Bug 285752 – [GTK][WPE][GStreamer] imported/w3c/web-platform-tests/mediacapture-record/MediaRecorder-mimetype.html flaky crash

• Status: RESOLVED
• Resolution: FIXED
• Component: WPE WebKit

[Philippe Normand]

Program terminated with signal SIGILL, Illegal instruction.
#0  0x00007f87af29b968 in GrResourceCache::notifyARefCntReachedZero(GrGpuResource*, GrIORef<GrGpuResource>::LastRemovedRef) [clone .cold] () from /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2

Thread 1 (Thread 0x7f87a0fd3300 (LWP 624988)):
#0  0x00007f87af29b968 in GrResourceCache::notifyARefCntReachedZero(GrGpuResource*, GrIORef<GrGpuResource>::LastRemovedRef) [clone .cold] () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#1  0x00007f87af2a41f7 in GrTextureProxy::~GrTextureProxy() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#2  0x00007f87af2a4b01 in virtual thunk to GrTextureRenderTargetProxy::~GrTextureRenderTargetProxy() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#3  0x00007f87af2bccfd in skgpu::ganesh::SurfaceFillContext::~SurfaceFillContext() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#4  0x00007f87af2b57fc in skgpu::ganesh::SurfaceContext::readPixels(GrDirectContext*, GrPixmap, SkIPoint) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#5  0x00007f87af24af4b in skgpu::ganesh::Device::onReadPixels(SkPixmap const&, int, int) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#6  0x00007f87ae7d7052 in WebCore::ImageBufferSkiaAcceleratedBackend::getPixelBuffer(WebCore::IntRect const&, WebCore::PixelBuffer&) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#7  0x00007f87ae6746a4 in WebCore::ImageBuffer::getPixelBuffer(WebCore::PixelBufferFormat const&, WebCore::IntRect const&, WebCore::ImageBufferAllocator const&) const () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#8  0x00007f87ade483a3 in WebCore::HTMLCanvasElement::toVideoFrame() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#9  0x00007f87ad311cfd in WebCore::CanvasCaptureMediaStreamTrack::Source::captureCanvas() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#10 0x00007f87ad3129fd in WTF::Detail::CallableWrapper<WebCore::Timer::Timer<WebCore::CanvasCaptureMediaStreamTrack::Source, WebCore::CanvasCaptureMediaStreamTrack::Source>(WebCore::CanvasCaptureMediaStreamTrack::Source&, void (WebCore::CanvasCaptureMediaStreamTrack::Source::*)())::{lambda()#1}, void>::call() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#11 0x00007f87ae571d0c in WebCore::ThreadTimers::sharedTimerFiredInternal() [clone .part.0] () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#12 0x00007f87ac3d8b0c in WTF::RunLoop::TimerBase::TimerBase(WTF::Ref<WTF::RunLoop, WTF::RawPtrTraits<WTF::RunLoop>, WTF::DefaultRefDerefTraits<WTF::RunLoop> >&&)::{lambda(void*)#1}::_FUN(void*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#13 0x00007f87ac3d986f in WTF::RunLoop::{lambda(_GSource*, int (*)(void*), void*)#1}::_FUN(_GSource*, int (*)(void*), void*) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#14 0x00007f87a7c10d36 in g_main_dispatch (context=0x560ecd0a9c20) at ../glib/gmain.c:3460
#15 g_main_context_dispatch (context=0x560ecd0a9c20) at ../glib/gmain.c:4200
#16 0x00007f87a7c6e2b8 in g_main_context_iterate.isra.0 (context=0x560ecd0a9c20, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4276
#17 0x00007f87a7c103ff in g_main_loop_run (loop=0x560ecd0a9d60) at ../glib/gmain.c:4479
#18 0x00007f87ac3d9a78 in WTF::RunLoop::run() () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#19 0x00007f87aaad128f in int WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainWPE>(int, char**) () at /app/webkit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2
#20 0x00007f87a741608a in __libc_start_call_main (main=main@entry=0x560ecb6c28d0 <main>, argc=argc@entry=5, argv=argv@entry=0x7ffffbbaea38) at ../sysdeps/nptl/libc_start_call_main.h:58
#21 0x00007f87a741614b in __libc_start_main_impl (main=0x560ecb6c28d0 <main>, argc=5, argv=0x7ffffbbaea38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffffbbaea28) at ../csu/libc-start.c:360
#22 0x0000560ecb6c2805 in _start () at ../sysdeps/x86_64/start.S:115

