (this=0x7fff1b78e2f0, arg=0x7f213935fb80)
    at /var/home/phil/WebKit/Source/WebCore/html/canvas/CanvasRenderingContext.h:164
...
(gdb) f 1
#1  0x00007f21624f59e5 in WebCore::VideoFrameGStreamer::create (sample=..., options=..., colorSpace=...) at /var/home/phil/WebKit/Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:373
373         return adoptRef(*new VideoFrameGStreamer(WTF::move(sample), newOptions, WTF::move(colorSpace)));
(gdb) p buffer
$1 = 0x0

[Philippe Normand]

Pull request: https://github.com/WebKit/WebKit/pull/59672

[EWS]

Committed 308455@main (60638d927b62): <https://commits.webkit.org/308455@main>

Reviewed commits have been landed. Closing PR #59672 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/171525348>