Bug 106551 - [gstreamer] Some media tests occasionally crash with gstreamer 1.0 backend
Summary: [gstreamer] Some media tests occasionally crash with gstreamer 1.0 backend
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: Platform (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL: https://bugzilla.gnome.org/show_bug.c...
Keywords:
: 104809 (view as bug list)
Depends on: 107025 107374 107544
Blocks:
  Show dependency treegraph
 
Reported: 2013-01-10 04:23 PST by Dominik Röttsches (drott)
Modified: 2018-02-09 10:04 PST (History)
13 users (show)

See Also:


Attachments
Patch (6.47 KB, patch)
2013-01-16 05:16 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (6.73 KB, patch)
2013-01-16 06:52 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Backtrace with symbols for all threads (17.66 KB, text/plain)
2013-01-20 09:38 PST, Chris Dumez
no flags Details
Full valgrind log including backtrace for all threads (149.13 KB, text/x-log)
2013-01-20 10:58 PST, Chris Dumez
no flags Details
gdb backtrace (19.04 KB, text/plain)
2013-01-22 07:36 PST, Jussi Kukkonen (jku)
no flags Details
full backtrace of the crashing thread (25.30 KB, text/plain)
2013-01-22 07:42 PST, Jussi Kukkonen (jku)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dominik Röttsches (drott) 2013-01-10 04:23:36 PST
media/video-src-source.html
media/video-source-moved.html
media/video-source.html

Are flaky crashers on the EFL bot.
Either with glibc detecting a corrupted doubly linked list or the following stack trace:

crash log for WebProcess (pid <unknown>):
STDOUT: <empty>
STDERR: 1   0x7f10baeda21f
STDERR: 2   0x7f10bd9394a0
STDERR: 3   0x7f10b0c4a61c gst_memory_unmap
STDERR: 4   0x7f10b0c2614a gst_buffer_unmap
STDERR: 5   0x7f10b0343536 gst_video_frame_unmap
STDERR: 6   0x7f1050f2c4e9
STDERR: 7   0x7f1051255b35
STDERR: 8   0x7f1050ef7dd2
STDERR: 9   0x7f1050f08e46
STDERR: 10  0x7f1050f1a6c0
STDERR: 11  0x7f1050f2e4f3
STDERR: 12  0x7f1050f2e5e8
STDERR: 13  0x7f10b034dd42
STDERR: 14  0x7f10b0c3abec gst_element_change_state
STDERR: 15  0x7f10b0c3b56f
STDERR: 16  0x7f10b0c23231
STDERR: 17  0x7f10619a6ad3
STDERR: 18  0x7f10b0c3abec gst_element_change_state
STDERR: 19  0x7f10b0c3b56f
STDERR: 20  0x7f10b0c23231
STDERR: 21  0x7f10619ae50c
STDERR: 22  0x7f10b0c3abec gst_element_change_state
STDERR: 23  0x7f10b0c3b56f
STDERR: 24  0x7f10b0c23231
STDERR: 25  0x7f10b0c58fc4
STDERR: 26  0x7f10619b5a50
STDERR: 27  0x7f10b0c3abec gst_element_change_state
STDERR: 28  0x7f10b0c3b56f
STDERR: 29  0x7f10baddd020 WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
STDERR: 30  0x7f10baddd16e WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
STDERR: 31  0x7f10ba360540 void WTF::deleteOwnedPtr<WebCore::MediaPlayerPrivateInterface>(WebCore::MediaPlayerPrivateInterface*)
STDERR: LEAK: 1 WebPage
STDERR: LEAK: 1 WebFrame
STDERR: LEAK: 35 RenderObject
STDERR: LEAK: 1 Page
STDERR: LEAK: 1 Frame
STDERR: LEAK: 6 CachedResource
STDERR: LEAK: 103 WebCoreNode
Comment 1 Chris Dumez 2013-01-10 04:31:00 PST
https://bugs.webkit.org/show_bug.cgi?id=104809 is related I believe.
Comment 2 Philippe Normand 2013-01-10 04:33:50 PST
GTK uses gst 1.0.4 and doesn't have these issues I think. CCing Xabier so he can check.
Comment 3 Philippe Normand 2013-01-10 04:34:33 PST
Also would you have a more detailed stack trace please?
Comment 4 Chris Dumez 2013-01-10 04:36:49 PST
(In reply to comment #2)
> GTK uses gst 1.0.4 and doesn't have these issues I think. CCing Xabier so he can check.