[Fujii Hironori]

GTK and WPE are still randomly crashing, but with different backtrace as comment#0.
Crash is happenning in the callback from gstreamer.

https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/306995@main%20(18080)/imported/w3c/web-platform-tests/mediacapture-record/MediaRecorder-mimetype-crash-log.txt

Thread 1 (Thread 0x7fa8deffd6c0 (LWP 1842048)):
#0  0x00007fad06d48621 in g_logv () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#1  0x00007fad06d488d3 in g_log () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007fad2615c641 in webkitMediaStreamSrcPadProbeCb (pad=0x556c053dfbc0, info=0x7fa8deffc3b0, data=0x7facf539a780) at ../../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:1292
#3  0x00007fad0640c265 in probe_hook_marshal (hook=0x556c053e04f0, data=0x7fa8deffc280) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:3709
#4  0x00007fad06d31ed7 in g_hook_list_marshal () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007fad0640b9ac in do_probe_callbacks (pad=pad@entry=0x556c053dfbc0, info=<optimized out>, defaultval=defaultval@entry=GST_FLOW_OK) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:3893
#6  0x00007fad0640fcfc in gst_pad_push_event_unchecked (pad=pad@entry=0x556c053dfbc0, event=0x7fa8d4001140, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:5668
#7  0x00007fad06410607 in push_sticky (pad=pad@entry=0x556c053dfbc0, ev=ev@entry=0x7fa8deffc4c0, user_data=user_data@entry=0x7fa8deffc520) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:4127
#8  0x00007fad0640d2ac in events_foreach (pad=pad@entry=0x556c053dfbc0, func=func@entry=0x7fad06410530 <push_sticky>, user_data=user_data@entry=0x7fa8deffc520) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:622
#9  0x00007fad064102ee in check_sticky (pad=pad@entry=0x556c053dfbc0, event=event@entry=0x7fa8d4001140) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:4194
#10 0x00007fad06419a33 in gst_pad_push_event (pad=0x556c053dfbc0, event=event@entry=0x7fa8d4001140) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:5847
#11 0x00007fad06532170 in gst_base_src_send_stream_start (src=0x556c053df8c0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/libs/gst/base/gstbasesrc.c:992
#12 0x00007fad06532a18 in gst_base_src_send_stream_start (src=0x556c053df8c0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/libs/gst/base/gstbasesrc.c:3171
#13 gst_base_src_loop (pad=0x556c053dfbc0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/libs/gst/base/gstbasesrc.c:2910
#14 0x00007fad0644cf22 in gst_task_func (task=0x556c053e3cc0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gsttask.c:399
#15 0x00007fad06d775b2 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007fad06d71e12 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007fad0e08aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#18 0x00007fad0e117c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

gst_event_set_seqnum: assertion 'gst_event_is_writable (event)' failed
gst_event_set_seqnum: assertion 'GST_IS_EVENT (event)' failed
WebKitWebProcess terminated (pid 1841008) for reason: crash

[Philippe Normand]

Better trace from Debug GTK:

