media/video-src-source.html media/video-source-moved.html media/video-source.html Are flaky crashers on the EFL bot. Either with glibc detecting a corrupted doubly linked list or the following stack trace: crash log for WebProcess (pid <unknown>): STDOUT: <empty> STDERR: 1 0x7f10baeda21f STDERR: 2 0x7f10bd9394a0 STDERR: 3 0x7f10b0c4a61c gst_memory_unmap STDERR: 4 0x7f10b0c2614a gst_buffer_unmap STDERR: 5 0x7f10b0343536 gst_video_frame_unmap STDERR: 6 0x7f1050f2c4e9 STDERR: 7 0x7f1051255b35 STDERR: 8 0x7f1050ef7dd2 STDERR: 9 0x7f1050f08e46 STDERR: 10 0x7f1050f1a6c0 STDERR: 11 0x7f1050f2e4f3 STDERR: 12 0x7f1050f2e5e8 STDERR: 13 0x7f10b034dd42 STDERR: 14 0x7f10b0c3abec gst_element_change_state STDERR: 15 0x7f10b0c3b56f STDERR: 16 0x7f10b0c23231 STDERR: 17 0x7f10619a6ad3 STDERR: 18 0x7f10b0c3abec gst_element_change_state STDERR: 19 0x7f10b0c3b56f STDERR: 20 0x7f10b0c23231 STDERR: 21 0x7f10619ae50c STDERR: 22 0x7f10b0c3abec gst_element_change_state STDERR: 23 0x7f10b0c3b56f STDERR: 24 0x7f10b0c23231 STDERR: 25 0x7f10b0c58fc4 STDERR: 26 0x7f10619b5a50 STDERR: 27 0x7f10b0c3abec gst_element_change_state STDERR: 28 0x7f10b0c3b56f STDERR: 29 0x7f10baddd020 WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer() STDERR: 30 0x7f10baddd16e WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer() STDERR: 31 0x7f10ba360540 void WTF::deleteOwnedPtr<WebCore::MediaPlayerPrivateInterface>(WebCore::MediaPlayerPrivateInterface*) STDERR: LEAK: 1 WebPage STDERR: LEAK: 1 WebFrame STDERR: LEAK: 35 RenderObject STDERR: LEAK: 1 Page STDERR: LEAK: 1 Frame STDERR: LEAK: 6 CachedResource STDERR: LEAK: 103 WebCoreNode
https://bugs.webkit.org/show_bug.cgi?id=104809 is related I believe.
GTK uses gst 1.0.4 and doesn't have these issues I think. CCing Xabier so he can check.
Also would you have a more detailed stack trace please?
(In reply to comment #2) > GTK uses gst 1.0.4 and doesn't have these issues I think. CCing Xabier so he can check. I tried using 1.0.4 as well but it did not help so I kept 1.0.5.
I have just double-checked, I can reproduce the exact same crash with gstreamer 1.0.4 and media/video-src-blob.html test case.
Here is another backtrace I got with media/video-source-moved.html: crash log for WebProcess (pid <unknown>): STDOUT: <empty> STDERR: STDERR: (WebProcess:8859): GStreamer-CRITICAL **: gst_poll_get_read_gpollfd: assertion `set != NULL' failed STDERR: STDERR: (WebProcess:8859): GStreamer-CRITICAL **: gst_bus_create_watch: assertion `bus->priv->poll != NULL' failed STDERR: STDERR: (WebProcess:8859): GLib-CRITICAL **: g_source_set_callback: assertion `source != NULL' failed STDERR: 1 0x7f3034833477 STDERR: 2 0x7f3036fab4a0 STDERR: 3 0x7f302ff56a46 g_source_attach STDERR: 4 0x7f302d3f8758 STDERR: 5 0x7f302d3f927f gst_bus_add_signal_watch_full STDERR: 6 0x7f302d3f9318 gst_bus_add_signal_watch STDERR: 7 0x7f303473c5df WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin() STDERR: 8 0x7f3034736506 WebCore::MediaPlayerPrivateGStreamer::load(WTF::String const&) STDERR: 9 0x7f3033cb6d78 WebCore::MediaPlayer::loadWithNextMediaEngine(WebCore::MediaPlayerFactory*) STDERR: 10 0x7f3033cb6a87 WebCore::MediaPlayer::load(WebCore::KURL const&, WebCore::ContentType const&, WTF::String const&) STDERR: 11 0x7f30338127d5 WebCore::HTMLMediaElement::loadResource(WebCore::KURL const&, WebCore::ContentType&, WTF::String const&) STDERR: 12 0x7f303381210b WebCore::HTMLMediaElement::loadNextSourceChild() STDERR: 13 0x7f30338113f1 WebCore::HTMLMediaElement::loadTimerFired(WebCore::Timer<WebCore::HTMLMediaElement>*) STDERR: 14 0x7f3033830342 WebCore::Timer<WebCore::HTMLMediaElement>::fired() STDERR: 15 0x7f3033c447e6 WebCore::ThreadTimers::sharedTimerFiredInternal() STDERR: 16 0x7f3033c44707 WebCore::ThreadTimers::sharedTimerFired() STDERR: 17 0x7f30347200a1 STDERR: 18 0x7f30382ab46e _ecore_timer_expired_call STDERR: 19 0x7f30382ab63b _ecore_timer_expired_timers_call STDERR: 20 0x7f30382a8551 STDERR: 21 0x7f30382a8be7 ecore_main_loop_begin STDERR: 22 0x7f303471e963 WebCore::RunLoop::run() STDERR: 23 0x7f3037d752ae WebProcessMainEfl STDERR: 24 0x4007c4 main STDERR: 25 0x7f3036f9676d __libc_start_main STDERR: 26 0x4006e9 STDERR: LEAK: 1 WebPage STDERR: LEAK: 1 WebFrame STDERR: LEAK: 124 RenderObject STDERR: LEAK: 1 Page STDERR: LEAK: 1 Frame STDERR: LEAK: 95 CachedResource STDERR: LEAK: 862 WebCoreNode
