Bug 303366 – [GTK] webrtc/datachannel/multiple-connections.html flaky crashes in RiceBackendProxy::create()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Claudio Saavedra]

I only checked one stacktrace, but this started crashing recently (around Time: 11/28/2025, 5:17:28 PM)

https://build.webkit.org/results/GTK-Linux-64-bit-Release-Tests/303696@main%20(22347)/webrtc/datachannel/multiple-connections-crash-log.txt

Thread 1 (Thread 0x7fca0b050440 (LWP 2716693)):
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007fca1603327e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007fca160168ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007fca0f619ff5 in ??? () at /lib/x86_64-linux-gnu/libstdc++.so.6
#6  0x00007fca0f62f0da in ??? () at /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00007fca0f619a55 in std::terminate() () at /lib/x86_64-linux-gnu/libstdc++.so.6
#8  0x00007fca189f6d05 in WebKit::RiceBackendProxy::create(WTF::ObjectIdentifierGeneric<WebKit::WebPageProxyIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long>, WebCore::RiceBackendClient&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#9  0x00007fca189b008c in WebKit::WebSocketProvider::createRiceBackend(WebCore::RiceBackendClient&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#10 0x00007fca19d27a29 in webkitGstWebRTCCreateIceAgent(WTF::String const&, WebCore::ScriptExecutionContext*) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#11 0x00007fca19d3c56e in WebCore::GStreamerMediaEndpoint::initializePipeline() () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#12 0x00007fca19d3cfc4 in WebCore::GStreamerPeerConnectionBackend::GStreamerPeerConnectionBackend(WebCore::RTCPeerConnection&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#13 0x00007fca19d483c7 in WebCore::createGStreamerPeerConnectionBackend(WebCore::RTCPeerConnection&, WebCore::MediaEndpointConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#14 0x00007fca19cfd1af in WebCore::RTCPeerConnection::initializeWithConfiguration(WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#15 0x00007fca19d03bec in WebCore::RTCPeerConnection::create(WebCore::Document&, WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#16 0x00007fca19502ac8 in WebCore::JSDOMConstructor<WebCore::JSRTCPeerConnection>::construct(JSC::JSGlobalObject*, JSC::CallFrame*) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#17 0x00007fc9be60c3e7 in ??? ()
#18 0x00007ffe3cf77300 in ??? ()
#19 0x00007fc9be675528 in ??? ()
#20 0x0000000000000000 in ??? ()

[Claudio Saavedra]

Gardened in https://commits.webkit.org/303742@main

[Philippe Normand]

I cannot reproduce this but I'll send a patch hardening this code a bit...

[Philippe Normand]

Pull request: https://github.com/WebKit/WebKit/pull/54761

[EWS]

Committed 304159@main (1c1bd26fae15): <https://commits.webkit.org/304159@main>

Reviewed commits have been landed. Closing PR #54761 and removing active labels.

[Claudio Saavedra]

I'm afraid that this is still crashing. From https://build.webkit.org/results/GTK-Linux-64-bit-Release-Tests/304194@main%20(22435)/results.html (which is from after your changes landed):

Thread 1 (Thread 0x7f7dc1d33440 (LWP 713438)):
#0  0x00007f7dc91cb6b1 in g_logv () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#1  0x00007f7dc91cb963 in g_log () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f7dcba7196a in g_object_set () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#3  0x00007f7dd097a0ea in WebCore::GStreamerMediaEndpoint::setConfiguration(WebCore::MediaEndpointConfiguration&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#4  0x00007f7dd097a8e3 in WebCore::createGStreamerPeerConnectionBackend(WebCore::RTCPeerConnection&, WebCore::MediaEndpointConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#5  0x00007f7dd092e3ff in WebCore::RTCPeerConnection::initializeWithConfiguration(WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#6  0x00007f7dd093503c in WebCore::RTCPeerConnection::create(WebCore::Document&, WebCore::RTCConfiguration&&) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#7  0x00007f7dd012f958 in WebCore::JSDOMConstructor<WebCore::JSRTCPeerConnection>::construct(JSC::JSGlobalObject*, JSC::CallFrame*) () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libwebkitgtk-6.0.so.4
#8  0x00007f7d7520c3e7 in ??? ()
#9  0x00007ffd362fa2a0 in ??? ()
#10 0x00007f7dc9b18eea in llint_op_construct () at /home/buildbot-worker/GTK-Linux-64-bit-Release-Build/build/WebKitBuild/GTK/Release/lib/libjavascriptcoregtk-6.0.so.1
#11 0x0000000000000000 in ??? ()

