Bug 210983 – ASSERTION FAILED: m_wrapper under HTMLMediaElement::setIsPlayingToWirelessTarget

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Chris Dumez]

ASSERTION FAILED: m_wrapper under HTMLMediaElement::setIsPlayingToWirelessTarget:
ASSERTION FAILED: m_wrapper
./bindings/js/JSEventListener.h(123) : JSC::JSObject *WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext &) const
1   0x106bf70b9 WTFCrash
2   0x11d80388b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x11f9be9f8 WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext&) const
4   0x11f9bdd1b WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&)
5   0x12000b87c WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase)
6   0x120007b12 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
7   0x1200834ba WebCore::Node::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
8   0x11fff6180 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const
9   0x11fff6b97 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&)
10  0x11fff6795 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&)
11  0x12008350d WebCore::Node::dispatchEvent(WebCore::Event&)
12  0x1203eeb31 WebCore::HTMLMediaElement::dispatchEvent(WebCore::Event&)
13  0x120426b95 WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)::$_35::operator()() const
14  0x120426999 WTF::Detail::CallableWrapper<WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)::$_35, void>::call()

The issue is that we are trying to fire a JS event as a result of ActiveDOMObject getting called, which is not allowed:
1   0x12799f3a4 WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)
2   0x12799f1bb WebCore::HTMLMediaElement::clearMediaPlayer()
3   0x12799f913 WebCore::HTMLMediaElement::stop()
4   0x12769ddbd auto WebCore::ScriptExecutionContext::stopActiveDOMObjects()::$_9::operator()<WebCore::ActiveDOMObject>(WebCore::ActiveDOMObject&) const
5   0x12769dd73 WTF::Detail::CallableWrapper<WebCore::ScriptExecutionContext::stopActiveDOMObjects()::$_9, WebCore::ScriptExecutionContext::ShouldContinue, WebCore::ActiveDOMObject&>::call(WebCore::ActiveDOMObject&)
6   0x12767c22a WTF::Function<WebCore::ScriptExecutionContext::ShouldContinue (WebCore::ActiveDOMObject&)>::operator()(WebCore::ActiveDOMObject&) const
7   0x12767c080 WebCore::ScriptExecutionContext::forEachActiveDOMObject(WTF::Function<WebCore::ScriptExecutionContext::ShouldContinue (WebCore::ActiveDOMObject&)> const&) const
8   0x12767c487 WebCore::ScriptExecutionContext::stopActiveDOMObjects()
9   0x1274a42ff WebCore::Document::stopActiveDOMObjects()
10  0x1274a40bc WebCore::Document::commonTeardown()
11  0x1274b0253 WebCore::Document::prepareForDestruction()

[Chris Dumez]

<rdar://problem/61611994>

[Chris Dumez]

Created attachment 397481 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 397481 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397481&action=review

> Source/WebCore/ChangeLog:14
> +        No new tests, already covered by:
> +        media/modern-media-controls/placard-support/placard-support-airplay-fullscreen.html

Is there any observable  behavior change here in addition to not running into the GC issue?

[Chris Dumez]

(In reply to Alexey Proskuryakov from comment #3)
> Comment on attachment 397481 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=397481&action=review
> 
> > Source/WebCore/ChangeLog:14
> > +        No new tests, already covered by:
> > +        media/modern-media-controls/placard-support/placard-support-airplay-fullscreen.html
> 
> Is there any observable  behavior change here in addition to not running
> into the GC issue?

No. In release, we would fail to fire the event in this case and return early. In debug we would hit the assertion. Now we don't even try to fire the event so that we no longer hit the assertion in this case. No behavior change since we don't fire the event either way.

[EWS]

Committed r260669: <https://trac.webkit.org/changeset/260669>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 397481 [details].

[Alexey Proskuryakov]

> No. In release, we would fail to fire the event in this case and return
> early. In debug we would hit the assertion. Now we don't even try to fire
> the event so that we no longer hit the assertion in this case. No behavior
> change since we don't fire the event either way.

We would hit the assertion (or return in release) in the case where the wrapper was already GC collected. What about the case where it was not?