Bug 289972 – [GTK] Crash in gst_caps_set_simple_valist

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: New Bugs

Version: webkitgtk-2.48.0 (latest stable version)
OS: Linux/ubuntu
Step to reproduce:
1. build default version webkitgtk-2.48.0
2. Open the testcase attached below with webkitgtk Minibrowser
3. with several seconds, WebProcess would crash with Log Info：

Stacktrace:
addr2line: DWARF error: invalid or unhandled FORM value: 0x23
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==2==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000020 (pc 0x7c08397eac84 bp 0x7c083976e692 sp 0x7ffcad259810 T2)
==2==The signal is caused by a READ memory access.
==2==Hint: address points to the zero page.
==2==WARNING: invalid path to external symbolizer!
==2==WARNING: Failed to use and restart external symbolizer!
    #0 0x7c08397eac84 in gst_caps_set_simple_valist ??:?
    #1 0x7c08397eaf8d in gst_caps_set_simple ??:?
    #2 0x7c0839739bab in gst_audio_info_to_caps ??:?
    #3 0x7c08558fd4a5 in WebCore::PlatformRawAudioData::create(std::span<unsigned char const, 18446744073709551615ul>, WebCore::AudioSampleFormat, float, long, unsigned long, unsigned long) UnifiedSource-3c72abbe-20.cpp:?
    #4 0x7c085273cba8 in WebCore::WebCodecsAudioData::create(WebCore::ScriptExecutionContext&, WebCore::WebCodecsAudioData::Init&&) UnifiedSource-f8afad56-57.cpp:?
    #5 0x7c08518110f2 in WebCore::JSDOMConstructor<WebCore::JSWebCodecsAudioData>::construct(JSC::JSGlobalObject*, JSC::CallFrame*) UnifiedSource-3a52ce78-170.cpp:?
    #6 0x7c07d3e103e6  (<unknown module>)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (/lib/x86_64-linux-gnu/libgstreamer-1.0.so.0+0x5bc84) (BuildId: 5e7102fb819ae14ffa6f3efbfe4bdf7d87ac5820)
==2==ABORTING

** (MiniBrowser:2374352): WARNING **: 17:05:28.216: WebProcess CRASHED

Additional Information is provided below:

The attached video shows the process triggering the WebProcess crash.

Created attachment 474608 [details]
testcase to trigger crash

Created attachment 474609 [details]
the video to show how to trigger the crash

[Philippe Normand]

Please try current main.

*** This bug has been marked as a duplicate of bug 289946 ***