Bug 210528 – [GStreamer] media/media-source/media-source-seek-back.html is flaky crashing with 3 kinds of traces

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Lauro Moura]

List of crashes since r259713 (outside this, only 4 times before r253000)

* r259713 - GTK Release X11 build 13249
    * #0  0x00007f5da1d6d243 in gst_gl_upload_transform_caps () at ../../Source/gst-plugins-base-1.16.1/gst-libs/gst/gl/gstglupload.c:1810
        1810      upload_methods[i]->transform_caps (upload->priv->upload_impl[i],
* r259775 - GTK Release X11 build 13257
    * #0  gst_gl_insert_debug_marker () at ../../Source/gst-plugins-base-1.16.1/gst-libs/gst/gl/gstgldebug.c:387
        387       const GstGLFuncs *gl = context->gl_vtable;
* r259819 - GTK Wayland build 11876
    * #0  0x00007f68565ff253 in gst_gl_upload_transform_caps () at ../../Source/gst-plugins-base-1.16.1/gst-libs/gst/gl/gstglupload.c:1810
        1810      upload_methods[i]->transform_caps (upload->priv->upload_impl[i],
* r259928 - GTK Release X11 build 13294
    * #0  gst_gl_insert_debug_marker () at ../../Source/gst-plugins-base-1.16.1/gst-libs/gst/gl/gstgldebug.c:387
        387       const GstGLFuncs *gl = context->gl_vtable;
* r259930 - GTK Release X11 build 13295
    * #0  gst_gl_insert_debug_marker () at ../../Source/gst-plugins-base-1.16.1/gst-libs/gst/gl/gstgldebug.c:387
        387       const GstGLFuncs *gl = context->gl_vtable;
* r259933 - GTK Release X11 build 13297
    * g_object_ref() assertion ref_count < 0 in gst_gl_upload_new()
* r259990 - GTK Wayland build 11914
    * g_object_ref() assertion ref_count < 0 in gst_gl_upload_new()
* r260035 - GTK Wayland build 11925
    * #0  0x00007f78389fa253 in gst_gl_upload_transform_caps () at ../../Source/gst-plugins-base-1.16.1/gst-libs/gst/gl/gstglupload.c:1810
        1810      upload_methods[i]->transform_caps (upload->priv->upload_impl[i],
* r260099 - GTK Release X11 build 13335
    * g_object_ref() assertion ref_count < 0 in gst_gl_upload_new()

This seems similar to other GST-related flaky crashes.

[Diego Pino]

This bug is also happening in WPE (random crashes). For instance:

Crash-log: https://build.webkit.org/results/WPE%20Linux%2064-bit%20Release%20(Tests)/r262962%20(18567)/media/media-source/media-source-seek-back-crash-log.txt

Crash-log: https://build.webkit.org/results/WPE%20Linux%2064-bit%20Release%20(Tests)/r263055%20(18616)/media/media-source/media-source-seek-back-crash-log.txt

In both cases the type of crash was:

STDERR:
STDERR: (WPEWebProcess:15969): GLib-GObject-CRITICAL **: 14:25:45.861: g_object_ref: assertion 'old_val > 0' failed

