Bug 183632 - Race Condition in MediaPlayerPrivateMediaStreamAVFObjC::requestNotificationWhenReadyForVideoData causes crash/segfault.
Summary: Race Condition in MediaPlayerPrivateMediaStreamAVFObjC::requestNotificationWh...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: Safari 11
Hardware: Mac macOS 10.13
: P2 Major
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-03-14 08:06 PDT by Jason Thomas
Modified: 2018-03-16 09:18 PDT (History)
5 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jason Thomas 2018-03-14 08:06:05 PDT
I have a web application that makes heavy use of HTML5 video elements.

It appears that when creating/destroying these video elements leads to an intermittent crash in Safari that looks like it's related to the callback in
requestNotificationWhenReadyForVideo:

```
    [m_sampleBufferDisplayLayer requestMediaDataWhenReadyOnQueue:dispatch_get_main_queue() usingBlock:^ {
        [m_sampleBufferDisplayLayer stopRequestingMediaData];

```

I assume what is happening is it is trying to dispatch stopRequestingMediaData on the main thread, but by the time the callback occurs, m_sampleBufferDisplayLayer has been released.

I am very reliably seeing it crash for multiple users in the exact location of the callback that is getting dispatched on main:

Process:               com.apple.WebKit.WebContent [4915]
Path:                  /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
Identifier:            com.apple.WebKit.WebContent
Version:               13604 (13604.5.6)
Build Info:            WebKit2-7604005006000000~4
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Safari [4896]
User ID:               501

Date/Time:             2018-02-16 12:59:48.599 -0700
OS Version:            Mac OS X 10.13.3 (17D47)
Report Version:        12
Anonymous UUID:        C456DFCB-0DBD-6CEE-2F31-1DA484FBE3DE

Sleep/Wake UUID:       E2FA000B-532E-4FA4-8DF1-CA99531A8A76

Time Awake Since Boot: 560000 seconds
Time Since Wake:       5200 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000100000018
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [0]

VM Regions Near 0x100000018:
--> 
    __TEXT                 0000000102707000-0000000102709000 [    8K] r-x/rwx SM=COW    [/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent]

Application Specific Information:
objc_msgSend() selector name: stopRequestingMediaData
Bundle controller class:
BrowserBundleController
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib               	0x00007fff6e424e9d objc_msgSend + 29
1   com.apple.WebCore             	0x00007fff554c01b6 invocation function for block in WebCore::MediaPlayerPrivateMediaStreamAVFObjC::requestNotificationWhenReadyForVideoData() + 38
2   com.apple.avfoundation        	0x00007fff439df9d5 -[AVMediaDataRequester _requestMediaDataIfReady] + 106
3   libdispatch.dylib             	0x00007fff6eff0591 _dispatch_call_block_and_release + 12
4   libdispatch.dylib             	0x00007fff6efe8d50 _dispatch_client_callout + 8
5   libdispatch.dylib             	0x00007fff6eff432d _dispatch_main_queue_callback_4CF + 1148
6   com.apple.CoreFoundation      	0x00007fff4774d929 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 9
7   com.apple.CoreFoundation      	0x00007fff4770fbea __CFRunLoopRun + 2586
8   com.apple.CoreFoundation      	0x00007fff4770ef43 CFRunLoopRunSpecific + 483
9   com.apple.HIToolbox           	0x00007fff46a26e26 RunCurrentEventLoopInMode + 286
10  com.apple.HIToolbox           	0x00007fff46a26b96 ReceiveNextEventCommon + 613
11  com.apple.HIToolbox           	0x00007fff46a26914 _BlockUntilNextEventMatchingListInModeWithFilter + 64
12  com.apple.AppKit              	0x00007fff44cf1f5f _DPSNextEvent + 2085
13  com.apple.AppKit              	0x00007fff45487b4c -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044
14  com.apple.AppKit              	0x00007fff44ce6d6d -[NSApplication run] + 764
15  com.apple.AppKit              	0x00007fff44cb5f1a NSApplicationMain + 804
16  libxpc.dylib                  	0x00007fff6f2ef42f _xpc_objc_main + 580
17  libxpc.dylib                  	0x00007fff6f2ee082 xpc_main + 417
18  com.apple.WebKit.WebContent   	0x00000001027086a1 0x102707000 + 5793
19  libdyld.dylib                 	0x00007fff6f022115 start + 1