Thread 1 (Thread 0x7f2fd87f06c0 (LWP 2852775)):
#0  0x00007f4393eb3621 in g_logv () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#1  0x00007f4393eb38d3 in g_log () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f4393575b2a in gst_mini_object_make_writable (mini_object=0x0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstminiobject.c:434
#3  0x00007f43b30af02e in webkitMediaStreamSrcPadProbeCb (pad=0x562206818290, info=0x7f2fd87eec70, data=0x7f4382473540) at ../../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:1290
#4  0x00007f4393577265 in probe_hook_marshal (hook=0x56220680c190, data=0x7f2fd87eeb40) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:3709
#5  0x00007f4393e9ced7 in g_hook_list_marshal () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6  0x00007f43935769ac in do_probe_callbacks (pad=pad@entry=0x562206818290, info=<optimized out>, defaultval=defaultval@entry=GST_FLOW_OK) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:3893
#7  0x00007f439357acfc in gst_pad_push_event_unchecked (pad=pad@entry=0x562206818290, event=0x7f4058000c40, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:5668
#8  0x00007f439357b607 in push_sticky (pad=pad@entry=0x562206818290, ev=ev@entry=0x7f2fd87eed80, user_data=user_data@entry=0x7f2fd87eede0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:4127
#9  0x00007f43935782ac in events_foreach (pad=pad@entry=0x562206818290, func=func@entry=0x7f439357b530 <push_sticky>, user_data=user_data@entry=0x7f2fd87eede0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:622
#10 0x00007f439357b2ee in check_sticky (pad=pad@entry=0x562206818290, event=event@entry=0x7f40540030a0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:4194
#11 0x00007f4393584a33 in gst_pad_push_event (pad=0x562206818290, event=0x7f40540030a0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstpad.c:5847
#12 0x00007f43b30a9178 in InternalSource::pushSample (this=0x7f4382309b30, sample=..., logMessage=...) at ../../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:375
#13 0x00007f43b30aa086 in InternalSource::audioSamplesAvailable (this=0x7f4382309b30, audioData=...) at ../../../Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:527
#14 0x00007f43b30230f1 in WebCore::RealtimeMediaSource::audioSamplesAvailable (this=0x7f43824b4110, time=..., audioData=..., description=..., numberOfFrames=128) at ../../../Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp:397
#15 0x00007f43afbca857 in WebCore::MediaStreamAudioSource::consumeAudio (this=0x7f43824b4110, bus=..., numberOfFrames=128) at ../../../Source/WebCore/Modules/webaudio/MediaStreamAudioSourceGStreamer.cpp:74
#16 0x00007f43afb9909e in WebCore::MediaStreamAudioDestinationNode::process (this=0x7f4382911c80, numberOfFrames=128) at ../../../Source/WebCore/Modules/webaudio/MediaStreamAudioDestinationNode.cpp:73
#17 0x00007f43afaf7472 in WebCore::AudioNode::processIfNecessary (this=0x7f4382911c80, framesToProcess=128) at ../../../Source/WebCore/Modules/webaudio/AudioNode.cpp:498
#18 0x00007f43afb621e0 in WebCore::BaseAudioContext::processAutomaticPullNodes (this=0x7f43824cdd00, framesToProcess=128) at ../../../Source/WebCore/Modules/webaudio/BaseAudioContext.cpp:907
#19 0x00007f43afaf1951 in WebCore::AudioDestinationNode::renderQuantum (this=0x7f43822a02a0, destinationBus=..., numberOfFrames=128, outputPosition=...) at ../../../Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp:107
#20 0x00007f43afb88b9e in WebCore::DefaultAudioDestinationNode::render (this=0x7f43822a02a0, destinationBus=..., numberOfFrames=128, outputPosition=...) at ../../../Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.cpp:267
#21 0x00007f43b28d9b70 in WebCore::AudioDestination::callRenderCallback (this=0x7f43824a6200, destinationBus=..., framesToProcess=128, outputPosition=...) at WebCore/PrivateHeaders/WebCore/AudioDestination.h:141
#22 0x00007f43b297a22e in webKitWebAudioSrcRenderAndPushFrames (element=..., buffer=...) at ../../../Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:275
#23 0x00007f43b297a72b in webKitWebAudioSrcRenderIteration (src=0x56220687fd50) at ../../../Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:325
#24 0x00007f43935b7f22 in gst_task_func (task=0x562206880a20) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gsttask.c:399
#25 0x00007f4393ee25b2 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#26 0x00007f4393edce12 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#27 0x00007f439b28aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#28 0x00007f439b317c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

STDERR: gst_mini_object_make_writable: assertion 'mini_object != NULL' failed
STDERR: WebKitWebProcess terminated (pid 2850044) for reason: crash

[Philippe Normand]

data->streamStartEvent = adoptGRef(gst_event_make_writable(data->streamStartEvent.leakRef())); looks problematic it seems, I suspect the =operator clears the ref before the leakRef() is called? I'm not sure...

Anyway, let's rework this and create new events on the fly...

[Philippe Normand]

Pull request: https://github.com/WebKit/WebKit/pull/59332

[EWS]

Committed 308191@main (537ca0fddc86): <https://commits.webkit.org/308191@main>

Reviewed commits have been landed. Closing PR #59332 and removing active labels.