Bug 283104 – REGRESSION(286527@main): [GStreamer][WebRTC] Triggers consistent crash in webrtc/utf8-sdp.html

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Philippe Normand]

Thread 1 (Thread 0x7f4be369b980 (LWP 757130)):
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007f4bf16a3e83 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
#2  0x00007f4bf1651dce in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f4bf163983f in __GI_abort () at abort.c:79
#4  0x00007f4bfc3b4f73 in  () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#5  0x00007f4bfc3b6610 in WTF::Detail::CallableWrapper<WebCore::MediaPlayerPrivateGStreamer::handleStreamCollectionMessage(_GstMessage*)::{lambda()#1}, void>::call() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#6  0x00007f4bfc39b079 in WebCore::MediaPlayerPrivateGStreamer::handleStreamCollectionMessage(_GstMessage*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#7  0x00007f4bf153063a in g_cclosure_marshal_VOID__BOXEDv (closure=0x56401e887a60, return_value=<optimized out>, instance=0x56401e7be700, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56401a5c1080) at ../gobject/gmarshal.c:1686
#8  0x00007f4bf154ca83 in _g_closure_invoke_va (param_types=0x56401a5c1080, n_params=<optimized out>, args=0x7ffe125e2f70, instance=0x56401e7be700, return_value=<optimized out>, closure=<optimized out>) at ../gobject/gclosure.c:895
#9  g_signal_emit_valist (instance=<optimized out>, signal_id=16, detail=<optimized out>, var_args=var_args@entry=0x7ffe125e2f70) at ../gobject/gsignal.c:3472
#10 0x00007f4bf154cc03 in g_signal_emit (instance=instance@entry=0x56401e7be700, signal_id=<optimized out>, detail=<optimized out>) at ../gobject/gsignal.c:3622
#11 0x00007f4bf1c15b5b in gst_bus_sync_signal_handler (bus=bus@entry=0x56401e7be700 [GstBus|bus142], message=message@entry=0x56401e8ad9b0, data=data@entry=0x0) at ../gst/gstbus.c:1306
#12 0x00007f4bf1c15e9d in gst_bus_post (bus=0x56401e7be700 [GstBus|bus142], message=0x56401e8ad9b0) at ../gst/gstbus.c:365
#13 0x00007f4bf1c2a017 in gst_element_post_message_default (element=element@entry=0x56401e7be100 [GstElement|mediastream-video-0], message=0x56401e8ad9b0) at ../gst/gstelement.c:2127
#14 0x00007f4bf1c085b3 in gst_bin_post_message (element=0x56401e7be100 [GstElement|mediastream-video-0], msg=0x56401e8ad9b0) at ../gst/gstbin.c:2789
#15 0x00007f4bf1c279c7 in gst_element_post_message (element=0x56401e7be100 [GstElement|mediastream-video-0], message=0x56401e8ad9b0) at ../gst/gstelement.c:2170
#16 0x00007f4bf1bfe58c in bin_bus_handler (bus=<optimized out>, message=<optimized out>, bin=<optimized out>) at ../gst/gstbin.c:3263
#17 0x00007f4bf1c15c8b in gst_bus_post (bus=0x56401e7be490 [GstBus|bus141], message=0x56401e8ad9b0) at ../gst/gstbus.c:358
#18 0x00007f4bf1c2a017 in gst_element_post_message_default (element=element@entry=0x56401e7bfe00 [GstElement|uridecodebin3], message=0x56401e8ad9b0) at ../gst/gstelement.c:2127
#19 0x00007f4bf1c085b3 in gst_bin_post_message (element=0x56401e7bfe00 [GstElement|uridecodebin3], msg=0x56401e8ad9b0) at ../gst/gstbin.c:2789
#20 0x00007f4bf1c279c7 in gst_element_post_message (element=0x56401e7bfe00 [GstElement|uridecodebin3], message=0x56401e8ad9b0) at ../gst/gstelement.c:2170
#21 0x00007f4bf1bfe58c in bin_bus_handler (bus=<optimized out>, message=<optimized out>, bin=<optimized out>) at ../gst/gstbin.c:3263
#22 0x00007f4bf1c15c8b in gst_bus_post (bus=0x56401e7c00d0 [GstBus|bus143], message=0x56401e8ad9b0) at ../gst/gstbus.c:358
#23 0x00007f4bf1c2a017 in gst_element_post_message_default (element=element@entry=0x56401e8b4940 [GstElement|urisourcebin0], message=0x56401e8ad9b0) at ../gst/gstelement.c:2127
#24 0x00007f4bf1c085b3 in gst_bin_post_message (element=0x56401e8b4940 [GstElement|urisourcebin0], msg=0x56401e8ad9b0) at ../gst/gstbin.c:2789
#25 0x00007f4bf1c279c7 in gst_element_post_message (element=0x56401e8b4940 [GstElement|urisourcebin0], message=0x56401e8ad9b0) at ../gst/gstelement.c:2170