I have trouble reproducing the crash in gdb as it seems time sensitive. Here is a slightly better backtrace though: [473/491] media/video-source.html passed*** glibc detected *** /home/chris/unencrypted/WebKit/WebKitBuild/Debug/bin/WebProcess: corrupted double-linked list: 0x00007f449421db60 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x7eb96)[0x7f4505ebeb96] /lib/x86_64-linux-gnu/libc.so.6(+0x7fe55)[0x7f4505ebfe55] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x59e5ac)[0x7f44938e15ac] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x210bec)[0x7f4493553bec] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x2a5484)[0x7f44935e8484] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x2a54cb)[0x7f44935e84cb] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x45b45e)[0x7f449379e45e] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x3e93b)[0x7f449338193b] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x57438)[0x7f449339a438] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstlibav.so(+0x5b109)[0x7f449339e109] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstvideo-1.0.so.0(+0x25345)[0x7f44fc189345] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x30e7a)[0x7f44fc28ae7a] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x3239f)[0x7f44fc28c39f] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstplayback.so(+0x15b82)[0x7f44aee8eb82] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x30e7a)[0x7f44fc28ae7a] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x3239f)[0x7f44fc28c39f] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstplayback.so(+0x1d242)[0x7f44aee96242] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x30e7a)[0x7f44fc28ae7a] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x3239f)[0x7f44fc28c39f] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x7a0a8)[0x7f44fc2d40a8] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/gstreamer-1.0/libgstplayback.so(+0x272fd)[0x7f44aeea02fd] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_change_state+0x4b)[0x7f44fc2add85] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(+0x53c31)[0x7f44fc2adc31] /home/chris/unencrypted/WebKit/WebKitBuild/Dependencies/Root/lib64/libgstreamer-1.0.so.0(gst_element_set_state+0xd1)[0x7f44fc2ad81f] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore27MediaPlayerPrivateGStreamerD1Ev+0xba)[0x7f45035d7364] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore27MediaPlayerPrivateGStreamerD0Ev+0x18)[0x7f45035d74b2] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF14deleteOwnedPtrIN7WebCore27MediaPlayerPrivateInterfaceEEEvPT_+0x2a)[0x7f4502b5a3c4] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF6OwnPtrIN7WebCore27MediaPlayerPrivateInterfaceEED1Ev+0x1b)[0x7f4502b5a17d] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11MediaPlayerD1Ev+0x80)[0x7f4502b577d6] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11MediaPlayerD0Ev+0x18)[0x7f4502b57818] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF14deleteOwnedPtrIN7WebCore11MediaPlayerEEEvPT_+0x2a)[0x7f45026c3d9b] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN3WTF6OwnPtrIN7WebCore11MediaPlayerEE5clearEv+0x2e)[0x7f45026c35bc] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore16HTMLMediaElement16clearMediaPlayerEi+0x2d)[0x7f45026bceeb] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore16HTMLMediaElement17userCancelledLoadEv+0x62)[0x7f45026bcdc8] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore16HTMLMediaElement4stopEv+0x68)[0x7f45026bcfbe] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore22ScriptExecutionContext20stopActiveDOMObjectsEv+0x12a)[0x7f4502545a3e] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore8Document6detachEv+0xea)[0x7f4502458dc2] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore8Document21prepareForDestructionEv+0x54)[0x7f4502459086] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore5Frame7setViewEN3WTF10PassRefPtrINS_9FrameViewEEE+0xd8)[0x7f4502a24180] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore5Frame10createViewERKNS_7IntSizeERKNS_5ColorEbS3_RKNS_7IntRectEbNS_13ScrollbarModeEbSA_b+0x179)[0x7f4502a2697d] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libewebkit2.so.0(_ZN6WebKit20WebFrameLoaderClient31transitionToCommittedForNewPageEv+0x2d6)[0x7f4506b82a38] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader21transitionToCommittedEN3WTF10PassRefPtrINS_10CachedPageEEE+0x5f1)[0x7f450292048b] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader21commitProvisionalLoadEv+0x3e2)[0x7f450291f896] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader13commitIfReadyEv+0x3d)[0x7f45028f9e1b] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader15finishedLoadingEv+0x18)[0x7f45028f9e36] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader14maybeLoadEmptyEv+0x315)[0x7f45028fc613] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14DocumentLoader24startLoadingMainResourceEv+0xb3)[0x7f45028fc6e7] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader31continueLoadAfterWillSubmitFormEv+0xa4)[0x7f45029219ca] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader33continueLoadAfterNavigationPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb+0x3e3)[0x7f450292447b] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore11FrameLoader37callContinueLoadAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb+0x4f)[0x7f4502923baf] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore14PolicyCallback4callEb+0x76)[0x7f450293a61a] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore13PolicyChecker29continueAfterNavigationPolicyENS_12PolicyActionE+0x24b)[0x7f450293b581] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libewebkit2.so.0(_ZN6WebKit20WebFrameLoaderClient39dispatchDecidePolicyForNavigationActionEMN7WebCore13PolicyCheckerEFvNS1_12PolicyActionEERKNS1_16NavigationActionERKNS1_15ResourceRequestEN3WTF10PassRefPtrINS1_9FormStateEEE+0x21c)[0x7f4506b805c4] /home/chris/unencrypted/WebKit/WebKitBuild/Debug/lib/libwebcore_efl.so.0(_ZN7WebCore13PolicyChecker21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S9_bESA_+0x40c)[0x7f450293af8c]
I managed to reproduce one gstreamer crash in gdb: (WebProcess:15781): GStreamer-CRITICAL **: gst_buffer_pool_acquire_buffer: assertion `GST_IS_BUFFER_POOL (pool)' failed Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to Thread 0x7fff7ffff700 (LWP 16568)] g_logv (log_domain=0x7fffed069f20 "GStreamer", log_level=<optimized out>, format=0x7fffefbfba41 "%s: assertion `%s' failed", args1=0x7fff7fffd838) at gmessages.c:765 765 g_private_set (&g_log_depth, GUINT_TO_POINTER (depth)); (gdb) bt #0 g_logv (log_domain=0x7fffed069f20 "GStreamer", log_level=<optimized out>, format=0x7fffefbfba41 "%s: assertion `%s' failed", args1=0x7fff7fffd838) at gmessages.c:765 #1 0x00007fffefb9bbd2 in g_log (log_domain=<optimized out>, log_level=<optimized out>, format=<optimized out>) at gmessages.c:792 #2 0x00007fffecfd57e9 in gst_buffer_pool_acquire_buffer (pool=0x0, buffer=0x7fff90036870, params=0x0) at gstbufferpool.c:1090 #3 0x00007fffecece114 in gst_video_decoder_allocate_output_frame ( decoder=0x7fff740388d0, frame=0x7fff90036830) at gstvideodecoder.c:3112 #4 0x00007fff7e39a354 in get_output_buffer (ffmpegdec=0x7fff740388d0, frame=0x7fff90036830) at gstavviddec.c:1000 #5 0x00007fff7e39b006 in gst_ffmpegviddec_video_frame ( ffmpegdec=0x7fff740388d0, data=0x7fff8c026090 "", size=10444, frame=0x7fff90036830, ret=0x7fff7fffdf8c) at gstavviddec.c:1188 #6 0x00007fff7e39b35a in gst_ffmpegviddec_frame (ffmpegdec=0x7fff740388d0, data=0x7fff8c026090 "", size=10444, got_data=0x7fff7fffdf88, frame=0x7fff90036830, ret=0x7fff7fffdf8c) at gstavviddec.c:1262 #7 0x00007fff7e39be51 in gst_ffmpegviddec_handle_frame ( decoder=0x7fff740388d0, frame=0x7fff90036830) at gstavviddec.c:1379 #8 0x00007fffececd10b in gst_video_decoder_decode_frame ( decoder=0x7fff740388d0, frame=0x7fff90036830) at gstvideodecoder.c:2665 #9 0x00007fffecec60d1 in gst_video_decoder_chain_forward ( decoder=0x7fff740388d0, buf=0x7fff90027e60, at_eos=0) ---Type <return> to continue, or q <return> to quit--- at gstvideodecoder.c:1697 #10 0x00007fffecec80f8 in gst_video_decoder_chain (pad=0x7fff8c01edb0, parent=0x7fff740388d0, buf=0x7fff90027e60) at gstvideodecoder.c:1957 #11 0x00007fffed00bbd6 in gst_pad_chain_data_unchecked (pad=0x7fff8c01edb0, type=4112, data=0x7fff90027e60) at gstpad.c:3654 #12 0x00007fffed00c693 in gst_pad_push_data (pad=0x7fff8c01e2c0, type=4112, data=0x7fff90027e60) at gstpad.c:3871 #13 0x00007fffed00cbe8 in gst_pad_push (pad=0x7fff8c01e2c0, buffer=0x7fff90027e60) at gstpad.c:3974 #14 0x00007fffecf74136 in gst_base_transform_chain (pad=0x7fff8c01e090, parent=0x7fff8c024020, buffer=0x7fff90027e60) at gstbasetransform.c:2203 #15 0x00007fffed00bbd6 in gst_pad_chain_data_unchecked (pad=0x7fff8c01e090, type=4112, data=0x7fff90027e60) at gstpad.c:3654 #16 0x00007fffed00c693 in gst_pad_push_data (pad=0x7fff84011d00, type=4112, data=0x7fff90027e60) at gstpad.c:3871 #17 0x00007fffed00cbe8 in gst_pad_push (pad=0x7fff84011d00, buffer=0x7fff90027e60) at gstpad.c:3974 #18 0x00007fffecf47c24 in gst_base_parse_push_frame (parse=0x7fff8c01c000, frame=0x7fff7fffe800) at gstbaseparse.c:2146 #19 0x00007fffecf4a313 in gst_base_parse_chain (pad=0x7fff84011ad0, parent=0x7fff8c01c000, buffer=0x7fff90027e60) at gstbaseparse.c:2623 #20 0x00007fffed00bbd6 in gst_pad_chain_data_unchecked (pad=0x7fff84011ad0, type=4112, data=0x7fff90027e60) at gstpad.c:3654 ---Type <return> to continue, or q <return> to quit--- #21 0x00007fffed00c693 in gst_pad_push_data (pad=0x7fff8c00fd40, type=4112, data=0x7fff90027e60) at gstpad.c:3871 #22 0x00007fffed00cbe8 in gst_pad_push (pad=0x7fff8c00fd40, buffer=0x7fff90027e60) at gstpad.c:3974 #23 0x00007fff97738a58 in gst_single_queue_push_one (mq=0x7fff8c010090, sq=0x7fff8c018d10, object=0x7fff90027e60) at gstmultiqueue.c:1057 #24 0x00007fff9773999a in gst_multi_queue_loop (pad=0x7fff8c00fd40) at gstmultiqueue.c:1303 #25 0x00007fffed03ecaf in gst_task_func (task=0x7fff88005240) at gsttask.c:316 #26 0x00007fffed03fdab in default_func (tdata=0x7945b0, pool=0x615020) at gsttaskpool.c:70 #27 0x00007fffefbb7438 in g_thread_pool_thread_proxy (data=<optimized out>) at gthreadpool.c:309 #28 0x00007fffefbb6bd5 in g_thread_proxy (data=0x7fff8c002800) at gthread.c:801 #29 0x00007fffec3e5e9a in start_thread (arg=0x7fff7ffff700) at pthread_create.c:308 #30 0x00007ffff6c73cbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112 #31 0x0000000000000000 in ?? ()
Another one: ** (WebProcess:16613): CRITICAL **: file gstaudioringbuffer.c: line 1939 (gst_audio_ring_buffer_set_channel_positions): should not be reached Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to Thread 0x7fff96ec2700 (LWP 16812)] g_logv (log_domain=0x0, log_level=<optimized out>, format=0x7fffeca81f98 "file %s: line %d (%s): should not be reached", args1=0x7fff96ebfa58) at gmessages.c:765 765 g_private_set (&g_log_depth, GUINT_TO_POINTER (depth)); (gdb) bt #0 g_logv (log_domain=0x0, log_level=<optimized out>, format=0x7fffeca81f98 "file %s: line %d (%s): should not be reached", args1=0x7fff96ebfa58) at gmessages.c:765 #1 0x00007fffefb9bbd2 in g_log (log_domain=<optimized out>, log_level=<optimized out>, format=<optimized out>) at gmessages.c:792 #2 0x00007fffeca4ee59 