Bug 265008 – [MSE] CrashTracer: com.apple.WebKit.GPU at com.apple.WebCore: std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::Medi......

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Jean-Yves Avenard [:jya]]

crashtrace:
```
      5 unsigned int std::__1::__cxx_atomic_fetch_add[abi:v160006]<unsigned int>(std::__1::__cxx_atomic_base_impl<unsigned int>*, unsigned int, std::__1::memory_order) <==
        5 std::__1::__atomic_base<unsigned int, true>::fetch_add[abi:v160006](unsigned int, std::__1::memory_order)
          5 std::__1::__atomic_base<unsigned int, true>::operator++[abi:v160006]()
            5 WTF::ThreadSafeRefCountedBase::ref() const
              5 WTF::DefaultRefDerefTraits<WebCore::MediaSample>::refIfNotNull(WebCore::MediaSample*)
                5 WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>::RefPtr(WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>> const&)
                  5 WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>::RefPtr(WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>> const&)
                    5 std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>::pair(std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                      5 std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>::pair(std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                        5 std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>* std::__1::construct_at[abi:v160006]<std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>*>(std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>*, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                          5 void std::__1::allocator_traits<WTF::FastAllocator<std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>>>::construct[abi:v160006]<std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&, void, void>(WTF::FastAllocator<std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>>&, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>*, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                            5 std::__1::unique_ptr<std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>, std::__1::__tree_node_destructor<WTF::FastAllocator<std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>>>> std::__1::__tree<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__map_value_compare<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::less<std::__1::pair<WTF::MediaTime, WTF::MediaTime>>, true>, WTF::FastAllocator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>>>::__construct_node<std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&>(std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                              5 std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>, bool> std::__1::__tree<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__map_value_compare<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::less<std::__1::pair<WTF::MediaTime, WTF::MediaTime>>, true>, WTF::FastAllocator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>>>::__emplace_hint_unique_key_args<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&>(std::__1::__tree_const_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>, std::__1::pair<WTF::MediaTime, WTF::MediaTime> const&, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                                5 std::__1::__tree<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__map_value_compare<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::less<std::__1::pair<WTF::MediaTime, WTF::MediaTime>>, true>, WTF::FastAllocator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>>>::__insert_unique[abi:v160006](std::__1::__tree_const_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>> const&)
                                  5 std::__1::__map_iterator<std::__1::__tree_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>> std::__1::map<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>, std::__1::less<std::__1::pair<WTF::MediaTime, WTF::MediaTime>>, WTF::FastAllocator<std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>>>::insert[abi:v160006]<std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>&, void>(std::__1::__map_const_iterator<std::__1::__tree_const_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>>, std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>&)
                                    5 void std::__1::map<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>, std::__1::less<std::__1::pair<WTF::MediaTime, WTF::MediaTime>>, WTF::FastAllocator<std::__1::pair<std::__1::pair<WTF::MediaTime, WTF::MediaTime> const, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>>>::insert[abi:v160006]<std::__1::__map_iterator<std::__1::__tree_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>>>(std::__1::__map_iterator<std::__1::__tree_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>>, std::__1::__map_iterator<std::__1::__tree_iterator<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, std::__1::__tree_node<std::__1::__value_type<std::__1::pair<WTF::MediaTime, WTF::MediaTime>, WTF::RefPtr<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>, WTF::DefaultRefDerefTraits<WebCore::MediaSample>>>, void*>*, long>>)
                                      5 WebCore::SourceBufferPrivate::processMediaSample(WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>&&)
                                        5 WebCore::SourceBufferPrivate::processMediaSamplesOperation(WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&)
                                          5 WebCore::SourceBufferPrivate::processPendingOperations()::$_12::operator()(WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&) const
                                            5 decltype(std::declval<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>()(std::declval<WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>())) std::__1::__invoke[abi:v160006]<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>(WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>&&, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&)
                                              5 decltype(auto) std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>::operator()[abi:v160006]<std::__1::__variant_detail::__alt<2ul, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>>(std::__1::__variant_detail::__alt<2ul, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>&&) const
                                                5 decltype(std::declval<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>>()(std::declval<std::__1::__variant_detail::__alt<2ul, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>>())) std::__1::__invoke[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>, std::__1::__variant_detail::__alt<2ul, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>>(std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>&&, std::__1::__variant_detail::__alt<2ul, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>>&&)
                                                  5 decltype(auto) std::__1::__variant_detail::__visitation::__base::__dispatcher<2ul>::__dispatch[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>&&, std::__1::__variant_detail::__base<(std::__1::__variant_detail::_Trait)1, WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>&&>(std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>&&, std::__1::__variant_detail::__base<(std::__1::__variant_detail::_Trait)1, WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>&&)
                                                    5 decltype(auto) std::__1::__variant_detail::__visitation::__base::__visit_alt[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>, std::__1::__variant_detail::__impl<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>>(std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>&&, std::__1::__variant_detail::__impl<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>&&)
                                                      5 decltype(auto) std::__1::__variant_detail::__visitation::__variant::__visit_alt[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>, std::__1::variant<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>>(std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>>&&, std::__1::variant<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>&&)
                                                        5 decltype(auto) std::__1::__variant_detail::__visitation::__variant::__visit_value[abi:v160006]<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>, std::__1::variant<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>>(WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>&&, std::__1::variant<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>&&)
                                                          5 decltype(auto) std::__1::visit[abi:v160006]<WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>, std::__1::variant<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>, void>(WTF::Visitor<WebCore::SourceBufferPrivate::processPendingOperations()::$_11, WebCore::SourceBufferPrivate::processPendingOperations()::$_12, WebCore::SourceBufferPrivate::processPendingOperations()::$_13, WebCore::SourceBufferPrivate::processPendingOperations()::$_14, WebCore::SourceBufferPrivate::processPendingOperations()::$_15, WebCore::SourceBufferPrivate::processPendingOperations()::$_16>&&, std::__1::variant<WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>, WebCore::SourceBufferPrivate::InitOperation, WTF::Vector<WTF::Ref<WebCore::MediaSample, WTF::RawPtrTraits<WebCore::MediaSample>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::SourceBufferPrivate::ResetParserOperation, WebCore::SourceBufferPrivate::AppendCompletedOperation, WebCore::SourceBufferPrivate::ErrorOperation>&&)
                                                            5 WebCore::SourceBufferPrivate::processPendingOperations()
                                                              5 WebCore::SourceBufferPrivate::appendCompleted(bool, bool, WTF::Function<void ()>&&)
                                                                5 WebCore::SourceBufferPrivateAVFObjC::appendCompleted()
                                                                  5 WebCore::SourceBufferPrivateAVFObjC::appendInternal(WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>&&)::$_18::operator()()::'lambda'()::operator()()::'lambda'()::operator()() const
                                                                    5 WTF::Detail::CallableWrapper<WebCore::SourceBufferPrivateAVFObjC::appendInternal(WTF::Ref<WebCore::SharedBuffer, WTF::RawPtrTraits<WebCore::SharedBuffer>>&&)::$_18::operator()()::'lambda'()::operator()()::'lambda'(), void>::call()
                                                                      5 WTF::Function<void ()>::operator()() const
                                                                        5 WTF::RunLoop::performWork()
                                                                          5 WTF::RunLoop::performWork(void*)
                                                                            5 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
                                                                              5 __CFRunLoopDoSource0
                                                                                5 __CFRunLoopDoSources0
                                                                                  5 __CFRunLoopRun
                                                                                    5 CFRunLoopRunSpecific
                                                                                      5 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
                                                                                        5 -[NSRunLoop(NSRunLoop) run]
                                                                                          5 _xpc_objc_main
                                                                                            5 _xpc_main
                                                                                              5 xpc_main
                                                                                                5 WebKit::XPCServiceMain(int, char const**)
                                                                                                  5 start
```