I tried using 1.0.4 as well but it did not help so I kept 1.0.5.
Comment 5 Chris Dumez 2013-01-10 05:38:24 PST
I have just double-checked, I can reproduce the exact same crash with gstreamer 1.0.4 and media/video-src-blob.html test case.
Comment 6 Chris Dumez 2013-01-11 04:42:45 PST
Here is another backtrace I got with media/video-source-moved.html:
crash log for WebProcess (pid <unknown>):
STDOUT: <empty>
STDERR:
STDERR: (WebProcess:8859): GStreamer-CRITICAL **: gst_poll_get_read_gpollfd: assertion `set != NULL' failed
STDERR:
STDERR: (WebProcess:8859): GStreamer-CRITICAL **: gst_bus_create_watch: assertion `bus->priv->poll != NULL' failed
STDERR:
STDERR: (WebProcess:8859): GLib-CRITICAL **: g_source_set_callback: assertion `source != NULL' failed
STDERR: 1   0x7f3034833477
STDERR: 2   0x7f3036fab4a0
STDERR: 3   0x7f302ff56a46 g_source_attach
STDERR: 4   0x7f302d3f8758
STDERR: 5   0x7f302d3f927f gst_bus_add_signal_watch_full
STDERR: 6   0x7f302d3f9318 gst_bus_add_signal_watch
STDERR: 7   0x7f303473c5df WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin()
STDERR: 8   0x7f3034736506 WebCore::MediaPlayerPrivateGStreamer::load(WTF::String const&)
STDERR: 9   0x7f3033cb6d78 WebCore::MediaPlayer::loadWithNextMediaEngine(WebCore::MediaPlayerFactory*)
STDERR: 10  0x7f3033cb6a87 WebCore::MediaPlayer::load(WebCore::KURL const&, WebCore::ContentType const&, WTF::String const&)
STDERR: 11  0x7f30338127d5 WebCore::HTMLMediaElement::loadResource(WebCore::KURL const&, WebCore::ContentType&, WTF::String const&)
STDERR: 12  0x7f303381210b WebCore::HTMLMediaElement::loadNextSourceChild()
STDERR: 13  0x7f30338113f1 WebCore::HTMLMediaElement::loadTimerFired(WebCore::Timer<WebCore::HTMLMediaElement>*)
STDERR: 14  0x7f3033830342 WebCore::Timer<WebCore::HTMLMediaElement>::fired()
STDERR: 15  0x7f3033c447e6 WebCore::ThreadTimers::sharedTimerFiredInternal()
STDERR: 16  0x7f3033c44707 WebCore::ThreadTimers::sharedTimerFired()
STDERR: 17  0x7f30347200a1
STDERR: 18  0x7f30382ab46e _ecore_timer_expired_call
STDERR: 19  0x7f30382ab63b _ecore_timer_expired_timers_call
STDERR: 20  0x7f30382a8551
STDERR: 21  0x7f30382a8be7 ecore_main_loop_begin
STDERR: 22  0x7f303471e963 WebCore::RunLoop::run()
STDERR: 23  0x7f3037d752ae WebProcessMainEfl
STDERR: 24  0x4007c4 main
STDERR: 25  0x7f3036f9676d __libc_start_main
STDERR: 26  0x4006e9
STDERR: LEAK: 1 WebPage
STDERR: LEAK: 1 WebFrame
STDERR: LEAK: 124 RenderObject
STDERR: LEAK: 1 Page
STDERR: LEAK: 1 Frame
STDERR: LEAK: 95 CachedResource
STDERR: LEAK: 862 WebCoreNode
Comment 7 Chris Dumez 2013-01-12 04:30:30 PST
I have trouble reproducing the crash in gdb as it seems time sensitive. Here is a slightly better backtrace though:
[473/491] media/video-source.html passed*** glibc detected *** /home/chris/unencrypted/WebKit/WebKitBuild/Debug/bin/WebProcess: corrupted double-linked list: 0x00007f449421db60 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7eb96)[0x7f4505ebeb96]
/lib/x86_64-linux-gnu/libc.so.6(+0x7fe55)[0x7f4505ebfe55]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x59e5ac)[0x7f44938e15ac]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x210bec)[0x7f4493553bec]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x2a5484)[0x7f44935e8484]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x2a54cb)[0x7f44935e84cb]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x45b45e)[0x7f449379e45e]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x3e93b)[0x7f449338193b]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x57438)[0x7f449339a438]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x5b109)[0x7f449339e109]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstvideo-1.0.so.0(+0x25345)[0x7f44fc189345]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x30e7a)[0x7f44fc28ae7a]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x3239f)[0x7f44fc28c39f]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstplayback.so(+0x15b82)[0x7f44aee8eb82]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x30e7a)[0x7f44fc28ae7a]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x3239f)[0x7f44fc28c39f]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstplayback.so(+0x1d242)[0x7f44aee96242]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x30e7a)[0x7f44fc28ae7a]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x3239f)[0x7f44fc28c39f]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x7a0a8)[0x7f44fc2d40a8]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstplayback.so(+0x272fd)[0x7f44aeea02fd]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31]