in gst_audio_ring_buffer_set_channel_positions ( buf=0x7fff8804e800, position=0x7fff957ddce0) at gstaudioringbuffer.c:1939 #3 0x00007fff957d3d6c in alsasink_parse_spec (alsa=0x7fff900b6410, spec=0x7fff8804e888) at gstalsasink.c:807 #4 0x00007fff957d41e4 in gst_alsasink_prepare (asink=0x7fff900b6410, spec=0x7fff8804e888) at gstalsasink.c:869 #5 0x00007fffeca78193 in gst_audio_sink_ring_buffer_acquire ( buf=0x7fff8804e800, spec=0x7fff8804e888) at gstaudiosink.c:404 #6 0x00007fffeca4a5e8 in gst_audio_ring_buffer_acquire (buf=0x7fff8804e800, spec=0x7fff8804e888) at gstaudioringbuffer.c:542 #7 0x00007fffeca6bd01 in gst_audio_base_sink_setcaps (bsink=0x7fff900b6410, caps=0x6de400) at gstaudiobasesink.c:883 #8 0x00007fffecf5c543 in gst_base_sink_default_event ( basesink=0x7fff900b6410, event=0x7fff9005a9e0) at gstbasesink.c:2912 #9 0x00007fffeca6c7e1 in gst_audio_base_sink_event (bsink=0x7fff900b6410, event=0x7fff9005a9e0) at gstaudiobasesink.c:1085 #10 0x00007fffecf5c89c in gst_base_sink_event (pad=0x7fff780066d0, parent=0x7fff900b6410, event=0x7fff9005a9e0) at gstbasesink.c:3014 #11 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff780066d0, event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4821 #12 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x8cafc0, event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #13 0x00007fffed00a571 in push_sticky (pad=0x8cafc0, ev=0x7fff96ec00b0, user_data=0x7fff96ec0110) at gstpad.c:3285 #14 0x00007fffed0028c4 in events_foreach (pad=0x8cafc0, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0110) at gstpad.c:514 #15 0x00007fffed00a862 in check_sticky (pad=0x8cafc0) at gstpad.c:3333 #16 0x00007fffed00e95b in gst_pad_push_event (pad=0x8cafc0, event=0x7fff9005a9e0) at gstpad.c:4635 #17 0x00007fffed008ed2 in event_forward_func (pad=0x8cafc0, data=0x7fff96ec02b0) at gstpad.c:2719 #18 0x00007fffed008ccb in gst_pad_forward (pad=0x91d140, forward=0x7fffed008d9a <event_forward_func>, user_data=0x7fff96ec02b0) at gstpad.c:2673 #19 0x00007fffed009084 in gst_pad_event_default (pad=0x91d140, parent=0x7fff60009380, event=0x7fff9005a9e0) at gstpad.c:2770 #20 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x91d140, event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM at gstpad.c:4821 #21 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x91c560, event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #22 0x00007fffed00a571 in push_sticky (pad=0x91c560, ev=0x7fff96ec04c0, user_data=0x7fff96ec0520) at gstpad.c:3285 #23 0x00007fffed0028c4 in events_foreach (pad=0x91c560, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0520) at gstpad.c:514 #24 0x00007fffed00a862 in check_sticky (pad=0x91c560) at gstpad.c:3333 #25 0x00007fffed00e95b in gst_pad_push_event (pad=0x91c560, event=0x7fff9005a9e0) at gstpad.c:4635 #26 0x00007fffed008ed2 in event_forward_func (pad=0x91c560, data=0x7fff96ec06c0) at gstpad.c:2719 #27 0x00007fffed008ccb in gst_pad_forward (pad=0x7fff700078e0, forward=0x7fffed008d9a <event_forward_func>, user_data=0x7fff96ec06c0) at gstpad.c:2673 #28 0x00007fffed009084 in gst_pad_event_default (pad=0x7fff700078e0, parent=0x91c560, event=0x7fff9005a9e0) at gstpad.c:2770 #29 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff700078e0, event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4821 #30 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff6c014470, event=0x7fff9005a9e0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #31 0x00007fffed00a571 in push_sticky (pad=0x7fff6c014470, ev=0x7fff96ec08d0, user_data=0x7fff96ec0930) at gstpad.c:3285 #32 0x00007fffed0028c4 in events_foreach (pad=0x7fff6c014470, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0930) at gstpad.c:514 #33 0x00007fffed00a862 in check_sticky (pad=0x7fff6c014470) at gstpad.c:3333 #34 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff6c014470, event=0x7fff9005a9e0) at gstpad.c:4635 #35 