Thread 1 (Thread 0x7fa24b553700 (LWP 16302)):
#0  0x00007fa30532cee5 in _g_log_abort (breakpoint=1) at ../glib/gmessages.c:554
#1  0x00007fa30532e1c9 in g_logv (log_domain=0x7fa305b192f7 "GLib-GObject", log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, args=args@entry=0x7fa24b54e140) at ../glib/gmessages.c:1373
#2  0x00007fa30532e393 in g_log (log_domain=log_domain@entry=0x7fa305b192f7 "GLib-GObject", log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, format=format@entry=0x7fa30537f77f "%s: assertion '%s' failed") at ../glib/gmessages.c:1415
#3  0x00007fa30532eb8d in g_return_if_fail_warning (log_domain=log_domain@entry=0x7fa305b192f7 "GLib-GObject", pretty_function=pretty_function@entry=0x7fa305b1c978 <__func__.15604> "g_object_ref", expression=expression@entry=0x7fa305b1b715 "old_val > 0") at ../glib/gmessages.c:2771
#4  0x00007fa305aec9fa in g_object_ref (_object=0x7fa23c00f460) at ../gobject/gobject.c:3368
#5  0x00007fa305aec9fa in g_object_ref (_object=0x7fa23c00f460) at ../gobject/gobject.c:3360
#6  0x00007fa305aecb08 in g_value_object_collect_value (value=0x7fa24b54e258, n_collect_values=<optimized out>, collect_values=<optimized out>, collect_flags=<optimized out>) at ../gobject/gobject.c:4007
#7  0x00007fa305233a46 in gst_structure_set_valist_internal (structure=0x7fa23c017160, fieldname=<optimized out>, varargs=varargs@entry=0x7fa24b54e300) at ../gst/gststructure.c:631
#8  0x00007fa305234dc6 in gst_structure_set (structure=structure@entry=0x7fa23c017160, field=field@entry=0x7fa305f9fa19 "context") at ../gst/gststructure.c:663
#9  0x00007fa305f8a8e5 in gst_gl_handle_context_query (element=element@entry=0x55d4d8e60130 [GstGLUploadElement], query=query@entry=0x7fa2402412d0 [GstQuery], display=<optimized out>, gl_context=0x7fa23c00f460 [GstGLContextEGL], other_context=<optimized out>) at ../gst-libs/gst/gl/gstglutils.c:550
#10 0x00007fa305f67b1b in gst_gl_base_filter_query (trans=0x55d4d8e60130 [GstGLUploadElement], direction=GST_PAD_SRC, query=0x7fa2402412d0 [GstQuery]) at ../gst-libs/gst/gl/gstglbasefilter.c:224
#11 0x00007fa305211238 in gst_pad_query (pad=pad@entry=0x7fa23c139630 [GstPad], query=query@entry=0x7fa2402412d0 [GstQuery]) at ../gst/gstpad.c:4072
#12 0x00007fa30521199b in gst_pad_peer_query (pad=pad@entry=0x7fa23c138f40 [GstPad], query=query@entry=0x7fa2402412d0 [GstQuery]) at ../gst/gstpad.c:4204
#13 0x00007fa305f899b6 in pad_query (item=<optimized out>, value=0x7fa24b54e640, user_data=0x7fa2402412d0) at ../gst-libs/gst/gl/gstglutils.c:108
#14 0x00007fa3051ff13c in gst_iterator_fold (it=it@entry=0x7fa258007b20, func=func@entry=0x7fa305f89990 <pad_query>, ret=ret@entry=0x7fa24b54e640, user_data=user_data@entry=0x7fa2402412d0) at ../gst/gstiterator.c:617
#15 0x00007fa305f89b26 in gst_gl_run_query (element=<optimized out>, query=query@entry=0x7fa2402412d0 [GstQuery], direction=direction@entry=GST_PAD_SINK) at ../gst-libs/gst/gl/gstglutils.c:136
#16 0x00007fa305f8aabd in gst_gl_query_local_gl_context (element=0x55d4d8e604a0 [GstGLColorConvertElement], direction=direction@entry=GST_PAD_SINK, context_ptr=context_ptr@entry=0x55d4d8e606e8) at ../gst-libs/gst/gl/gstglutils.c:591
#17 0x00007fa305f6764e in _find_local_gl_context (filter=0x55d4d8e604a0 [GstGLColorConvertElement]) at ../gst-libs/gst/gl/gstglbasefilter.c:197
#18 0x00007fa305f67df5 in gst_gl_base_filter_find_gl_context (filter=0x55d4d8e604a0 [GstGLColorConvertElement]) at ../gst-libs/gst/gl/gstglbasefilter.c:432
#19 0x00007fa2887b24b1 in gst_gl_color_convert_element_transform_caps (bt=0x55d4d8e604a0 [GstGLColorConvertElement], direction=GST_PAD_SRC, caps=0x7fa258065cf0 [GstCaps], filter=0x0) at ../ext/gl/gstglcolorconvertelement.c:145
#20 0x00007fa3061bae71 in gst_base_transform_transform_caps (trans=trans@entry=0x55d4d8e604a0 [GstGLColorConvertElement], direction=GST_PAD_SRC, caps=caps@entry=0x7fa258065cf0 [GstCaps], filter=filter@entry=0x0) at ../libs/gst/base/gstbasetransform.c:474
...