/home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore27MediaPlayerPrivateGStreamerD1Ev+0xba)[0x7f45035d7364]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore27MediaPlayerPrivateGStreamerD0Ev+0x18)[0x7f45035d74b2]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF14deleteOwnedPtrIN7WebCore27MediaPlayerPrivateInterfaceEEEvPT_+0x2a)[0x7f4502b5a3c4]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF6OwnPtrIN7WebCore27MediaPlayerPrivateInterfaceEED1Ev+0x1b)[0x7f4502b5a17d]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11MediaPlayerD1Ev+0x80)[0x7f4502b577d6]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11MediaPlayerD0Ev+0x18)[0x7f4502b57818]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF14deleteOwnedPtrIN7WebCore11MediaPlayerEEEvPT_+0x2a)[0x7f45026c3d9b]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF6OwnPtrIN7WebCore11MediaPlayerEE5clearEv+0x2e)[0x7f45026c35bc]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore16HTMLMediaElement16clearMediaPlayerEi+0x2d)[0x7f45026bceeb]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore16HTMLMediaElement17userCancelledLoadEv+0x62)[0x7f45026bcdc8]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore16HTMLMediaElement4stopEv+0x68)[0x7f45026bcfbe]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore22ScriptExecutionContext20stopActiveDOMObjectsEv+0x12a)[0x7f4502545a3e]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore8Document6detachEv+0xea)[0x7f4502458dc2]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore8Document21prepareForDestructionEv+0x54)[0x7f4502459086]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore5Frame7setViewEN3WTF10PassRefPtrINS_9FrameViewEEE+0xd8)[0x7f4502a24180]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore5Frame10createViewERKNS_7IntSizeERKNS_5ColorEbS3_RKNS_7IntRectEbNS_13ScrollbarModeEbSA_b+0x179)[0x7f4502a2697d]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libewebkit2.so.0(_ZN6WebKit20WebFrameLoaderClient31transitionToCommittedForNewPageEv+0x2d6)[0x7f4506b82a38]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader21transitionToCommittedEN3WTF10PassRefPtrINS_10CachedPageEEE+0x5f1)[0x7f450292048b]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader21commitProvisionalLoadEv+0x3e2)[0x7f450291f896]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader13commitIfReadyEv+0x3d)[0x7f45028f9e1b]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader15finishedLoadingEv+0x18)[0x7f45028f9e36]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader14maybeLoadEmptyEv+0x315)[0x7f45028fc613]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader24startLoadingMainResourceEv+0xb3)[0x7f45028fc6e7]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader31continueLoadAfterWillSubmitFormEv+0xa4)[0x7f45029219ca]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader33continueLoadAfterNavigationPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb+0x3e3)[0x7f450292447b]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader37callContinueLoadAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb+0x4f)[0x7f4502923baf]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14PolicyCallback4callEb+0x76)[0x7f450293a61a]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore13PolicyChecker29continueAfterNavigationPolicyENS_12PolicyActionE+0x24b)[0x7f450293b581]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libewebkit2.so.0(_ZN6WebKit20WebFrameLoaderClient39dispatchDecidePolicyForNavigationActionEMN7WebCore13PolicyCheckerEFvNS1_12PolicyActionEERKNS1_16NavigationActionERKNS1_15ResourceRequestEN3WTF10PassRefPtrINS1_9FormStateEEE+0x21c)[0x7f4506b805c4]
/home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore13PolicyChecker21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S9_bESA_+0x40c)[0x7f450293af8c]
Comment 8 Chris Dumez 2013-01-12 07:20:05 PST
I managed to reproduce one gstreamer crash in gdb:

