RESOLVED DUPLICATE of bug 304134286481
REGRESSION(289282@main): [Skia] imported/w3c/web-platform-tests/webrtc/protocol/rtp-demuxing.html is crashing 
https://bugs.webkit.org/show_bug.cgi?id=286481
Summary REGRESSION(289282@main): [Skia] imported/w3c/web-platform-tests/webrtc/protoc...
Claudio Saavedra
Reported 2025-01-24 09:57:29 PST
This started crashing in both ports after https://commits.webkit.org/289282@main . The crash is Skia-related: Thread 1 (Thread 0x7f58e5bff6c0 (LWP 1046414)): #0 sk_collection_check_bounds<int>(int, int) (i=6, size=6) at /app/webkit/Source/ThirdParty/skia/include/private/base/SkAssert.h:152 #1 0x00007f594ed4682b in SkTDArray<GrGpuResource*>::operator[](int) (this=0x555a480f4538, index=6) at /app/webkit/Source/ThirdParty/skia/include/private/base/SkTDArray.h:156 #2 0x00007f594ed4756a in SkTDPQueue<GrGpuResource*, &GrResourceCache::CompareTimestamp, &GrResourceCache::AccessResourceIndex>::percolateUpIfNecessary(int) (this=0x555a480f4538, index=6) at /app/webkit/Source/ThirdParty/skia/src/base/SkTDPQueue.h:146 #3 0x00007f594ed46556 in SkTDPQueue<GrGpuResource*, &GrResourceCache::CompareTimestamp, &GrResourceCache::AccessResourceIndex>::insert(GrGpuResource*) (this=0x555a480f4538, entry=0x555a49053c40) at /app/webkit/Source/ThirdParty/skia/src/base/SkTDPQueue.h:74 #4 0x00007f594ed44718 in GrResourceCache::notifyARefCntReachedZero(GrGpuResource*, GrIORef<GrGpuResource>::LastRemovedRef) (this=0x555a480f4520, resource=0x555a49053c40, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrResourceCache.cpp:359 #5 0x00007f594ed2024c in GrResourceCache::ResourceAccess::notifyARefCntReachedZero(GrGpuResource*, GrIORef<GrGpuResource>::LastRemovedRef) (this=0x7f58e5bfdc78, resource=0x555a49053c40, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrResourceCache.h:454 #6 0x00007f594ed20e46 in GrGpuResource::notifyARefCntIsZero(GrIORef<GrGpuResource>::LastRemovedRef) const (this=0x555a49053c40, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrGpuResource.cpp:180 #7 0x00007f594ecb8204 in GrIORef<GrGpuResource>::notifyWillBeZero(GrIORef<GrGpuResource>::LastRemovedRef) const (this=0x555a49053c48, removedRef=GrIORef<GrGpuResource>::LastRemovedRef::kMainRef) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrGpuResource.h:102 #8 0x00007f594ecb6876 in GrIORef<GrGpuResource>::unref() const (this=0x555a49053c48) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrGpuResource.h:65 #9 0x00007f594ed403c2 in SkSafeUnref<GrSurface>(GrSurface*) (obj=0x555a49053c40) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:151 #10 0x00007f594ed4063a in sk_sp<GrSurface>::reset(GrSurface*) (this=0x555a4848e210, ptr=0x0) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:316 #11 0x00007f594ed5640f in sk_sp<GrSurface>::operator=(decltype(nullptr)) (this=0x555a4848e210) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:260 #12 0x00007f594ed57dc6 in GrTextureProxy::~GrTextureProxy() (this=0x555a4848e1a0, __vtt_parm=0x7f5950008210 <VTT for GrTextureRenderTargetProxy+24>, __in_chrg=<optimized out>) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrTextureProxy.cpp:110 #13 0x00007f594ed5990b in GrTextureRenderTargetProxy::~GrTextureRenderTargetProxy() (this=0x555a4848e170, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrTextureRenderTargetProxy.h:44 #14 0x00007f594ed59964 in GrTextureRenderTargetProxy::~GrTextureRenderTargetProxy() (this=0x555a4848e170, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/GrTextureRenderTargetProxy.h:44 #15 0x00007f594ecb9b23 in SkNVRefCnt<GrSurfaceProxy>::unref() const (this=0x555a4848e208) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:181 #16 0x00007f594ecb81bf in SkSafeUnref<GrSurfaceProxy>(GrSurfaceProxy*) (obj=0x555a4848e200) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:151 #17 0x00007f594ecb67fd in sk_sp<GrSurfaceProxy>::~sk_sp() (this=0x555a48f351c0, __in_chrg=<optimized