[Diego Pino]

`gst_gl_insert_debug_marker` happening on media/video-src-blob-replay.html.

Crash-log: https://build.webkit.org/results/GTK%20Linux%2064-bit%20Release%20(Tests)/r263193%20(14128)/media/video-src-blob-replay-crash-log.txt

Thread 1 (Thread 0x7fdf3edff700 (LWP 6706)):
#0  0x00007fdfa3499652 in gst_gl_insert_debug_marker (context=0x0 [GstGLContext], format=format@entry=0x7fdfa34c0e82 "starting element %s") at ../gst-libs/gst/gl/gstgldebug.c:387
#1  0x00007fdfa348dcfa in gst_gl_base_filter_gl_start (context=<optimized out>, data=<optimized out>) at ../gst-libs/gst/gl/gstglbasefilter.c:283
#2  0x00007fdfa34b61a7 in _run_message_sync (message=0x7fde767f8f70) at ../gst-libs/gst/gl/gstglwindow.c:573
#3  0x00007fdfa34b6146 in _run_message_async (message=0x55f5324ed720) at ../gst-libs/gst/gl/gstglwindow.c:640
#4  0x00007fdfa2e01c3e in g_main_dispatch (context=0x7fde70093cd0) at ../glib/gmain.c:3309
#5  0x00007fdfa2e01c3e in g_main_context_dispatch (context=context@entry=0x7fde70093cd0) at ../glib/gmain.c:3974
#6  0x00007fdfa2e01ff0 in g_main_context_iterate (context=0x7fde70093cd0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4047
#7  0x00007fdfa2e022e3 in g_main_loop_run (loop=0x7fde70085770) at ../glib/gmain.c:4241
#8  0x00007fdfa34b6239 in gst_gl_window_default_run (window=0x55f53299c100 [GstGLWindowX11|glwindowx11-7]) at ../gst-libs/gst/gl/gstglwindow.c:499
#9  0x00007fdfa34989ef in gst_gl_context_create_thread (context=0x7fde8c02d930 [GstGLContextGLX|glcontextglx7]) at ../gst-libs/gst/gl/gstglcontext.c:1305
#10 0x00007fdfa2e2b761 in g_thread_proxy (data=0x7fde28016b60) at ../glib/gthread.c:807
#11 0x00007fdfa3e7e5e2 in start_thread (arg=<optimized out>) at pthread_create.c:479
#12 0x00007fdfa1b0f473 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

STDERR: Traceback (most recent call last):
STDERR: File "<string>", line 3, in <module>
STDERR: ModuleNotFoundError: No module named 'webkit'
STDERR: /home/slave/.gdbinit:7: Error in sourced command file:
STDERR: Error while executing Python code.
STDERR:
STDERR: warning: core file may not match specified executable file.
STDERR: <empty>

[Diego Pino]

`gst_gl_insert_debug_marker` happening on fast/mediastream/mediastreamtrack-video-frameRate-clone-decreasing.html.

Crash-log: https://build.webkit.org/results/GTK%20Linux%2064-bit%20Release%20(Tests)/r263254%20(14151)/fast/mediastream/mediastreamtrack-video-frameRate-clone-decreasing-crash-log.txt

[Xabier Rodríguez Calvar]

This seems to work now and bots seem happy.

[Xabier Rodríguez Calvar]

Created attachment 425747 [details]
[fast-cq] Patch

[EWS]

Committed r275863 (236428@main): <https://commits.webkit.org/236428@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 425747 [details].

[Radar WebKit Bug Importer]

<rdar://problem/76576033>

[Philippe Normand]

There is this in TestExpectations:

webkit.org/b/210528 fast/mediastream/MediaStream-MediaElement-setObject-null.html [ Crash Pass ]

But that test is 1) consistently passing 2) not linked with this bug.

I will unflag it.

[Philippe Normand]

r278984