(WebProcess:15781): GStreamer-CRITICAL **: gst_buffer_pool_acquire_buffer: assertion `GST_IS_BUFFER_POOL (pool)' failed

Program received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0x7fff7ffff700 (LWP 16568)]
g_logv (log_domain=0x7fffed069f20 "GStreamer", log_level=<optimized out>, 
    format=0x7fffefbfba41 "%s: assertion `%s' failed", args1=0x7fff7fffd838)
    at gmessages.c:765
765               g_private_set (&g_log_depth, GUINT_TO_POINTER (depth));
(gdb) bt
#0  g_logv (log_domain=0x7fffed069f20 "GStreamer", log_level=<optimized out>,
    format=0x7fffefbfba41 "%s: assertion `%s' failed", args1=0x7fff7fffd838)
    at gmessages.c:765
#1  0x00007fffefb9bbd2 in g_log (log_domain=<optimized out>, 
    log_level=<optimized out>, format=<optimized out>) at gmessages.c:792
#2  0x00007fffecfd57e9 in gst_buffer_pool_acquire_buffer (pool=0x0, 
    buffer=0x7fff90036870, params=0x0) at gstbufferpool.c:1090
#3  0x00007fffecece114 in gst_video_decoder_allocate_output_frame (
    decoder=0x7fff740388d0, frame=0x7fff90036830) at gstvideodecoder.c:3112
#4  0x00007fff7e39a354 in get_output_buffer (ffmpegdec=0x7fff740388d0, 
    frame=0x7fff90036830) at gstavviddec.c:1000
#5  0x00007fff7e39b006 in gst_ffmpegviddec_video_frame (
    ffmpegdec=0x7fff740388d0, data=0x7fff8c026090 "", size=10444, 
    frame=0x7fff90036830, ret=0x7fff7fffdf8c) at gstavviddec.c:1188
#6  0x00007fff7e39b35a in gst_ffmpegviddec_frame (ffmpegdec=0x7fff740388d0, 
    data=0x7fff8c026090 "", size=10444, got_data=0x7fff7fffdf88, 
    frame=0x7fff90036830, ret=0x7fff7fffdf8c) at gstavviddec.c:1262
#7  0x00007fff7e39be51 in gst_ffmpegviddec_handle_frame (
    decoder=0x7fff740388d0, frame=0x7fff90036830) at gstavviddec.c:1379
#8  0x00007fffececd10b in gst_video_decoder_decode_frame (
    decoder=0x7fff740388d0, frame=0x7fff90036830) at gstvideodecoder.c:2665
#9  0x00007fffecec60d1 in gst_video_decoder_chain_forward (
    decoder=0x7fff740388d0, buf=0x7fff90027e60, at_eos=0)
---Type <return> to continue, or q <return> to quit---
    at gstvideodecoder.c:1697
#10 0x00007fffecec80f8 in gst_video_decoder_chain (pad=0x7fff8c01edb0, 
    parent=0x7fff740388d0, buf=0x7fff90027e60) at gstvideodecoder.c:1957
#11 0x00007fffed00bbd6 in gst_pad_chain_data_unchecked (pad=0x7fff8c01edb0, 
    type=4112, data=0x7fff90027e60) at gstpad.c:3654
#12 0x00007fffed00c693 in gst_pad_push_data (pad=0x7fff8c01e2c0, type=4112, 
    data=0x7fff90027e60) at gstpad.c:3871
#13 0x00007fffed00cbe8 in gst_pad_push (pad=0x7fff8c01e2c0, 
    buffer=0x7fff90027e60) at gstpad.c:3974
#14 0x00007fffecf74136 in gst_base_transform_chain (pad=0x7fff8c01e090, 
    parent=0x7fff8c024020, buffer=0x7fff90027e60) at gstbasetransform.c:2203
#15 0x00007fffed00bbd6 in gst_pad_chain_data_unchecked (pad=0x7fff8c01e090, 
    type=4112, data=0x7fff90027e60) at gstpad.c:3654
#16 0x00007fffed00c693 in gst_pad_push_data (pad=0x7fff84011d00, type=4112, 
    data=0x7fff90027e60) at gstpad.c:3871
#17 0x00007fffed00cbe8 in gst_pad_push (pad=0x7fff84011d00, 
    buffer=0x7fff90027e60) at gstpad.c:3974
#18 0x00007fffecf47c24 in gst_base_parse_push_frame (parse=0x7fff8c01c000, 
    frame=0x7fff7fffe800) at gstbaseparse.c:2146
#19 0x00007fffecf4a313 in gst_base_parse_chain (pad=0x7fff84011ad0, 
    parent=0x7fff8c01c000, buffer=0x7fff90027e60) at gstbaseparse.c:2623
#20 0x00007fffed00bbd6 in gst_pad_chain_data_unchecked (pad=0x7fff84011ad0, 
    type=4112, data=0x7fff90027e60) at gstpad.c:3654
---Type <return> to continue, or q <return> to quit---
#21 0x00007fffed00c693 in gst_pad_push_data (pad=0x7fff8c00fd40, type=4112, 
    data=0x7fff90027e60) at gstpad.c:3871
#22 0x00007fffed00cbe8 in gst_pad_push (pad=0x7fff8c00fd40, 
    buffer=0x7fff90027e60) at gstpad.c:3974
#23 0x00007fff97738a58 in gst_single_queue_push_one (mq=0x7fff8c010090, 
    sq=0x7fff8c018d10, object=0x7fff90027e60) at gstmultiqueue.c:1057
#24 0x00007fff9773999a in gst_multi_queue_loop (pad=0x7fff8c00fd40)
    at gstmultiqueue.c:1303
#25 0x00007fffed03ecaf in gst_task_func (task=0x7fff88005240) at gsttask.c:316
#26 0x00007fffed03fdab in default_func (tdata=0x7945b0, pool=0x615020)
    at gsttaskpool.c:70
#27 0x00007fffefbb7438 in g_thread_pool_thread_proxy (data=<optimized out>)
    at gthreadpool.c:309
#28 0x00007fffefbb6bd5 in g_thread_proxy (data=0x7fff8c002800) at gthread.c:801
#29 0x00007fffec3e5e9a in start_thread (arg=0x7fff7ffff700)
    at pthread_create.c:308
#30 0x00007ffff6c73cbd in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#31 0x0000000000000000 in ?? ()
Comment 9 Chris Dumez 2013-01-12 07:25:21 PST
Another one:

** (WebProcess:16613): CRITICAL **: file gstaudioringbuffer.c: line 1939 (gst_audio_ring_buffer_set_channel_positions): should not be reached

