Bug 242395

Summary: [Media] Destroy media player on fatal playback error
Product: WebKit Reporter: Enrique Ocaña <eocanha>
Component: MediaAssignee: Enrique Ocaña <eocanha>
Status: RESOLVED WONTFIX    
Severity: Normal CC: philn, rackler, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Enrique Ocaña 2022-07-06 09:37:13 PDT
Under some circumstances, the SourceBuffer.append() can generate an EOS internally in glib ports, which reaches HTMLMediaElement as DecodeError. This triggers detachMediaSource() while the player is still playing fine (it's not aware of any issue). Eventually, the player reaches EOS when running out of samples and the playback is ended. The JavaScript app may try to resume video with video.play(), triggering seek(0), which triggers other internal operations. One of those operations was a MediaPlayerPrivateGStreamerMSE::sourceSetup() call that was trying to setPrivateAndOpen() on the MediaSource that was already detached and this was crashing. The crash itself was fixed in https://bugs.webkit.org/show_bug.cgi?id=220091 by reopening MediaSource on load() only, but the player private still keeps this detached MediaSource that may cause different issues.
    
The proper way to avoid this invalid state where a reference to MediaSource is kept by the player private is to ensure that the player is destroyed on error. It will be recreated again if needed if a fresh src is set in the future.
Comment 1 Enrique Ocaña 2022-07-06 09:48:01 PDT
Pull request: https://github.com/WebKit/WebKit/pull/2122
Comment 2 Radar WebKit Bug Importer 2022-07-13 09:38:15 PDT
<rdar://problem/96957131>
Comment 3 EWS 2022-08-17 09:58:30 PDT
Committed 253522@main (1c9cc6e485dc): <https://commits.webkit.org/253522@main>

Reviewed commits have been landed. Closing PR #2122 and removing active labels.
Comment 4 Karl Rackler 2022-08-20 11:25:35 PDT
Revert "[Media] Destroy media player on fatal playback error"

This reverts because causing three imported/w3c/web-platform-tests/media-source/mediasource-changetype tests are a consistent crash.
Comment 5 Karl Rackler 2022-08-20 11:27:46 PDT
Committed 253621@main (a44a944): https://commits.webkit.org/253621@main
Comment 6 Karl Rackler 2022-08-20 16:14:18 PDT
Verified Revert "[Media] Destroy media player on fatal playback error" at 253621@main; tests are no longer crashing on macOS Debug.
Comment 7 Philippe Normand 2022-08-21 01:58:55 PDT
When reverting a patch please reopen the corresponding bug.
Comment 8 Enrique Ocaña 2022-08-22 04:12:46 PDT
As the original crash was fixed in https://github.com/WebKit/WebKit/commit/45759ff (see also https://github.com/WebPlatformForEmbedded/WPEWebKit/pull/880) and this https://github.com/WebKit/WebKit/pull/2122 was just preventive (the issue can't actually be reproduced upstream), I'm not going to insist about fixing the issue here. If it's ever reproduced in the future, we can reopen the bug again.

Closing as wontfix.