Bug 210800

Summary:	REGRESSION(r260380): [GTK] fast/mediastream/MediaStream-video-element-remove-track.html is crashing
Product:	WebKit	Reporter:	Diego Pino <dpino>
Component:	Media	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	aboya, calvaris, lmoura
Priority:	P2
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=191886 https://bugs.webkit.org/show_bug.cgi?id=210494

Description Diego Pino 2020-04-21 08:32:14 PDT

The test started crashing since:

[r260379-r260382]             UNKNOWN
r260383                       CRASH (Expected: FAIL)
[r260384-r260399]             UNKNOWN

Likely due to r260380 (MediaPlayerPrivateMediaStreamAVFObjC should start play a newly added audio track if it is playing).

Stacktrace: https://build.webkit.org/results/GTK%20Linux%2064-bit%20Release%20(Tests)/r260383%20(13411)/fast/mediastream/MediaStream-video-element-remove-track-crash-log.txt

Thread 1 (Thread 0x7faa687b09c0 (LWP 95220)):
#0  _g_log_abort () at ../../Source/glib-2.58.1/glib/gmessages.c:557
#1  0x00007faa6aecf559 in g_logv () at ../../Source/glib-2.58.1/glib/gmessages.c:1371
#2  0x00007faa6aecf712 in g_log () at ../../Source/glib-2.58.1/glib/gmessages.c:1413
#3  0x00007faa6afadc53 in g_object_unref () at ../../Source/glib-2.58.1/gobject/gobject.c:3309
#4  g_object_unref () at ../../Source/glib-2.58.1/gobject/gobject.c:3238
#5  0x00007faa6cff569a in _gst_message_free () at ../../Source/gstreamer-1.16.1/gst/gstmessage.c:212
#6  0x00007faa6cfce317 in gst_message_unref () at ../../Source/gstreamer-1.16.1/gst/gstmessage.h:382
#7  gst_bus_source_dispatch () at ../../Source/gstreamer-1.16.1/gst/gstbus.c:840
#8  0x00007faa6aec86b8 in g_main_dispatch () at ../../Source/glib-2.58.1/glib/gmain.c:3182
#9  g_main_context_dispatch () at ../../Source/glib-2.58.1/glib/gmain.c:3847
#10 0x00007faa6aec8a78 in g_main_context_iterate () at ../../Source/glib-2.58.1/glib/gmain.c:3920
#11 0x00007faa6aec8d62 in g_main_loop_run () at ../../Source/glib-2.58.1/glib/gmain.c:4116
#12 0x00007faa70c2dbc0 in WTF::RunLoop::run() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#13 0x00007faa7355a34d in int WebKit::AuxiliaryProcessMain<WebKit::WebProcess, WebKit::WebProcessMainGtk>(int, char**) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#14 0x00007faa6a27809b in __libc_start_main (main=0x5581020a4c10 <main>, argc=4, argv=0x7fffc626ebf8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffc626ebe8) at ../csu/libc-start.c:308
#15 0x00005581020a4c8a in _start ()

Comment 1 Lauro Moura 2020-04-21 14:48:31 PDT

Bisecting, I got the crashes starting right before, in r260379 (bug210494) (tracked in the same build that started crashing).

Comment 2 Xabier Rodríguez Calvar 2020-07-20 22:44:26 PDT

As a result of fixing bug fast/mediastream/MediaStream-removeTrack-while-playing.html begins to crash in debug mode in an assertion. When a track is removed the observer is not removed and when it dies there are null objects in the observer weak hash set. Still, if you do a quick patch to remove the observer, things can still crash as track removal is racy and in release there' other crash. All this needs to be taclked as a general approach to fix track removal.

Comment 3 Lauro Moura 2021-03-07 19:09:58 PST

This test also started to flaky timeout frequently in the release bots since r271526 (Memory pressure changes).

Comment 4 Alicia Boya García 2021-04-06 05:29:49 PDT

No longer crashing. Closing and adjusting expectations.