Program received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0x7fff96ec2700 (LWP 16812)]
g_logv (log_domain=0x0, log_level=<optimized out>, 
    format=0x7fffeca81f98 "file %s: line %d (%s): should not be reached", 
    args1=0x7fff96ebfa58) at gmessages.c:765
765               g_private_set (&g_log_depth, GUINT_TO_POINTER (depth));
(gdb) bt
#0  g_logv (log_domain=0x0, log_level=<optimized out>, 
    format=0x7fffeca81f98 "file %s: line %d (%s): should not be reached", 
    args1=0x7fff96ebfa58) at gmessages.c:765
#1  0x00007fffefb9bbd2 in g_log (log_domain=<optimized out>, 
    log_level=<optimized out>, format=<optimized out>) at gmessages.c:792
#2  0x00007fffeca4ee59 in gst_audio_ring_buffer_set_channel_positions (
    buf=0x7fff8804e800, position=0x7fff957ddce0) at gstaudioringbuffer.c:1939
#3  0x00007fff957d3d6c in alsasink_parse_spec (alsa=0x7fff900b6410, 
    spec=0x7fff8804e888) at gstalsasink.c:807
#4  0x00007fff957d41e4 in gst_alsasink_prepare (asink=0x7fff900b6410, 
    spec=0x7fff8804e888) at gstalsasink.c:869
#5  0x00007fffeca78193 in gst_audio_sink_ring_buffer_acquire (
    buf=0x7fff8804e800, spec=0x7fff8804e888) at gstaudiosink.c:404
#6  0x00007fffeca4a5e8 in gst_audio_ring_buffer_acquire (buf=0x7fff8804e800, 
    spec=0x7fff8804e888) at gstaudioringbuffer.c:542
#7  0x00007fffeca6bd01 in gst_audio_base_sink_setcaps (bsink=0x7fff900b6410, 
    caps=0x6de400) at gstaudiobasesink.c:883
#8  0x00007fffecf5c543 in gst_base_sink_default_event (
    basesink=0x7fff900b6410, event=0x7fff9005a9e0) at gstbasesink.c:2912
#9  0x00007fffeca6c7e1 in gst_audio_base_sink_event (bsink=0x7fff900b6410, 
    event=0x7fff9005a9e0) at gstaudiobasesink.c:1085
#10 0x00007fffecf5c89c in gst_base_sink_event (pad=0x7fff780066d0, 
    parent=0x7fff900b6410, event=0x7fff9005a9e0) at gstbasesink.c:3014
#11 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff780066d0, 
    event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4821
#12 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x8cafc0, 
    event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#13 0x00007fffed00a571 in push_sticky (pad=0x8cafc0, ev=0x7fff96ec00b0, 
    user_data=0x7fff96ec0110) at gstpad.c:3285
#14 0x00007fffed0028c4 in events_foreach (pad=0x8cafc0, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0110)
    at gstpad.c:514
#15 0x00007fffed00a862 in check_sticky (pad=0x8cafc0) at gstpad.c:3333
#16 0x00007fffed00e95b in gst_pad_push_event (pad=0x8cafc0, 
    event=0x7fff9005a9e0) at gstpad.c:4635
#17 0x00007fffed008ed2 in event_forward_func (pad=0x8cafc0, 
    data=0x7fff96ec02b0) at gstpad.c:2719
#18 0x00007fffed008ccb in gst_pad_forward (pad=0x91d140, 
    forward=0x7fffed008d9a <event_forward_func>, user_data=0x7fff96ec02b0)
    at gstpad.c:2673
#19 0x00007fffed009084 in gst_pad_event_default (pad=0x91d140, 
    parent=0x7fff60009380, event=0x7fff9005a9e0) at gstpad.c:2770
#20 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x91d140, 
    event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM
    at gstpad.c:4821
#21 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x91c560, 
    event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#22 0x00007fffed00a571 in push_sticky (pad=0x91c560, ev=0x7fff96ec04c0, 
    user_data=0x7fff96ec0520) at gstpad.c:3285
#23 0x00007fffed0028c4 in events_foreach (pad=0x91c560, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0520)
    at gstpad.c:514
#24 0x00007fffed00a862 in check_sticky (pad=0x91c560) at gstpad.c:3333
#25 0x00007fffed00e95b in gst_pad_push_event (pad=0x91c560, 
    event=0x7fff9005a9e0) at gstpad.c:4635
#26 0x00007fffed008ed2 in event_forward_func (pad=0x91c560, 
    data=0x7fff96ec06c0) at gstpad.c:2719
#27 0x00007fffed008ccb in gst_pad_forward (pad=0x7fff700078e0, 
    forward=0x7fffed008d9a <event_forward_func>, user_data=0x7fff96ec06c0)
    at gstpad.c:2673
#28 0x00007fffed009084 in gst_pad_event_default (pad=0x7fff700078e0, 
    parent=0x91c560, event=0x7fff9005a9e0) at gstpad.c:2770
#29 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff700078e0, 
    event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4821
#30 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff6c014470,
    event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#31 0x00007fffed00a571 in push_sticky (pad=0x7fff6c014470, ev=0x7fff96ec08d0, 
    user_data=0x7fff96ec0930) at gstpad.c:3285
#32 0x00007fffed0028c4 in events_foreach (pad=0x7fff6c014470, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0930)
    at gstpad.c:514
#33 0x00007fffed00a862 in check_sticky (pad=0x7fff6c014470) at gstpad.c:3333
#34 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff6c014470, 
    event=0x7fff9005a9e0) at gstpad.c:4635
#35 0x00007fffecf6e558 in gst_pad_set_caps (pad=0x7fff6c014470, caps=0x6de400)
    at ../../../gst/gstcompat.h:71
#36 0x00007fffecf71487 in gst_base_transform_setcaps (trans=0x7fff900bdca0, 
    pad=0x7fff6c015a50, incaps=0x6de400) at gstbasetransform.c:1326
#37 0x00007fffecf72ca1 in gst_base_transform_sink_eventfunc (
    trans=0x7fff900bdca0, event=0x7fff9005a8c0) at gstbasetransform.c:1826
#38 0x00007fffecf72b2d in gst_base_transform_sink_event (pad=0x7fff6c015a50, 
    parent=0x7fff900bdca0, event=0x7fff9005a8c0) at gstbasetransform.c:1785
#39 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff6c015a50, 
    event=0x7fff9005a8c0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4821
#40 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff78006d60, 
    event=0x7fff9005a8c0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#41 0x00007fffed00a571 in push_sticky (pad=0x7fff78006d60, ev=0x7fff96ec0cd0, 
