Bug 256839

Summary: [GStreamer][MSE] Crash in gsturisourcebin expose_raw_output_pad
Product: WebKit Reporter: Michael Catanzaro <mcatanzaro>
Component: MediaAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: aboya, bugs-noreply, eocanha, philn
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Full backtrace none

Description Michael Catanzaro 2023-05-16 06:41:17 PDT 
Created attachment 466361 [details]
Full backtrace

Here's a crash in gsturisourcebin.c. This occurred when viewing https://www.ksdk.com/article/news/crime/north-county-police-cooperative-officer-charged-kidnapping-assault-on-duty-incident/63-8e3b2ad8-2757-4b03-870d-301baf283cb4

Core was generated by `/usr/libexec/webkitgtk-6.0/WebKitWebProcess 705 152'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
44	      return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
[Current thread is 1 (Thread 0x7f048dffb640 (LWP 288))]
bt(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at pthread_kill.c:44
#1  0x00007f0733a911f3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
#2  0x00007f0733a3f00e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f0733a287fc in __GI_abort () at abort.c:79
#4  0x00007f0730092e5e in g_assertion_message
    (domain=<optimized out>, file=0x7f0680c8ad18 "../gst/playback/gsturisourcebin.c", line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:3451
#5  0x00007f07300fcee7 in g_assertion_message_expr
    (domain=domain@entry=0x0, file=file@entry=0x7f0680c8ad18 "../gst/playback/gsturisourcebin.c", line=line@entry=1315, func=func@entry=0x7f0680c8c8e0 <__func__.21.lto_priv.1> "expose_raw_output_pad", expr=expr@entry=0x7f0680c8b418 "g_object_get_data (G_OBJECT (srcpad), \"urisourcebin.srcpadinfo\") == NULL") at ../glib/gtestutils.c:3477
#6  0x00007f0680c3d76c in expose_raw_output_pad
     (urisrc=urisrc@entry=0x55d2881a95c0 [GstURISourceBin|urisourcebin5], srcpad=srcpad@entry=0x55d28839ec50 [GstPad|src], output_pad=0x0 [GstPad]) at ../gst/playback/gsturisourcebin.c:1315
#7  0x00007f0680c3dd25 in handle_new_pad
    (urisrc=0x55d2881a95c0 [GstURISourceBin|urisourcebin5], srcpad=0x55d28839ec50 [GstPad|src], caps=0x7f0468003c70 [GstCaps]) at ../gst/playback/gsturisourcebin.c:1931
#8  0x00007f0680c3e16d in type_found
    (typefind=<optimized out>, probability=<optimized out>, caps=0x7f0468003c70 [GstCaps], urisrc=0x55d2881a95c0 [GstURISourceBin|urisourcebin5]) at ../gst/playback/gsturisourcebin.c:2000
#9  0x00007f072d42a056 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#10 0x00007f072d428add in ffi_call_int
    (cif=<optimized out>, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=<optimized out>) at ../src/x86/ffi64.c:673
#11 0x00007f072d4292b3 in ffi_call
    (cif=cif@entry=0x7f048dffa280, fn=fn@entry=0x7f0680c3e0f0 <type_found>, rvalue=rvalue@entry=0x7f048dffa200, avalue=avalue@entry=0x7f048dffa1a0) at ../src/x86/ffi64.c:710
#16 0x00007f07301f0743 in <emit signal ??? on instance 0x55d2883d27b0 [GstTypeFindElement]>
    (instance=instance@entry=0x55d2883d27b0, signal_id=<optimized out>, detail=detail@entry=0)
    at ../gobject/gsignal.c:3631
    #12 0x00007f07301d5edf in g_cclosure_marshal_generic
    (closure=<optimized out>, return_gvalue=<optimized out>, n_param_values=<optimized out>, param_values=<optimized out>, invocation_hint=<optimized out>, marshal_data=<optimized out>) at ../gobject/gclosure.c:1536