#26 0x00007f4bf1bfe58c in bin_bus_handler (bus=<optimized out>, message=<optimized out>, bin=<optimized out>) at ../gst/gstbin.c:3263
#27 0x00007f4bf1c15c8b in gst_bus_post (bus=0x56401e8b1460 [GstBus|bus149], message=0x56401e8ad9b0) at ../gst/gstbus.c:358
#28 0x00007f4bf1c2a017 in gst_element_post_message_default (element=element@entry=0x56401e8adce0 [GstElement|webkitmediastreamsrc2], message=0x56401e8ad9b0) at ../gst/gstelement.c:2127
#29 0x00007f4bf1c085b3 in gst_bin_post_message (element=0x56401e8adce0 [GstElement|webkitmediastreamsrc2], msg=0x56401e8ad9b0) at ../gst/gstbin.c:2789
#30 0x00007f4bf1c279c7 in gst_element_post_message (element=0x56401e8adce0 [GstElement|webkitmediastreamsrc2], message=0x56401e8ad9b0) at ../gst/gstelement.c:2170
#31 0x00007f4bfc4b977a in WTF::Detail::CallableWrapper<webkitMediaStreamSrcEnsureStreamCollectionPosted(_WebKitMediaStreamSrc*)::{lambda()#1}, void>::call() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#32 0x00007f4bfc4b7702 in webkitMediaStreamSrcEnsureStreamCollectionPosted(_WebKitMediaStreamSrc*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#33 0x00007f4bfc4c312a in webkitMediaStreamSrcSetStream(_WebKitMediaStreamSrc*, WebCore::MediaStreamPrivate*, bool) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#34 0x00007f4bfc39ef90 in WebCore::MediaPlayerPrivateGStreamer::sourceSetup(_GstElement*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#35 0x00007f4bf152af67 in g_cclosure_marshal_VOID__OBJECTv (closure=0x56401e887c40, return_value=<optimized out>, instance=0x56401e7be100, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56401e7b2580) at ../gobject/gmarshal.c:1910
#36 0x00007f4bf154ca83 in _g_closure_invoke_va (param_types=0x56401e7b2580, n_params=<optimized out>, args=0x7ffe125e3730, instance=0x56401e7be100, return_value=<optimized out>, closure=<optimized out>) at ../gobject/gclosure.c:895
#37 g_signal_emit_valist (instance=<optimized out>, signal_id=192, detail=<optimized out>, var_args=var_args@entry=0x7ffe125e3730) at ../gobject/gsignal.c:3472
#38 0x00007f4bf154cc03 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../gobject/gsignal.c:3622
#39 0x00007f4bf152af67 in g_cclosure_marshal_VOID__OBJECTv (closure=0x56401e884110, return_value=<optimized out>, instance=0x56401e7bfe00, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56401e7bda90) at ../gobject/gmarshal.c:1910
#40 0x00007f4bf154ca83 in _g_closure_invoke_va (param_types=0x56401e7bda90, n_params=<optimized out>, args=0x7ffe125e39f0, instance=0x56401e7bfe00, return_value=<optimized out>, closure=<optimized out>) at ../gobject/gclosure.c:895
#41 g_signal_emit_valist (instance=<optimized out>, signal_id=196, detail=<optimized out>, var_args=var_args@entry=0x7ffe125e39f0) at ../gobject/gsignal.c:3472
#42 0x00007f4bf154cc03 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../gobject/gsignal.c:3622
#43 0x00007f4bf152af67 in g_cclosure_marshal_VOID__OBJECTv (closure=0x56401e8b05c0, return_value=<optimized out>, instance=0x56401e8b4940, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56401e8ab550) at ../gobject/gmarshal.c:1910
#44 0x00007f4bf154ca83 in _g_closure_invoke_va (param_types=0x56401e8ab550, n_params=<optimized out>, args=0x7ffe125e3cb0, instance=0x56401e8b4940, return_value=<optimized out>, closure=<optimized out>) at ../gobject/gclosure.c:895
#45 g_signal_emit_valist (instance=<optimized out>, signal_id=204, detail=<optimized out>, var_args=var_args@entry=0x7ffe125e3cb0) at ../gobject/gsignal.c:3472
#46 0x00007f4bf154cc03 in g_signal_emit (instance=instance@entry=0x56401e8b4940, signal_id=<optimized out>, detail=detail@entry=0) at ../gobject/gsignal.c:3622
#47 0x00007f4b140dac0a in setup_source (urisrc=<optimized out>) at ../gst/playback/gsturisourcebin.c:2511