    user_data=0x7fff96ec0d30) at gstpad.c:3285
#42 0x00007fffed0028c4 in events_foreach (pad=0x7fff78006d60, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0d30)
    at gstpad.c:514
#43 0x00007fffed00a862 in check_sticky (pad=0x7fff78006d60) at gstpad.c:3333
#44 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff78006d60, 
    event=0x7fff9005a8c0) at gstpad.c:4635
#45 0x00007fffecf6e558 in gst_pad_set_caps (pad=0x7fff78006d60, caps=0x6de400)
    at ../../../gst/gstcompat.h:71
#46 0x00007fffecf71487 in gst_base_transform_setcaps (trans=0x7fff900bee60, 
    pad=0x7fff60015440, incaps=0x6de400) at gstbasetransform.c:1326
#47 0x00007fffecf72ca1 in gst_base_transform_sink_eventfunc (
    trans=0x7fff900bee60, event=0x7fff9005a800) at gstbasetransform.c:1826
#48 0x00007fff94a70222 in gst_audio_resample_sink_event (base=0x7fff900bee60, 
    event=0x7fff9005a800) at gstaudioresample.c:917
#49 0x00007fffecf72b2d in gst_base_transform_sink_event (pad=0x7fff60015440, 
    parent=0x7fff900bee60, event=0x7fff9005a800) at gstbasetransform.c:1785
#50 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff60015440, 
    event=0x7fff9005a800, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4821
#51 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff60015210,
    event=0x7fff9005a800, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#52 0x00007fffed00a571 in push_sticky (pad=0x7fff60015210, ev=0x7fff96ec1100, 
    user_data=0x7fff96ec1160) at gstpad.c:3285
#53 0x00007fffed0028c4 in events_foreach (pad=0x7fff60015210, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec1160)
    at gstpad.c:514
#54 0x00007fffed00a862 in check_sticky (pad=0x7fff60015210) at gstpad.c:3333
#55 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff60015210, 
    event=0x7fff9005a800) at gstpad.c:4635
#56 0x00007fffecf6e558 in gst_pad_set_caps (pad=0x7fff60015210, caps=0x6de400)
    at ../../../gst/gstcompat.h:71
#57 0x00007fffecf71487 in gst_base_transform_setcaps (trans=0x7fff900be620, 
    pad=0x7fff6c014b00, incaps=0x7fff60002a30) at gstbasetransform.c:1326
#58 0x00007fffecf72ca1 in gst_base_transform_sink_eventfunc (
    trans=0x7fff900be620, event=0x7fff44002cc0) at gstbasetransform.c:1826
#59 0x00007fffecf72b2d in gst_base_transform_sink_event (pad=0x7fff6c014b00, 
    parent=0x7fff900be620, event=0x7fff44002cc0) at gstbasetransform.c:1785
#60 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff6c014b00, 
    event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4821
#61 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff700076a0, 
    event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#62 0x00007fffed00a571 in push_sticky (pad=0x7fff700076a0, ev=0x7fff96ec1500, 
    user_data=0x7fff96ec1560) at gstpad.c:3285
#63 0x00007fffed0028c4 in events_foreach (pad=0x7fff700076a0, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec1560)
    at gstpad.c:514
#64 0x00007fffed00a862 in check_sticky (pad=0x7fff700076a0) at gstpad.c:3333
#65 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff700076a0, 
    event=0x7fff44002cc0) at gstpad.c:4635
#66 0x00007fffed008ed2 in event_forward_func (pad=0x7fff700076a0, 
    data=0x7fff96ec1700) at gstpad.c:2719
#67 0x00007fffed008ccb in gst_pad_forward (pad=0x91c7c0, 
    forward=0x7fffed008d9a <event_forward_func>, user_data=0x7fff96ec1700)
    at gstpad.c:2673
#68 0x00007fffed009084 in gst_pad_event_default (pad=0x91c7c0, 
    parent=0x7fff88079380, event=0x7fff44002cc0) at gstpad.c:2770
#69 0x00007fff9738448b in gst_play_sink_convert_bin_sink_event (pad=0x91c7c0, 
    parent=0x7fff88079380, event=0x7fff44002cc0) at gstplaysinkconvertbin.c:274
#70 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x91c7c0, 
    event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4821
#71 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff780064a0, 
    event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM)
    at gstpad.c:4514
#72 0x00007fffed00a571 in push_sticky (pad=0x7fff780064a0, ev=0x7fff96ec19e0, 
    user_data=0x7fff96ec1a40) at gstpad.c:3285
#73 0x00007fffed0028c4 in events_foreach (pad=0x7fff780064a0, 
    func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec1a40)
    at gstpad.c:514
#74 0x00007fffed00a862 in check_sticky (pad=0x7fff780064a0) at gstpad.c:3333
#75 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff780064a0, 
    event=0x7fff44002cc0) at gstpad.c:4635
#76 0x00007fff9731722f in gst_queue_push_one (queue=0x7fff88073720)
    at gstqueue.c:1096
#77 0x00007fff97317b82 in gst_queue_loop (pad=0x7fff780064a0)
    at gstqueue.c:1161
#78 0x00007fffed03ecaf in gst_task_func (task=0x7fff88099360) at gsttask.c:316
#79 0x00007fffed03fdab in default_func (tdata=0x7fff5c002490, pool=0x640830)
    at gsttaskpool.c:70
#80 0x00007fffefbb7438 in g_thread_pool_thread_proxy (data=<optimized out>)
    at gthreadpool.c:309
#81 0x00007fffefbb6bd5 in g_thread_proxy (data=0x7fff4c002590) at gthread.c:801
#82 0x00007fffec3e5e9a in start_thread (arg=0x7fff96ec2700)
    at pthread_create.c:308
#83 0x00007ffff6c73cbd in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
Comment 10 Philippe Normand 2013-01-14 02:42:43 PST
Can you please check the other threads too? It seems the crash happens in the dtor of the player, when setting playbin to NULL but it'd be nice to have a dump of all the threads
Comment 11 Chris Dumez 2013-01-14 04:18:13 PST
(In reply to comment #10)
> Can you please check the other threads too? It seems the crash happens in the dtor of the player, when setting playbin to NULL but it'd be nice to have a dump of all the threads

