Bug 210983

Summary: ASSERTION FAILED: m_wrapper under HTMLMediaElement::setIsPlayingToWirelessTarget
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: MediaAssignee: Chris Dumez <cdumez>
Status: RESOLVED FIXED    
Severity: Normal CC: calvaris, eric.carlson, esprehn+autocc, ews-watchlist, glenn, gyuyoung.kim, jer.noble, philipj, sergio, webkit-bug-importer, youennf
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Chris Dumez
Reported 2020-04-24 12:10:26 PDT
ASSERTION FAILED: m_wrapper under HTMLMediaElement::setIsPlayingToWirelessTarget: ASSERTION FAILED: m_wrapper ./bindings/js/JSEventListener.h(123) : JSC::JSObject *WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext &) const 1 0x106bf70b9 WTFCrash 2 0x11d80388b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x11f9be9f8 WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext&) const 4 0x11f9bdd1b WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) 5 0x12000b87c WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) 6 0x120007b12 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) 7 0x1200834ba WebCore::Node::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) 8 0x11fff6180 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const 9 0x11fff6b97 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) 10 0x11fff6795 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) 11 0x12008350d WebCore::Node::dispatchEvent(WebCore::Event&) 12 0x1203eeb31 WebCore::HTMLMediaElement::dispatchEvent(WebCore::Event&) 13 0x120426b95 WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)::$_35::operator()() const 14 0x120426999 WTF::Detail::CallableWrapper<WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool)::$_35, void>::call() The issue is that we are trying to fire a JS event as a result of ActiveDOMObject getting called, which is not allowed: 1 0x12799f3a4 WebCore::HTMLMediaElement::setIsPlayingToWirelessTarget(bool) 2 0x12799f1bb WebCore::HTMLMediaElement::clearMediaPlayer() 3 0x12799f913 WebCore::HTMLMediaElement::stop() 4 0x12769ddbd auto WebCore::ScriptExecutionContext::stopActiveDOMObjects()::$_9::operator()<WebCore::ActiveDOMObject>(WebCore::ActiveDOMObject&) const 5 0x12769dd73 WTF::Detail::CallableWrapper<WebCore::ScriptExecutionContext::stopActiveDOMObjects()::$_9, WebCore::ScriptExecutionContext::ShouldContinue, WebCore::ActiveDOMObject&>::call(WebCore::ActiveDOMObject&) 6 0x12767c22a WTF::Function<WebCore::ScriptExecutionContext::ShouldContinue (WebCore::ActiveDOMObject&)>::operator()(WebCore::ActiveDOMObject&) const 7 0x12767c080 WebCore::ScriptExecutionContext::forEachActiveDOMObject(WTF::Function<WebCore::ScriptExecutionContext::ShouldContinue (WebCore::ActiveDOMObject&)> const&) const 8 0x12767c487 WebCore::ScriptExecutionContext::stopActiveDOMObjects() 9 0x1274a42ff WebCore::Document::stopActiveDOMObjects() 10 0x1274a40bc WebCore::Document::commonTeardown() 11 0x1274b0253 WebCore::Document::prepareForDestruction()
Attachments
Patch (1.96 KB, patch)
2020-04-24 12:12 PDT, Chris Dumez 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Chris Dumez
Comment 1 2020-04-24 12:10:36 PDT
<rdar://problem/61611994>
Chris Dumez
Comment 2 2020-04-24 12:12:32 PDT
Created attachment 397481 [details] Patch
Alexey Proskuryakov
Comment 3 2020-04-24 12:27:13 PDT
Comment on attachment 397481 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=397481&action=review > Source/WebCore/ChangeLog:14 > + No new tests, already covered by: > + media/modern-media-controls/placard-support/placard-support-airplay-fullscreen.html Is there any observable behavior change here in addition to not running into the GC issue?
Chris Dumez
Comment 4 2020-04-24 12:32:56 PDT
(In reply to Alexey Proskuryakov from comment #3) > Comment on attachment 397481 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=397481&action=review > > > Source/WebCore/ChangeLog:14 > > + No new tests, already covered by: > > + media/modern-media-controls/placard-support/placard-support-airplay-fullscreen.html > > Is there any observable behavior change here in addition to not running > into the GC issue? No. In release, we would fail to fire the event in this case and return early. In debug we would hit the assertion. Now we don't even try to fire the event so that we no longer hit the assertion in this case. No behavior change since we don't fire the event either way.
EWS
Comment 5 2020-04-24 14:11:05 PDT
Committed r260669: <https://trac.webkit.org/changeset/260669> All reviewed patches have been landed. Closing bug and clearing flags on attachment 397481 [details].
Alexey Proskuryakov
Comment 6 2020-04-24 19:11:34 PDT
> No. In release, we would fail to fire the event in this case and return > early. In debug we would hit the assertion. Now we don't even try to fire > the event so that we no longer hit the assertion in this case. No behavior > change since we don't fire the event either way. We would hit the assertion (or return in release) in the case where the wrapper was already GC collected. What about the case where it was not?
Note You need to log in before you can comment on or make changes to this bug.