0x00007fffecf6e558 in gst_pad_set_caps (pad=0x7fff6c014470, caps=0x6de400) at ../../../gst/gstcompat.h:71 #36 0x00007fffecf71487 in gst_base_transform_setcaps (trans=0x7fff900bdca0, pad=0x7fff6c015a50, incaps=0x6de400) at gstbasetransform.c:1326 #37 0x00007fffecf72ca1 in gst_base_transform_sink_eventfunc ( trans=0x7fff900bdca0, event=0x7fff9005a8c0) at gstbasetransform.c:1826 #38 0x00007fffecf72b2d in gst_base_transform_sink_event (pad=0x7fff6c015a50, parent=0x7fff900bdca0, event=0x7fff9005a8c0) at gstbasetransform.c:1785 #39 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff6c015a50, event=0x7fff9005a8c0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4821 #40 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff78006d60, event=0x7fff9005a8c0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #41 0x00007fffed00a571 in push_sticky (pad=0x7fff78006d60, ev=0x7fff96ec0cd0, user_data=0x7fff96ec0d30) at gstpad.c:3285 #42 0x00007fffed0028c4 in events_foreach (pad=0x7fff78006d60, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec0d30) at gstpad.c:514 #43 0x00007fffed00a862 in check_sticky (pad=0x7fff78006d60) at gstpad.c:3333 #44 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff78006d60, event=0x7fff9005a8c0) at gstpad.c:4635 #45 0x00007fffecf6e558 in gst_pad_set_caps (pad=0x7fff78006d60, caps=0x6de400) at ../../../gst/gstcompat.h:71 #46 0x00007fffecf71487 in gst_base_transform_setcaps (trans=0x7fff900bee60, pad=0x7fff60015440, incaps=0x6de400) at gstbasetransform.c:1326 #47 0x00007fffecf72ca1 in gst_base_transform_sink_eventfunc ( trans=0x7fff900bee60, event=0x7fff9005a800) at gstbasetransform.c:1826 #48 0x00007fff94a70222 in gst_audio_resample_sink_event (base=0x7fff900bee60, event=0x7fff9005a800) at gstaudioresample.c:917 #49 0x00007fffecf72b2d in gst_base_transform_sink_event (pad=0x7fff60015440, parent=0x7fff900bee60, event=0x7fff9005a800) at gstbasetransform.c:1785 #50 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff60015440, event=0x7fff9005a800, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4821 #51 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff60015210, event=0x7fff9005a800, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #52 0x00007fffed00a571 in push_sticky (pad=0x7fff60015210, ev=0x7fff96ec1100, user_data=0x7fff96ec1160) at gstpad.c:3285 #53 0x00007fffed0028c4 in events_foreach (pad=0x7fff60015210, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec1160) at gstpad.c:514 #54 0x00007fffed00a862 in check_sticky (pad=0x7fff60015210) at gstpad.c:3333 #55 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff60015210, event=0x7fff9005a800) at gstpad.c:4635 #56 0x00007fffecf6e558 in gst_pad_set_caps (pad=0x7fff60015210, caps=0x6de400) at ../../../gst/gstcompat.h:71 #57 0x00007fffecf71487 in gst_base_transform_setcaps (trans=0x7fff900be620, pad=0x7fff6c014b00, incaps=0x7fff60002a30) at gstbasetransform.c:1326 #58 0x00007fffecf72ca1 in gst_base_transform_sink_eventfunc ( trans=0x7fff900be620, event=0x7fff44002cc0) at gstbasetransform.c:1826 #59 0x00007fffecf72b2d in gst_base_transform_sink_event (pad=0x7fff6c014b00, parent=0x7fff900be620, event=0x7fff44002cc0) at gstbasetransform.c:1785 #60 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x7fff6c014b00, event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4821 #61 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff700076a0, event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #62 0x00007fffed00a571 in push_sticky (pad=0x7fff700076a0, ev=0x7fff96ec1500, user_data=0x7fff96ec1560) at gstpad.c:3285 #63 0x00007fffed0028c4 in events_foreach (pad=0x7fff700076a0, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec1560) at gstpad.c:514 #64 0x00007fffed00a862 in check_sticky (pad=0x7fff700076a0) at gstpad.c:3333 #65 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff700076a0, event=0x7fff44002cc0) at gstpad.c:4635 #66 0x00007fffed008ed2 