Bug 228725 – REGRESSION (r280374): ASSERTION FAILED: Completion handler should not be called more than once under WebCore::MediaControlsContextMenuProvider::contextMenuItemSelected

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Ryan Haddad]

Created attachment 434804 [details]
crash log

media/modern-media-controls/tracks-support/click-track-in-contextmenu.html appears to be flakily asserting with the following backtrace on macOS bots:

ASSERTION FAILED: Completion handler should not be called more than once
m_function
/Volumes/Data/worker/bigsur-debug/build/WebKitBuild/Debug/usr/local/include/wtf/CompletionHandler.h(66) : Out WTF::CompletionHandler<void (unsigned long long)>::operator()(In...)
1   0x3bd3cd879 WTFCrash
2   0x39d06953b WTF::CompletionHandler<void (unsigned long long)>::operator()(unsigned long long)
3   0x39d068031 WebCore::MediaControlsContextMenuProvider::contextMenuItemSelected(WebCore::ContextMenuAction, WTF::String const&)
4   0x39ef698f3 WebCore::ContextMenuController::contextMenuItemSelected(WebCore::ContextMenuAction, WTF::String const&)
5   0x38a15acca WebKit::WebContextMenu::itemSelected(WebKit::WebContextMenuItemData const&)
6   0x38a37f2cd WebKit::WebPage::didSelectItemFromActiveContextMenu(WebKit::WebContextMenuItemData const&)
7   0x38a452500 void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebContextMenuItemData const&), std::__1::tuple<WebKit::WebContextMenuItemData>, 0ul>(WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebContextMenuItemData const&), std::__1::tuple<WebKit::WebContextMenuItemData>&&, std::__1::integer_sequence<unsigned long, 0ul>)
8   0x38a451840 void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebContextMenuItemData const&), std::__1::tuple<WebKit::WebContextMenuItemData>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebKit::WebContextMenuItemData>&&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebContextMenuItemData const&))
9   0x38a3f11e5 void IPC::handleMessage<Messages::WebPage::DidSelectItemFromActiveContextMenu, WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebContextMenuItemData const&)>(IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebContextMenuItemData const&))
10  0x38a3e6b82 WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&)
11  0x38a38032e WebKit::WebPage::didReceiveMessage(IPC::Connection&, IPC::Decoder&)
12  0x38859ba65 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&)
13  0x389c9d5f7 WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&)
14  0x38808fd84 IPC::Connection::dispatchMessage(IPC::Decoder&)
15  0x38809054f IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)
16  0x388090bb0 IPC::Connection::dispatchOneIncomingMessage()
17  0x3880b1e08 IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_12::operator()()
18  0x3880b1cfe WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_12, void>::call()
19  0x3bd3fb312 WTF::Function<void ()>::operator()() const
20  0x3bd486120 WTF::RunLoop::performWork()
21  0x3bd48ab51 WTF::RunLoop::performWork(void*)
22  0x7fff2067c97c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
23  0x7fff2067c8e4 __CFRunLoopDoSource0
24  0x7fff2067c664 __CFRunLoopDoSources0
25  0x7fff2067b08c __CFRunLoopRun
26  0x7fff2067a64c CFRunLoopRunSpecific
27  0x7fff21408647 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
28  0x7fff21496511 -[NSRunLoop(NSRunLoop) run]
29  0x7fff202d238d _xpc_objc_main
30  0x7fff202d1cd3 xpc_main
31  0x388ef7415 WebKit::XPCServiceMain(int, char const**)
com.apple.WebKit.WebContent.Development terminated (pid 55556) because the process crashed
LEAK: 2 WebPageProxy

https://results.webkit.org/?suite=layout-tests&test=media%2Fmodern-media-controls%2Ftracks-support%2Fclick-track-in-contextmenu.html

[Ryan Haddad]

It looks like this started with https://trac.webkit.org/changeset/280374/webkit

[Radar WebKit Bug Importer]

<rdar://problem/81437221>

[Devin Rousso]

Created attachment 434946 [details]
Patch

[Devin Rousso]

Created attachment 434950 [details]
Patch

oops `MediaControlsContextMenuProvider::didDismissContextMenu` isn't supposed to `std::exchange`, as that's kinda the whole point of this patch 😅

[EWS]

Committed r280676 (240278@main): <https://commits.webkit.org/240278@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 434950 [details].