out>) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:256 #18 0x00007f594ee35a10 in SkImage_Ganesh::ProxyChooser::~ProxyChooser() (this=0x555a48f351b8, __in_chrg=<optimized out>) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/image/SkImage_Ganesh.cpp:74 #19 0x00007f594ee36686 in SkImage_Ganesh::~SkImage_Ganesh() (this=0x555a48f35180, __in_chrg=<optimized out>) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/image/SkImage_Ganesh.cpp:237 #20 0x00007f594ee366ae in SkImage_Ganesh::~SkImage_Ganesh() (this=0x555a48f35180, __in_chrg=<optimized out>) at /app/webkit/Source/ThirdParty/skia/src/gpu/ganesh/image/SkImage_Ganesh.cpp:237 #21 0x00007f594e9ee52c in SkRefCntBase::internal_dispose() const (this=0x555a48f35180) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:99 #22 0x00007f594628bce6 in SkRefCntBase::unref() const (this=0x555a48f35180) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:78 #23 0x00007f594628c21d in SkSafeUnref<SkImage>(SkImage*) (obj=0x555a48f35180) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:151 #24 0x00007f594628bed5 in sk_sp<SkImage>::~sk_sp() (this=0x555a4829a288, __in_chrg=<optimized out>) at /app/webkit/Source/ThirdParty/skia/include/core/SkRefCnt.h:256 #25 0x00007f594d72759e in WebCore::PlatformImageNativeImageBackend::~PlatformImageNativeImageBackend() (this=0x555a4829a280, __in_chrg=<optimized out>) at /app/webkit/Source/WebCore/platform/graphics/NativeImage.cpp:48 #26 0x00007f594d7275c6 in WebCore::PlatformImageNativeImageBackend::~PlatformImageNativeImageBackend() (this=0x555a4829a280, __in_chrg=<optimized out>) at /app/webkit/Source/WebCore/platform/graphics/NativeImage.cpp:48 #27 0x00007f59480ab6a8 in std::default_delete<WebCore::NativeImageBackend>::operator()(WebCore::NativeImageBackend*) const (this=0x7f5923146d30, __ptr=0x555a4829a280) at /usr/include/c++/13.2.0/bits/unique_ptr.h:99 #28 0x00007f59480700c8 in std::unique_ptr<WebCore::NativeImageBackend, std::default_delete<WebCore::NativeImageBackend> >::~unique_ptr() (this=0x7f5923146d30, __in_chrg=<optimized out>) at /usr/include/c++/13.2.0/bits/unique_ptr.h:404 #29 0x00007f59480583f0 in WTF::UniqueRef<WebCore::NativeImageBackend>::~UniqueRef() (this=0x7f5923146d30, __in_chrg=<optimized out>) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/UniqueRef.h:65 #30 0x00007f594d727954 in WebCore::NativeImage::~NativeImage() (this=0x7f5923146cf0, __in_chrg=<optimized out>) at /app/webkit/Source/WebCore/platform/graphics/NativeImage.cpp:81 #31 0x00007f594d72797c in WebCore::NativeImage::~NativeImage() (this=0x7f5923146cf0, __in_chrg=<optimized out>) at /app/webkit/Source/WebCore/platform/graphics/NativeImage.cpp:81 #32 0x00007f594628c5b6 in WTF::ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<WebCore::RenderingResource, (WTF::DestructionThread)0>::deref() const::{lambda()#1}::operator()() const (__closure=0x7f58e5bfe060) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/ThreadSafeWeakPtr.h:243 #33 0x00007f594628c6be in WTF::ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<WebCore::RenderingResource, (WTF::DestructionThread)0>::deref() const (this=0x7f5923146cf8) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/ThreadSafeWeakPtr.h:247 #34 0x00007f594628c406 in WTF::DefaultRefDerefTraits<WebCore::NativeImage>::derefIfNotNull(WebCore::NativeImage*) (ptr=0x7f5923146cf0) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Ref.h:62 #35 0x00007f5946d04449 in WTF::Ref<WebCore::NativeImage, WTF::RawPtrTraits<WebCore::NativeImage>, WTF::DefaultRefDerefTraits<WebCore::NativeImage> >::~Ref() (this=0x7f592319e2a8, __in_chrg=<optimized out>) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Ref.h:82 #36 0x00007f5948a70d66 in WebCore::CoordinatedPlatformLayerBufferNativeImage::~CoordinatedPlatformLayerBufferNativeImage() (this=0x7f592319e280, __in_chrg=<optimized