Sadly, I am unable to reproduce in gdb the crash that is mentioned by Dominik in the first comment. It seems timing related. However, I confirm that the crash occurs when calling gst_element_set_state(m_playBin, GST_STATE_NULL) in the MediaPlayerPrivateGStreamer dtor.

I can easily reproduce the issue outside gdb by running all media tests.
Comment 12 Chris Dumez 2013-01-16 05:16:00 PST
Created attachment 182963 [details]
Patch
Comment 13 Philippe Normand 2013-01-16 05:47:30 PST
Comment on attachment 182963 [details]
Patch

Interesting findings! Patch seems fine to me but I'd like to hear the opinion of a better Cairo expert than me :)
Comment 14 Gustavo Noronha (kov) 2013-01-16 06:04:55 PST
Comment on attachment 182963 [details]
Patch

How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that?
Comment 15 Chris Dumez 2013-01-16 06:11:47 PST
(In reply to comment #14)
> (From update of attachment 182963 [details])
> How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that?

Yes, it would be nice to avoid the copy. I took another look at the code and I indeed think we could do better.

Basically, we could change the ImageGStreamer() constructor to take a pointer to the data array and the data size, instead of a GstBuffer. This way, the caller can take care of mapping / unmapping the memory. 

It seems ImageGStreamer is used only in MediaPlayerPrivateGStreamer::paint() and the image only lives in that method. I'll propose a new patch.
Comment 16 Chris Dumez 2013-01-16 06:30:30 PST
(In reply to comment #14)
> (From update of attachment 182963 [details])
> How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that?

I'm about worried about doing it this way because the buffer belongs to the MediaPlayerPrivateGStreamer, not the ImageGStreamer. While this will work in practice with the current code, I think it is bug prone.
Comment 17 Chris Dumez 2013-01-16 06:33:36 PST
(In reply to comment #16)
> (In reply to comment #14)
> > (From update of attachment 182963 [details] [details])
> > How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that?
> 
> I'm about worried about doing it this way because the buffer belongs to the MediaPlayerPrivateGStreamer, not the ImageGStreamer. While this will work in practice with the current code, I think it is bug prone.

scratch that. The GstBuffer is ref counted so I think I will use Gustavo's proposal after all and simply ref the GstBuffer in the ImageGStreamer to make sure the buffer does not disappear while the Image is still alive.
Comment 18 Chris Dumez 2013-01-16 06:52:31 PST
Created attachment 182975 [details]
Patch

Take Gustavo's feedback into consideration. This avoids copying the image data.
Comment 19 Gustavo Noronha (kov) 2013-01-16 07:14:49 PST
Comment on attachment 182975 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=182975&action=review

cq- because of my nit suggestion

> Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h:65
> +        GstBuffer* m_buffer;

How about using GRefPtr<GstBuffer>?
Comment 20 Chris Dumez 2013-01-16 07:47:40 PST
(In reply to comment #19)
> (From update of attachment 182975 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=182975&action=review
> 
> cq- because of my nit suggestion
> 
> > Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h:65
> > +        GstBuffer* m_buffer;
> 
> How about using GRefPtr<GstBuffer>?