#48 gst_uri_source_bin_change_state (element=0x56401e8b4940 [GstElement|urisourcebin0], transition=<optimized out>) at ../gst/playback/gsturisourcebin.c:3387
#49 0x00007f4bf1c2fd74 in gst_element_change_state (element=element@entry=0x56401e8b4940 [GstElement|urisourcebin0], transition=GST_STATE_CHANGE_READY_TO_PAUSED) at ../gst/gstelement.c:3101
#50 0x00007f4bf1c302e1 in gst_element_continue_state (element=element@entry=0x56401e8b4940 [GstElement|urisourcebin0], ret=ret@entry=GST_STATE_CHANGE_SUCCESS) at ../gst/gstelement.c:2809
#51 0x00007f4bf1c2fdb8 in gst_element_change_state (element=element@entry=0x56401e8b4940 [GstElement|urisourcebin0], transition=transition@entry=GST_STATE_CHANGE_NULL_TO_READY) at ../gst/gstelement.c:3140
#52 0x00007f4bf1c30629 in gst_element_set_state_func (element=0x56401e8b4940 [GstElement|urisourcebin0], state=GST_STATE_PAUSED) at ../gst/gstelement.c:3055
#53 0x00007f4bf1c2f41f in gst_element_sync_state_with_parent (element=0x56401e8b4940 [GstElement|urisourcebin0]) at ../gst/gstelement.c:2473
#54 0x00007f4b1411c7bc in activate_source_item.isra.0 (item=<optimized out>) at ../gst/playback/gsturidecodebin3.c:978
#55 0x00007f4b140cffee in assign_handlers_to_item (item=0x56401e4ca550, dec=<optimized out>) at ../gst/playback/gsturidecodebin3.c:2038
#56 activate_play_item (item=0x56401e4ca550) at ../gst/playback/gsturidecodebin3.c:2057
#57 0x00007f4b140d016c in gst_uri_decode_bin3_change_state (element=0x56401e7bfe00 [GstElement|uridecodebin3], transition=<optimized out>) at ../gst/playback/gsturidecodebin3.c:2097
#58 0x00007f4bf1c2fd74 in gst_element_change_state (element=element@entry=0x56401e7bfe00 [GstElement|uridecodebin3], transition=transition@entry=GST_STATE_CHANGE_READY_TO_PAUSED) at ../gst/gstelement.c:3101
#59 0x00007f4bf1c30629 in gst_element_set_state_func (element=0x56401e7bfe00 [GstElement|uridecodebin3], state=GST_STATE_PAUSED) at ../gst/gstelement.c:3055
#60 0x00007f4bf1c07608 in gst_bin_element_set_state (next=<optimized out>, current=<optimized out>, start_time=18446744073709551615 [99:99:99.999999999], base_time=0 [0:00:00.000000000], element=0x56401e7bfe00 [GstElement|uridecodebin3], bin=<optimized out>) at ../gst/gstbin.c:2582
#61 gst_bin_change_state_func (element=0x56401e7be100 [GstElement|mediastream-video-0], transition=GST_STATE_CHANGE_READY_TO_PAUSED) at ../gst/gstbin.c:2934
#62 0x00007f4bf1c5b63f in gst_pipeline_change_state (element=0x56401e7be100 [GstElement|mediastream-video-0], transition=GST_STATE_CHANGE_READY_TO_PAUSED) at ../gst/gstpipeline.c:534
#63 0x00007f4b14104f79 in gst_play_bin3_change_state (element=0x56401e7be100 [GstElement|mediastream-video-0], transition=<optimized out>) at ../gst/playback/gstplaybin3.c:2723
#64 0x00007f4bf1c2fd74 in gst_element_change_state (element=element@entry=0x56401e7be100 [GstElement|mediastream-video-0], transition=GST_STATE_CHANGE_READY_TO_PAUSED) at ../gst/gstelement.c:3101
#65 0x00007f4bf1c302e1 in gst_element_continue_state (element=element@entry=0x56401e7be100 [GstElement|mediastream-video-0], ret=ret@entry=GST_STATE_CHANGE_SUCCESS) at ../gst/gstelement.c:2809
#66 0x00007f4bf1c2fdb8 in gst_element_change_state (element=element@entry=0x56401e7be100 [GstElement|mediastream-video-0], transition=transition@entry=GST_STATE_CHANGE_NULL_TO_READY) at ../gst/gstelement.c:3140
#67 0x00007f4bf1c30629 in gst_element_set_state_func (element=0x56401e7be100 [GstElement|mediastream-video-0], state=GST_STATE_PAUSED) at ../gst/gstelement.c:3055