out>) at /app/webkit/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferNativeImage.cpp:91 #37 0x00007f5948a70d8e in WebCore::CoordinatedPlatformLayerBufferNativeImage::~CoordinatedPlatformLayerBufferNativeImage() (this=0x7f592319e280, __in_chrg=<optimized out>) at /app/webkit/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferNativeImage.cpp:91 #38 0x00007f59481a3894 in std::default_delete<WebCore::CoordinatedPlatformLayerBuffer>::operator()(WebCore::CoordinatedPlatformLayerBuffer*) const (this=0x7f5923669960, __ptr=0x7f592319e280) at /usr/include/c++/13.2.0/bits/unique_ptr.h:99 #39 0x00007f5948a50e20 in std::__uniq_ptr_impl<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >::reset(WebCore::CoordinatedPlatformLayerBuffer*) (this=0x7f5923669960, __p=0x7f592319e000) at /usr/include/c++/13.2.0/bits/unique_ptr.h:211 #40 0x00007f5948a50904 in std::__uniq_ptr_impl<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >::operator=(std::__uniq_ptr_impl<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >&&) (this=0x7f5923669960, __u=...) at /usr/include/c++/13.2.0/bits/unique_ptr.h:191 #41 0x00007f5948a4fdc5 in std::__uniq_ptr_data<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer>, true, true>::operator=(std::__uniq_ptr_data<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer>, true, true>&&) (this=0x7f5923669960) at /usr/include/c++/13.2.0/bits/unique_ptr.h:243 #42 0x00007f5948a4fdef in std::unique_ptr<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >::operator=(std::unique_ptr<WebCore::CoordinatedPlatformLayerBuffer, std::default_delete<WebCore::CoordinatedPlatformLayerBuffer> >&&) (this=0x7f5923669960) at /usr/include/c++/13.2.0/bits/unique_ptr.h:414 #43 0x00007f5948a4ff16 in WebCore::TextureMapperPlatformLayerProxy::swapBuffer() (this=0x7f5923669920) at /app/webkit/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:136 #44 0x00007f5948a6be31 in WebCore::CoordinatedPlatformLayer::flushCompositingState(WebCore::TextureMapper&) (this=0x7f58ed369c00, textureMapper=...) at /app/webkit/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:930 #45 0x00007f59486d979c in WebKit::CoordinatedGraphicsScene::updateSceneState() (this=0x7f59231200e0) at /app/webkit/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:110 #46 0x00007f59486d8e39 in WebKit::CoordinatedGraphicsScene::paintToCurrentGLContext(WebCore::TransformationMatrix const&, WebCore::FloatRect const&, bool) (this=0x7f59231200e0, matrix=..., clipRect=..., flipY=true) at /app/webkit/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:46 #47 0x00007f59486e1c08 in WebKit::ThreadedCompositor::renderLayerTree() (this=0x7f59230d3920) at /app/webkit/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:287 #48 0x00007f59486e07bf in operator()() const (__closure=0x7f59230014d8) at /app/webkit/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:85 #49 0x00007f59486f92ae in WTF::Detail::CallableWrapper<WebKit::ThreadedCompositor::ThreadedCompositor(WebKit::LayerTreeHost&)::<lambda()>, void>::call(void) (this=0x7f59230014d0) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Function.h:53 #50 0x00007f5946b2a53d in WTF::Function<void ()>::operator()() const (this=0x7f5923038ca8) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Function.h:82 #51 0x00007f59486d8964 in WebKit::CompositingRunLoop::updateTimerFired() (this=0x7f5923038c70) at /app/webkit/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingRunLoop.cpp:188 #52 0x00007f59486f95c4 in std::__invoke_impl<void, void (WebKit::CompositingRunLoop::*&)(), WebKit::CompositingRunLoop*&>(std::__invoke_memfun_deref, void (WebKit::CompositingRunLoop::*&)(), WebKit::CompositingRunLoop*&) (__f=@0x7f5923107408: (void (WebKit::CompositingRunLoop::*)(WebKit::CompositingRunLoop * const)) 0x7f59486d88ec <WebKit::CompositingRunLoop::updateTimerFired()>, __t=@0x7f5923107418: 0x7f5923038c70) at /usr/include/c++/13.2.0/bits/invoke.h:74 #53 0x00007f59486f953d in std::__invoke<void (WebKit::CompositingRunLoop::*&)(), WebKit::CompositingRunLoop*&>(void (WebKit::CompositingRunLoop::*&)(), WebKit::CompositingRunLoop*&) (__fn=@0x7f5923107408: (void (WebKit::CompositingRunLoop::*)(WebKit::CompositingRunLoop * const)) 0x7f59486d88ec <WebKit::CompositingRunLoop::updateTimerFired()>) at /usr/include/c++/13.2.0/bits/invoke.h:96 #54 0x00007f59486f94b3 in std::_Bind<void (WebKit::CompositingRunLoop::*(WebKit::CompositingRunLoop*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (this=0x7f5923107408, __args=...) at /usr/include/c++/13.2.0/functional:506 #55 0x00007f59486f9445 in std::_Bind<void (WebKit::CompositingRunLoop::*(WebKit::CompositingRunLoop*))()>::operator()<, void>() (this=0x7f5923107408) at /usr/include/c++/13.2.0/functional:591 #56 0x00007f59486f930e in WTF::Detail::CallableWrapper<std::_Bind<void (WebKit::CompositingRunLoop::*(WebKit::CompositingRunLoop*))()>, void>::call() (this=0x7f5923107400) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Function.h:53 #57 0x00007f5946b2a53d in WTF::Function<void ()>::operator()() const (this=0x7f5923038ca0) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Function.h:82 #58 0x00007f59470ee7e0 in WTF::RunLoop::Timer::fired() (this=0x7f5923038c78) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/RunLoop.h:223 #59 0x00007f5938b40279 in operator()(gpointer) const (__closure=0x0, userData=0x7f5923038c78) at /app/webkit/Source/WTF/wtf/glib/RunLoopGLib.cpp:177 #60 0x00007f5938b402b9 in _FUN(gpointer) () at /app/webkit/Source/WTF/wtf/glib/RunLoopGLib.cpp:181 #61 0x00007f5938b3f6bf in operator()(GSource*, GSourceFunc, gpointer) const (__closure=0x0, source=0x555a47e8ec70, callback=0x7f5938b4029c <_FUN(gpointer)>, userData=0x7f5923038c78) at /app/webkit/Source/WTF/wtf/glib/RunLoopGLib.cpp:53 #62 0x00007f5938b3f70d in _FUN(GSource*, GSourceFunc, gpointer) () at /app/webkit/Source/WTF/wtf/glib/RunLoopGLib.cpp:56 #63 0x00007f5931317d36 in g_main_dispatch (context=0x7f5760000b70) at ../glib/gmain.c:3460 #64 g_main_context_dispatch (context=0x7f5760000b70) at ../glib/gmain.c:4200 #65 0x00007f59313752b8 in g_main_context_iterate.isra.0 (context=0x7f5760000b70, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4276 #66 0x00007f59313173ff in g_main_loop_run (loop=0x7f5760000da0) at ../glib/gmain.c:4479 #67 0x00007f5938b3fde8 in WTF::RunLoop::run() () at /app/webkit/Source/WTF/wtf/glib/RunLoopGLib.cpp:108 #68 0x00007f59389b8c7d in operator()() const (__closure=0x7f59231073e8) at /app/webkit/Source/WTF/wtf/RunLoop.cpp:114 #69 0x00007f59389bc32e in WTF::Detail::CallableWrapper<WTF::RunLoop::create(WTF::ASCIILiteral, WTF::ThreadType, WTF::Thread::QOS)::<lambda()>, void>::call(void) (this=0x7f59231073e0) at /app/webkit/Source/WTF/wtf/Function.h:53 #70 0x00007f593705ed57 in WTF::Function<void ()>::operator()() const (this=0x7f58e5bfeb40) at /app/webkit/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Function.h:82 #71 0x00007f5938a7b741 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) (newThreadContext=0x7f5923009bc0) at /app/webkit/Source/WTF/wtf/Threading.cpp:266 #72 0x00007f5938b4ef2d in WTF::wtfThreadEntryPoint(void*) (context=0x7f5923009bc0) at /app/webkit/Source/WTF/wtf/posix/ThreadingPOSIX.cpp:241 #73 0x00007f5930ca1e39 in start_thread (arg=<optimized out>) at pthread_create.c:444 #74 0x00007f5930d298c4 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:100
Attachments
Add attachment proposed patch, testcase, etc.
Philippe Normand
Comment 1 2025-03-10 05:54:56 PDT
When fixing this crash please restore the previous expectation for this test (Failure).
Nikolas Zimmermann
Comment 2 2025-12-18 06:31:00 PST
*** This bug has been marked as a duplicate of bug 304134 ***
Note You need to log in before you can comment on or make changes to this bug.