Under some circumstances, the SourceBuffer.append() can generate an EOS internally in glib ports, which reaches HTMLMediaElement as DecodeError. This triggers detachMediaSource() while the player is still playing fine (it's not aware of any issue). Eventually, the player reaches EOS when running out of samples and the playback is ended. The JavaScript app may try to resume video with video.play(), triggering seek(0), which triggers other internal operations. One of those operations was a MediaPlayerPrivateGStreamerMSE::sourceSetup() call that was trying to setPrivateAndOpen() on the MediaSource that was already detached and this was crashing. The crash itself was fixed in https://bugs.webkit.org/show_bug.cgi?id=220091 by reopening MediaSource on load() only, but the player private still keeps this detached MediaSource that may cause different issues. The proper way to avoid this invalid state where a reference to MediaSource is kept by the player private is to ensure that the player is destroyed on error. It will be recreated again if needed if a fresh src is set in the future.
Pull request: https://github.com/WebKit/WebKit/pull/2122
<rdar://problem/96957131>
Committed 253522@main (1c9cc6e485dc): <https://commits.webkit.org/253522@main> Reviewed commits have been landed. Closing PR #2122 and removing active labels.
Revert "[Media] Destroy media player on fatal playback error" This reverts because causing three imported/w3c/web-platform-tests/media-source/mediasource-changetype tests are a consistent crash.
Committed 253621@main (a44a944): https://commits.webkit.org/253621@main
Verified Revert "[Media] Destroy media player on fatal playback error" at 253621@main; tests are no longer crashing on macOS Debug.
When reverting a patch please reopen the corresponding bug.
As the original crash was fixed in https://github.com/WebKit/WebKit/commit/45759ff (see also https://github.com/WebPlatformForEmbedded/WPEWebKit/pull/880) and this https://github.com/WebKit/WebKit/pull/2122 was just preventive (the issue can't actually be reproduced upstream), I'm not going to insist about fixing the issue here. If it's ever reproduced in the future, we can reopen the bug again. Closing as wontfix.