in event_forward_func (pad=0x7fff700076a0, data=0x7fff96ec1700) at gstpad.c:2719 #67 0x00007fffed008ccb in gst_pad_forward (pad=0x91c7c0, forward=0x7fffed008d9a <event_forward_func>, user_data=0x7fff96ec1700) at gstpad.c:2673 #68 0x00007fffed009084 in gst_pad_event_default (pad=0x91c7c0, parent=0x7fff88079380, event=0x7fff44002cc0) at gstpad.c:2770 #69 0x00007fff9738448b in gst_play_sink_convert_bin_sink_event (pad=0x91c7c0, parent=0x7fff88079380, event=0x7fff44002cc0) at gstplaysinkconvertbin.c:274 #70 0x00007fffed00f26f in gst_pad_send_event_unchecked (pad=0x91c7c0, event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4821 #71 0x00007fffed00e429 in gst_pad_push_event_unchecked (pad=0x7fff780064a0, event=0x7fff44002cc0, type=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at gstpad.c:4514 #72 0x00007fffed00a571 in push_sticky (pad=0x7fff780064a0, ev=0x7fff96ec19e0, user_data=0x7fff96ec1a40) at gstpad.c:3285 #73 0x00007fffed0028c4 in events_foreach (pad=0x7fff780064a0, func=0x7fffed00a4b2 <push_sticky>, user_data=0x7fff96ec1a40) at gstpad.c:514 #74 0x00007fffed00a862 in check_sticky (pad=0x7fff780064a0) at gstpad.c:3333 #75 0x00007fffed00e95b in gst_pad_push_event (pad=0x7fff780064a0, event=0x7fff44002cc0) at gstpad.c:4635 #76 0x00007fff9731722f in gst_queue_push_one (queue=0x7fff88073720) at gstqueue.c:1096 #77 0x00007fff97317b82 in gst_queue_loop (pad=0x7fff780064a0) at gstqueue.c:1161 #78 0x00007fffed03ecaf in gst_task_func (task=0x7fff88099360) at gsttask.c:316 #79 0x00007fffed03fdab in default_func (tdata=0x7fff5c002490, pool=0x640830) at gsttaskpool.c:70 #80 0x00007fffefbb7438 in g_thread_pool_thread_proxy (data=<optimized out>) at gthreadpool.c:309 #81 0x00007fffefbb6bd5 in g_thread_proxy (data=0x7fff4c002590) at gthread.c:801 #82 0x00007fffec3e5e9a in start_thread (arg=0x7fff96ec2700) at pthread_create.c:308 #83 0x00007ffff6c73cbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
Can you please check the other threads too? It seems the crash happens in the dtor of the player, when setting playbin to NULL but it'd be nice to have a dump of all the threads
(In reply to comment #10) > Can you please check the other threads too? It seems the crash happens in the dtor of the player, when setting playbin to NULL but it'd be nice to have a dump of all the threads Sadly, I am unable to reproduce in gdb the crash that is mentioned by Dominik in the first comment. It seems timing related. However, I confirm that the crash occurs when calling gst_element_set_state(m_playBin, GST_STATE_NULL) in the MediaPlayerPrivateGStreamer dtor. I can easily reproduce the issue outside gdb by running all media tests.
Created attachment 182963 [details] Patch
Comment on attachment 182963 [details] Patch Interesting findings! Patch seems fine to me but I'd like to hear the opinion of a better Cairo expert than me :)
Comment on attachment 182963 [details] Patch How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that?
(In reply to comment #14) > (From update of attachment 182963 [details]) > How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that? Yes, it would be nice to avoid the copy. I took another look at the code and I indeed think we could do better. Basically, we could change the ImageGStreamer() constructor to take a pointer to the data array and the data size, instead of a GstBuffer. This way, the caller can take care of mapping / unmapping the memory. It seems ImageGStreamer is used only in MediaPlayerPrivateGStreamer::paint() and the image only lives in that method. I'll propose a new patch.
(In reply to comment #14) > (From update of attachment 182963 [details]) > How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that? I'm about worried about doing it this way because the buffer belongs to the MediaPlayerPrivateGStreamer, not the ImageGStreamer. While this will work in practice with the current code, I think it is bug prone.