While this signature is new (processOperations was added in March 2023), where the crash occurs isn’t 
```
    if (range.first != trackBuffer.samples().presentationOrder().end())
        erasedSamples.addRange(range.first, range.second);
```


It looks that when this code ran, the track buffer content was modified, which can happen under two conditions:
1- SourceBufferPrivate::removeCodedFrames code run before an append operation completed
2- SourceBufferPrivate::memoryPressure happened while an append got fixed.

1 typically is very unlikely to happen, as the only possible scenario would be for the web player to do something like sourceBuffer.appendBuffer(); /* some time later */ sourceBuffer.abort(); sourceBuffer.removeCodedFrames(); . While the likelihood is low, it is possible.

2- is however quite likely and I noticed this problem while working on rdar://118429088 (somehow the bit about fly-by fix got lost during my rebase). It was possible for the memoryPressure operation to run while the appendBuffer operation was ongoing. In rdar://118429088 this was fixed. memoryPressure is added as a task to the queue and will occur once the append has completed.

So I believe this bug is primarily fixed by bug 264854

[Jean-Yves Avenard [:jya]]

rdar://116953621

[Jean-Yves Avenard [:jya]]

Pull request: https://github.com/WebKit/WebKit/pull/20652

[EWS]

Committed 270929@main (c54dbe8ebd21): <https://commits.webkit.org/270929@main>

Reviewed commits have been landed. Closing PR #20652 and removing active labels.