#68 0x00007f4bfc39f104 in WebCore::MediaPlayerPrivateGStreamer::changePipelineState(GstState) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#69 0x00007f4bfc39f342 in WebCore::MediaPlayerPrivateGStreamer::commitLoad() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#70 0x00007f4bfc3b9320 in WebCore::MediaPlayerPrivateGStreamer::load(WTF::String const&) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#71 0x00007f4bfc3b24ab in WebCore::MediaPlayerPrivateGStreamer::load(WebCore::MediaStreamPrivate&) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#72 0x00007f4bfc2b2944 in WebCore::MediaPlayer::loadWithNextMediaEngine(WebCore::MediaPlayerFactory const*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#73 0x00007f4bfc2bbd6a in WebCore::MediaPlayer::load(WebCore::MediaStreamPrivate&) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#74 0x00007f4bfb9be6e8 in WebCore::HTMLMediaElement::loadResource(WTF::URL const&, WebCore::ContentType const&, WTF::String const&) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#75 0x00007f4bfb9bfbe8 in WebCore::HTMLMediaElement::selectMediaResource()::{lambda()#1}::operator()() const () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#76 0x00007f4bfb624150 in WebCore::EventLoop::run(std::optional<WTF::ApproximateTime>) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#77 0x00007f4bfb733400 in WebCore::WindowEventLoop::didReachTimeToRun() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#78 0x00007f4bfb733285 in WTF::Detail::CallableWrapper<WebCore::Timer::Timer<WebCore::WindowEventLoop, WebCore::WindowEventLoop>(WebCore::WindowEventLoop&, void (WebCore::WindowEventLoop::*)())::{lambda()#1}, void>::call() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#79 0x00007f4bfc179a5b in WebCore::ThreadTimers::sharedTimerFiredInternal() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#80 0x00007f4bf9392c55 in WTF::RunLoop::TimerBase::TimerBase(WTF::Ref<WTF::RunLoop, WTF::RawPtrTraits<WTF::RunLoop>, WTF::DefaultRefDerefTraits<WTF::RunLoop> >&&)::{lambda(void*)#1}::_FUN(void*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#81 0x00007f4bf939369f in WTF::RunLoop::{lambda(_GSource*, int (*)(void*), void*)#1}::_FUN(_GSource*, int (*)(void*), void*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#82 0x00007f4bf1e37d36 in g_main_dispatch (context=0x56401a592ea0) at ../glib/gmain.c:3460
#83 g_main_context_dispatch (context=0x56401a592ea0) at ../glib/gmain.c:4200
#84 0x00007f4bf1e952b8 in g_main_context_iterate.isra.0 (context=0x56401a592ea0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4276
#85 0x00007f4bf1e373ff in g_main_loop_run (loop=0x56401a592fe0) at ../glib/gmain.c:4479
#86 0x00007f4bf93937d0 in WTF::RunLoop::run() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#87 0x00007f4bf755972f in int WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainWPE>(int, char**) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#88 0x00007f4bf163b08a in __libc_start_call_main (main=main@entry=0x56401a3f78b0 <main>, argc=argc@entry=5, argv=argv@entry=0x7ffe125e4d58) at ../sysdeps/nptl/libc_start_call_main.h:58
#89 0x00007f4bf163b14b in __libc_start_main_impl (main=0x56401a3f78b0 <main>, argc=5, argv=0x7ffe125e4d58, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffe125e4d48) at ../csu/libc-start.c:360
#90 0x000056401a3f77e5 in _start () at ../sysdeps/x86_64/start.S:115

[Philippe Normand]

I've got the same crash (I think) in my branch switching all playback to playbin3, the issue is that getStreamIdFromStream() returns nullopt and we don't check it in updateTracks().

The GstStream in my test is for an MP3 audio track:

-> stream audio 0x7f18a003c010, ID f54120c84a193e4cc248617b304408950c56fd6ad0c239bb61c60a671191401f, flags 0x0, caps [audio/mpeg, mpegversion=(int)1, mpegaudioversion=(int)2, layer=(int)3, rate=(int)22050, chann
els=(int)1, parsed=(boolean)true], tags [taglist, has-crc=(boolean)false, channel-mode=(string)mono, audio-codec=(string)"MPEG-1\ Layer\ 3\ \(MP3\)", minimum-bitrate=(uint)23887, maximum-bitrate=(uint)159862, bi
trate=(uint)37000;]

[Vivienne Watermeier]

Pull request: https://github.com/WebKit/WebKit/pull/36642

[EWS]

Committed 286598@main (8330471282e8): <https://commits.webkit.org/286598@main>

Reviewed commits have been landed. Closing PR #36642 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/139889146>