(In reply to comment #16) > (In reply to comment #14) > > (From update of attachment 182963 [details] [details]) > > How about leaving the memory mapped until the cairo surface is destroyed? Or would the buffer possibly be gone before that? > > I'm about worried about doing it this way because the buffer belongs to the MediaPlayerPrivateGStreamer, not the ImageGStreamer. While this will work in practice with the current code, I think it is bug prone. scratch that. The GstBuffer is ref counted so I think I will use Gustavo's proposal after all and simply ref the GstBuffer in the ImageGStreamer to make sure the buffer does not disappear while the Image is still alive.
Created attachment 182975 [details] Patch Take Gustavo's feedback into consideration. This avoids copying the image data.
Comment on attachment 182975 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=182975&action=review cq- because of my nit suggestion > Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h:65 > + GstBuffer* m_buffer; How about using GRefPtr<GstBuffer>?
(In reply to comment #19) > (From update of attachment 182975 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=182975&action=review > > cq- because of my nit suggestion > > > Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h:65 > > + GstBuffer* m_buffer; > > How about using GRefPtr<GstBuffer>? Makes sense, I'll fix it. Thanks for reviewing.
Sadly, it seems I have just experienced the crash reported by Dominik despite my fix. My fix is definitely needed but there is another bug. I will attach my patch to Bug 107025 and keep this bug open then.
*** Bug 104809 has been marked as a duplicate of this bug. ***
Crash is definitely still randomly occurring on the build bots: http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r139974%20(8170)/inspector-protocol/input/dispatchKeyEvent-crash-log.txt
(In reply to comment #23) > Crash is definitely still randomly occurring on the build bots: > http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r139974%20(8170)/inspector-protocol/input/dispatchKeyEvent-crash-log.txt There is a bit of everything in that huge crash log
(In reply to comment #24) > (In reply to comment #23) > > Crash is definitely still randomly occurring on the build bots: > > http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r139974%20(8170)/inspector-protocol/input/dispatchKeyEvent-crash-log.txt > > There is a bit of everything in that huge crash log Well, at least the backtrace is always the same (from MediaPlayerPrivateGStreamer dtor). Philippe, shouldn't the ref count of m_playBin always be 1 in MediaPlayerPrivateGStreamer destructor? This is what I expected but I get different values (e.g. 3). We don't seem to ref m_playBin anywhere and gst_element_factory_make(gPlaybinName, "play") is supposed to return a floating reference. I'm not sure how it gets ref'd yet.
I'm thinking that things may not get cleaned up properly when the media player is destroyed because non-media tests are crashing with gstreamer backtraces.
(In reply to comment #26) > I'm thinking that things may not get cleaned up properly when the media player is destroyed because non-media tests are crashing with gstreamer backtraces. The GTK Debug doesn't seem to have those issues. Could it be an EFL-only issue? Maybe related with your GLib mainloop integration?
(In reply to comment #9) > Another one: > > ** (WebProcess:16613): CRITICAL **: file gstaudioringbuffer.c: line 1939 (gst_audio_ring_buffer_set_channel_positions): should not be reached I filed https://bugzilla.gnome.org/show_bug.cgi?id=692013 for this particular assertion.
Created attachment 183675 [details] Backtrace with symbols for all threads
FYI, I managed to reproduce the crash by running media/video-source-media.html in a loop.
Created attachment 183677 [details] Full valgrind log including backtrace for all threads
(In reply to comment #8) > I managed to reproduce one gstreamer crash in gdb: > > (WebProcess:15781): GStreamer-CRITICAL **: gst_buffer_pool_acquire_buffer: assertion `GST_IS_BUFFER_POOL (pool)' failed Filed https://bugzilla.gnome.org/show_bug.cgi?id=692014 to track this specific gstreamer assertion.
Created attachment 183984 [details] gdb backtrace (In reply to comment #29) > Created an attachment (id=183675) [details] > Backtrace with symbols for all threads Hmm, I think this may be yet another different problem (maybe with the same cause but still): this one doesn't actually end up in gst_memory_unmap(). I have a gdb backtrace of what seems like the original problem: it seems to crash when ffmpeg frees some image buffers during the GST_STATE_CHANGE_PAUSED_TO_READY transition that happens when we set state to GST_STATE_NULL. Attaching backtrace.
Created attachment 183987 [details] full backtrace of the crashing thread Same but with "bt full" for the crashing thread
Those 3 tests are passing in GTK and EFL was removed so I'm going to close this bug. Please reopen if needed.