Bug 304130 – [Debug][GStreamer] Several tests crashing due to RiceBackendClient deref'd from wrong thread

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: WebKitGTK

[Claudio Saavedra]

At least the following tests are crashing in Debug (and with assertions enabled) as of 304401@main:

imported/w3c/web-platform-tests/webrtc/protocol/dtls-fingerprint-validation.html
fast/mediastream/RTCPeerConnection-media-setup-callbacks-single-dialog.html
imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-parameterless.https.html
imported/w3c/web-platform-tests/webrtc/protocol/split.https.html
imported/w3c/web-platform-tests/webrtc/protocol/handover.html

Thread 1 (Thread 0x7faf497fa6c0 (LWP 1163070)):
#0  WTFCrash () at ../../../Source/WTF/wtf/Assertions.cpp:380
#1  0x00007fc36e2a85ec in WTF::RefCountDebugger::applyRefDerefThreadingCheck (this=0x7fc347d5cdd0, refCount=2, isThreadSafe=WTF::RefCountDebugger::RefCountIsThreadSafe::No) at WTF/Headers/wtf/RefCountDebugger.h:114
#2  0x00007fc36e2a8649 in WTF::RefCountDebugger::willDeref (this=0x7fc347d5cdd0, refCount=2, isThreadSafe=WTF::RefCountDebugger::RefCountIsThreadSafe::No) at WTF/Headers/wtf/RefCountDebugger.h:146
#3  0x00007fc36e2aa836 in WTF::RefCountedBase::derefBase (this=0x7fc347d5cdd0) at WTF/Headers/wtf/RefCounted.h:53
#4  0x00007fc370c18a4e in WTF::RefCounted<WebCore::RiceBackendClient>::deref (this=0x7fc347d5cdd0) at WTF/Headers/wtf/RefCounted.h:75
#5  0x00007fc370c12ec7 in WTF::DefaultRefDerefTraits<WebCore::RiceBackendClient>::derefIfNotNull (ptr=0x7fc347d5cdd0) at WTF/Headers/wtf/Ref.h:64
#6  0x00007fc370c0f128 in WTF::RefPtr<WebCore::RiceBackendClient, WTF::RawPtrTraits<WebCore::RiceBackendClient>, WTF::DefaultRefDerefTraits<WebCore::RiceBackendClient> >::~RefPtr (this=0x560e38978120, __in_chrg=<optimized out>) at WTF/Headers/wtf/RefPtr.h:66
#7  0x00007fc374366384 in _WebKitGstIceAgentPrivate::~_WebKitGstIceAgentPrivate (this=0x560e38978120, __in_chrg=<optimized out>) at ../../../Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp:81
#8  0x00007fc3743663cd in webkit_gst_webrtc_ice_backend_finalize (object=0x560e389781f0) at ../../../Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp:122
#9  0x00007fc35ecae61d in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#10 0x00007fc1e7eb5587 in gst_webrtc_bin_dispose (object=0x560e39290450) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c:8783
#11 0x00007fc35ecae3fe in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#12 0x00007fc35831959f in gst_bin_remove_func (bin=0x560e38f9aed0, element=<optimized out>) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstbin.c:1817
#13 0x00007fc3583186af in gst_bin_remove (bin=bin@entry=0x560e38f9aed0, element=0x560e39290450) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstbin.c:1868
#14 0x00007fc3583189b3 in gst_bin_dispose (object=0x560e38f9aed0) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstbin.c:527
#15 0x00007fc35ecae3fe in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#16 0x00007fc35833c469 in gst_element_call_async_func (data=0x560e39294160, user_data=<optimized out>) at ../../../../../jhbuild/checkout/gstreamer/subprojects/gstreamer/gst/gstelement.c:3842
#17 0x00007fc358ce0532 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007fc358cdad92 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#19 0x00007fc36008aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#20 0x00007fc360117c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78


https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304401@main%20(17729)/imported/w3c/web-platform-tests/webrtc/protocol/handover-crash-log.txt
https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304401@main%20(17729)/imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-parameterless.https-crash-log.txt

etc

[Claudio Saavedra]

This seems to be very recent:

03661@main                   CRASH (Expected: PASS)
[303662@main-304172@main]     UNKNOWN
304173@main                   NOERROR
[304174@main-304186@main]     UNKNOWN
304187@main                   NOERROR
[304188@main-304400@main]     UNKNOWN
304401@main                   CRASH (Expected: PASS)

[Claudio Saavedra]

Gardened in https://commits.webkit.org/304427@main

[Claudio Saavedra]

Also 

fast/mediastream/RTCPeerConnection-onnegotiationneeded.html
fast/mediastream/RTCPeerConnection-setLocalDescription-offer.html

are crashing with the same stacktrace. I might garden them later when I have a moment.

[Philippe Normand]

(In reply to Claudio Saavedra from comment #3)
> Also 
> 
> fast/mediastream/RTCPeerConnection-onnegotiationneeded.html
> fast/mediastream/RTCPeerConnection-setLocalDescription-offer.html
> 
> are crashing with the same stacktrace. I might garden them later when I have
> a moment.

I think this is a dupe of bug 304065 fwiw.

[Philippe Normand]

*** This bug has been marked as a duplicate of bug 304065 ***