Makes sense, I'll fix it. Thanks for reviewing.
Comment 21 Chris Dumez 2013-01-16 09:55:30 PST
Sadly, it seems I have just experienced the crash reported by Dominik despite my fix. My fix is definitely needed but there is another bug.

I will attach my patch to Bug 107025 and keep this bug open then.
Comment 22 Zan Dobersek 2013-01-17 04:16:28 PST
*** Bug 104809 has been marked as a duplicate of this bug. ***
Comment 23 Chris Dumez 2013-01-17 04:38:08 PST
Crash is definitely still randomly occurring on the build bots:
http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r139974%20(8170)/inspector-protocol/input/dispatchKeyEvent-crash-log.txt
Comment 24 Philippe Normand 2013-01-17 04:41:24 PST
(In reply to comment #23)
> Crash is definitely still randomly occurring on the build bots:
> http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r139974%20(8170)/inspector-protocol/input/dispatchKeyEvent-crash-log.txt

There is a bit of everything in that huge crash log
Comment 25 Chris Dumez 2013-01-17 04:46:55 PST
(In reply to comment #24)
> (In reply to comment #23)
> > Crash is definitely still randomly occurring on the build bots:
> > http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r139974%20(8170)/inspector-protocol/input/dispatchKeyEvent-crash-log.txt
> 
> There is a bit of everything in that huge crash log

Well, at least the backtrace is always the same (from MediaPlayerPrivateGStreamer dtor).

Philippe, shouldn't the ref count of m_playBin always be 1 in MediaPlayerPrivateGStreamer destructor? This is what I expected but I get different values (e.g. 3). We don't seem to ref m_playBin anywhere and gst_element_factory_make(gPlaybinName, "play") is supposed to return a floating reference. I'm not sure how it gets ref'd yet.
Comment 26 Chris Dumez 2013-01-17 04:48:36 PST
I'm thinking that things may not get cleaned up properly when the media player is destroyed because non-media tests are crashing with gstreamer backtraces.
Comment 27 Philippe Normand 2013-01-18 02:55:03 PST
(In reply to comment #26)
> I'm thinking that things may not get cleaned up properly when the media player is destroyed because non-media tests are crashing with gstreamer backtraces.

The GTK Debug doesn't seem to have those issues. Could it be an EFL-only issue? Maybe related with your GLib mainloop integration?
Comment 28 Chris Dumez 2013-01-19 11:15:01 PST
(In reply to comment #9)
> Another one:
> 
> ** (WebProcess:16613): CRITICAL **: file gstaudioringbuffer.c: line 1939 (gst_audio_ring_buffer_set_channel_positions): should not be reached

I filed https://bugzilla.gnome.org/show_bug.cgi?id=692013 for this particular assertion.
Comment 29 Chris Dumez 2013-01-20 09:38:01 PST
Created attachment 183675 [details]
Backtrace with symbols for all threads
Comment 30 Chris Dumez 2013-01-20 09:47:23 PST
FYI, I managed to reproduce the crash by running media/video-source-media.html in a loop.
Comment 31 Chris Dumez 2013-01-20 10:58:09 PST
Created attachment 183677 [details]
Full valgrind log including backtrace for all threads
Comment 32 Chris Dumez 2013-01-20 13:17:34 PST
(In reply to comment #8)
> I managed to reproduce one gstreamer crash in gdb:
> 
> (WebProcess:15781): GStreamer-CRITICAL **: gst_buffer_pool_acquire_buffer: assertion `GST_IS_BUFFER_POOL (pool)' failed

Filed https://bugzilla.gnome.org/show_bug.cgi?id=692014 to track this specific gstreamer assertion.
Comment 33 Jussi Kukkonen (jku) 2013-01-22 07:36:29 PST
Created attachment 183984 [details]
gdb backtrace

(In reply to comment #29)
> Created an attachment (id=183675) [details]
> Backtrace with symbols for all threads

Hmm, I think this may be yet another different problem (maybe with the same cause but still): this one doesn't actually end up in gst_memory_unmap().

I have a gdb backtrace of what seems like the original problem: it seems to crash when ffmpeg frees some image buffers during the GST_STATE_CHANGE_PAUSED_TO_READY transition that happens when we set state to GST_STATE_NULL. Attaching backtrace.
Comment 34 Jussi Kukkonen (jku) 2013-01-22 07:42:36 PST
Created attachment 183987 [details]
full backtrace of the crashing thread

Same but with "bt full" for the crashing thread
Comment 35 Philippe Normand 2018-02-09 10:04:46 PST
Those 3 tests are passing in GTK and EFL was removed so I'm going to close this bug. Please reopen if needed.