Full trace is in https://build.webkit.org/results/GTK-Linux-64-bit-Release-Tests/304194@main%20(22435)/webrtc/datachannel/multiple-connections-crash-log.txt

[Claudio Saavedra]

(ok it's a different crash but since it's the same test I think it's ok to reuse this)

[Claudio Saavedra]

There is also a Debug crash (or release with assertions enabled), but this is in the web process instead:

STDERR: ASSERTION FAILED: Unsafe to ref/deref from different threads
STDERR: m_isOwnedByMainThread == isMainThread()
STDERR: WTF/Headers/wtf/RefCountDebugger.h(114) : void WTF::RefCountDebugger::applyRefDerefThreadingCheck(unsigned int, RefCountIsThreadSafe) const
STDERR: 1   0x7fa49d6050a1 WTF::RefCountedBase::derefBase() const
STDERR: 2   0x7fa4a0430ed8 webkit_gst_webrtc_ice_backend_finalize(_GObject*)
STDERR: 3   0x7fa497f4061d g_object_unref
STDERR: 4   0x7fa41c0ba587 gst_webrtc_bin_dispose
STDERR: 5   0x7fa497f403fe g_object_unref
STDERR: 6   0x7fa493df559f gst_bin_remove_func
STDERR: 7   0x7fa493df46af gst_bin_remove
STDERR: 8   0x7fa493df49b3 gst_bin_dispose
STDERR: 9   0x7fa497f403fe g_object_unref
STDERR: 10  0x7fa493e18469 gst_element_call_async_func
STDERR: 11  0x7fa494777532 ???
STDERR: 12  0x7fa494771d92 ???
STDERR: 13  0x7fa49928aaa4 start_thread
STDERR: 14  0x7fa499317c6c clone3

https://ews-build.s3-us-west-2.amazonaws.com/GTK-WK2-Tests-EWS/8f2d446c-111453/webrtc/datachannel/multiple-connections-crash-log.txt

[Philippe Normand]

(In reply to Claudio Saavedra from comment #7)
> There is also a Debug crash (or release with assertions enabled), but this
> is in the web process instead:
> 
> STDERR: ASSERTION FAILED: Unsafe to ref/deref from different threads
> STDERR: m_isOwnedByMainThread == isMainThread()
> STDERR: WTF/Headers/wtf/RefCountDebugger.h(114) : void
> WTF::RefCountDebugger::applyRefDerefThreadingCheck(unsigned int,
> RefCountIsThreadSafe) const
> STDERR: 1   0x7fa49d6050a1 WTF::RefCountedBase::derefBase() const
> STDERR: 2   0x7fa4a0430ed8 webkit_gst_webrtc_ice_backend_finalize(_GObject*)
> STDERR: 3   0x7fa497f4061d g_object_unref
> STDERR: 4   0x7fa41c0ba587 gst_webrtc_bin_dispose
> STDERR: 5   0x7fa497f403fe g_object_unref
> STDERR: 6   0x7fa493df559f gst_bin_remove_func
> STDERR: 7   0x7fa493df46af gst_bin_remove
> STDERR: 8   0x7fa493df49b3 gst_bin_dispose
> STDERR: 9   0x7fa497f403fe g_object_unref
> STDERR: 10  0x7fa493e18469 gst_element_call_async_func
> STDERR: 11  0x7fa494777532 ???
> STDERR: 12  0x7fa494771d92 ???
> STDERR: 13  0x7fa49928aaa4 start_thread
> STDERR: 14  0x7fa499317c6c clone3
> 
> https://ews-build.s3-us-west-2.amazonaws.com/GTK-WK2-Tests-EWS/8f2d446c-
> 111453/webrtc/datachannel/multiple-connections-crash-log.txt

That's https://bugs.webkit.org/show_bug.cgi?id=303919 no?

[Claudio Saavedra]

Right, just sharing it here in case it is useful (e.g. if a process crash causing another process to terminate crashing as well, etc).

[Philippe Normand]

Pull request: https://github.com/WebKit/WebKit/pull/55171

[EWS]

Committed 304288@main (e1c64e854142): <https://commits.webkit.org/304288@main>

Reviewed commits have been landed. Closing PR #55171 and removing active labels.