Bug 233352 - HTMLTrackElement is not always kept alive until HTMLTrackElement::didCompleteLoad is called
Summary: HTMLTrackElement is not always kept alive until HTMLTrackElement::didComplete...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-11-18 23:03 PST by youenn fablet
Modified: 2021-11-25 23:04 PST (History)
4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description youenn fablet 2021-11-18 23:03:51 PST 
From https://ews-build.s3-us-west-2.amazonaws.com/macOS-Catalina-Debug-WK1-Tests-EWS/r444685-20219/media/track/track-id-crash-log.txt
Application Specific Information:
CRASHING TEST: media/track/track-id.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000114cdcd1e WTFCrash + 14 (Assertions.cpp:322)
1   com.apple.WebCore             	0x0000000136ba5d8b WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   com.apple.WebCore             	0x00000001398104f8 WebCore::JSEventListener::ensureJSFunction(WebCore::ScriptExecutionContext&) const + 632
3   com.apple.WebCore             	0x000000013980f7f4 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 212
4   com.apple.WebCore             	0x000000013a0847c7 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 1063
5   com.apple.WebCore             	0x000000013a084224 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 356
6   com.apple.WebCore             	0x000000013a05811a WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const + 938
7   com.apple.WebCore             	0x000000013a07ad05 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 149
8   com.apple.WebCore             	0x000000013a07a57e WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 1134
9   com.apple.WebCore             	0x000000013a11211d WebCore::Node::dispatchEvent(WebCore::Event&) + 29
10  com.apple.WebCore             	0x000000013a5af127 WebCore::HTMLTrackElement::didCompleteLoad(WebCore::HTMLTrackElement::LoadStatus) + 135
11  com.apple.WebCore             	0x000000013a7dce35 WebCore::LoadableTextTrack::scheduleLoad(WTF::URL const&)::$_1::operator()() + 309
12  com.apple.WebCore             	0x000000013a7dccae WTF::Detail::CallableWrapper<WebCore::LoadableTextTrack::scheduleLoad(WTF::URL const&)::$_1, void>::call() + 30
13  com.apple.WebCore             	0x0000000136bbec92 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
14  com.apple.WebCore             	0x000000013a5bbb75 WebCore::HTMLTrackElement::scheduleTask(WTF::Function<void ()>&&)::$_3::operator()() + 21
15  com.apple.WebCore             	0x000000013a5bbaae WTF::Detail::CallableWrapper<WebCore::HTMLTrackElement::scheduleTask(WTF::Function<void ()>&&)::$_3, void>::call() + 30
16  com.apple.WebCore             	0x0000000136bbec92 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
17  com.apple.WebCore             	0x000000013a5bb2ce void WebCore::ActiveDOMObject::queueTaskKeepingObjectAlive<WebCore::HTMLTrackElement>(WebCore::HTMLTrackElement&, WebCore::TaskSource, WTF::Function<void ()>&&)::'lambda'()::operator()() const + 30
18  com.apple.WebCore             	0x000000013a5baf1e WTF::Detail::CallableWrapper<void WebCore::ActiveDOMObject::queueTaskKeepingObjectAlive<WebCore::HTMLTrackElement>(WebCore::HTMLTrackElement&, WebCore::TaskSource, WTF::Function<void ()>&&)::'lambda'(), void>::call() + 30
19  com.apple.WebCore             	0x0000000136bbec92 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
20  com.apple.WebCore             	0x000000013a08844e WebCore::EventLoopFunctionDispatchTask::execute() + 30
21  com.apple.WebCore             	0x000000013a07dc05 WebCore::EventLoop::run() + 373
Comment 1 youenn fablet 2021-11-18 23:06:26 PST 
One possibility is that HTMLTrackElement::textTrackModeChanged is calling scheduleLoad and TextTrack was GCed before as it readyState was None.
Comment 2 Radar WebKit Bug Importer 2021-11-25 23:04:19 PST 
<rdar://problem/85760489>