    #13 0x00007f07301d5442 in g_closure_invoke
    (closure=0x55d2883956b0, return_value=return_value@entry=0x0, n_param_values=3, param_values=param_values@entry=0x7f048dffa490, invocation_hint=invocation_hint@entry=0x7f048dffa410) at ../gobject/gclosure.c:832
    #14 0x00007f07301e95c8 in signal_emit_unlocked_R
    (node=node@entry=0x55d287d689d0, detail=detail@entry=0, instance=instance@entry=0x55d2883d27b0, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7f048dffa490) at ../gobject/gsignal.c:3821
    #15 0x00007f07301f0575 in g_signal_emit_valist
    (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7f048dffa640) at ../gobject/gsignal.c:3574
#17 0x00007f0680d03ff9 in gst_type_find_element_emit_have_type
    (typefind=typefind@entry=0x55d2883d27b0 [GstTypeFindElement|typefindelement8], probability=probability@entry=100, caps=caps@entry=0x7f0468003c70 [GstCaps]) at ../plugins/elements/gsttypefindelement.c:239
#18 0x00007f0680d09f3a in gst_type_find_element_setcaps
    (caps=0x7f0468003c70 [GstCaps], typefind=0x55d2883d27b0 [GstTypeFindElement|typefindelement8])
    at ../plugins/elements/gsttypefindelement.c:788
#19 gst_type_find_element_sink_event (pad=<optimized out>, parent=<optimized out>, event=0x7f0460401190 [GstEvent])
    at ../plugins/elements/gsttypefindelement.c:678
#20 0x00007f0730951b73 in gst_pad_send_event_unchecked
--Type <RET> for more, q to quit, c to continue without paging--c
    (pad=pad@entry=0x55d28839e760 [GstPad|sink], event=event@entry=0x7f0460401190 [GstEvent], type=<optimized out>, type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../gst/gstpad.c:5900
#21 0x00007f0730952310 in gst_pad_push_event_unchecked (pad=pad@entry=0x55d2883ce4c0 [WebKitMediaSrcPad|src_A0], event=0x7f0460401190 [GstEvent], type=<optimized out>, type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../gst/gstpad.c:5542
#22 0x00007f073095281b in push_sticky (pad=pad@entry=0x55d2883ce4c0 [WebKitMediaSrcPad|src_A0], ev=ev@entry=0x7f048dffa950, user_data=user_data@entry=0x7f048dffa9c0) at ../gst/gstpad.c:4047
#23 0x00007f0730948379 in events_foreach (pad=0x55d2883ce4c0 [WebKitMediaSrcPad|src_A0], func=0x7f07309527c0 <push_sticky>, user_data=0x7f048dffa9c0) at ../gst/gstpad.c:608
#24 0x00007f0730955e67 in check_sticky (event=0x7f04600078d0 [GstEvent], pad=0x55d2883ce4c0 [WebKitMediaSrcPad|src_A0]) at ../gst/gstpad.c:4106
#25 gst_pad_push_event (pad=0x55d2883ce4c0 [WebKitMediaSrcPad|src_A0], event=0x7f04600078d0 [GstEvent]) at ../gst/gstpad.c:5675
#26 0x00007f0734ce197e in webKitMediaSrcLoop(void*) (userData=0x55d2883ce4c0) at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:509
#27 0x00007f073097c211 in gst_task_func (task=0x55d2883952e0 [GstTask|webkitmediasrc5:src_A0]) at ../gst/gsttask.c:384
#28 0x00007f07300ff452 in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:350
#29 0x00007f07300fea19 in g_thread_proxy (data=0x7f071c0039f0) at ../glib/gthread.c:831
#30 0x00007f0733a8f1da in start_thread (arg=<optimized out>) at pthread_create.c:442
#31 0x00007f0733b17f44 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:100

I'll attach a full backtrace. No gstreamer log because it's not reproducible.