Bug 261264

Summary: [GTK][GStreamer] Crash when clicking play button after video ended
Product: WebKit Reporter: Kdwk <kdwkleung>
Component: WebKitGTKAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: bugs-noreply, mcatanzaro, philn
Priority: P2    
Version: WebKit Nightly Build   
Hardware: PC   
OS: Linux   
Attachments:
Description Flags
gdb (t a a bt; c) output.txt
none
gdb (thread 14; f 2; p *mutex; into threads) output.txt
none
gdb (thread 14; f 2; p *mutex; into threads) output 2
none
gdb (t a a bt; c) output 2.txt none

Description Kdwk 2023-09-07 02:12:56 PDT
Created attachment 467581 [details]
gdb (t a a bt; c) output.txt

Transferred from https://gitlab.gnome.org/GNOME/epiphany/-/issues/2171. I have now found a way to reproduce the crash

1. Visit https://tools.woolyss.com/html5-audio-video-tester/?u=woolyss.com/f/caminandes-3-llamigos-x265-aac.mp4
2. Play the video until its end
3. Press play
4. WebProcess crash. 'App not responding' dialog appears
Comment 1 Philippe Normand 2023-09-07 06:04:24 PDT
in gdb can you type this?

thread 14
f 2
p *mutex

and then:

into threads
Comment 2 Philippe Normand 2023-09-07 06:17:31 PDT
I cannot reproduce this issue here btw, in TP, without or without VA decoders.
Comment 3 Kdwk 2023-09-07 06:19:06 PDT
Created attachment 467582 [details]
gdb (thread 14; f 2; p *mutex; into threads) output.txt
Comment 4 Michael Catanzaro 2023-09-07 06:42:48 PDT
(In reply to Philippe Normand from comment #2)
> I cannot reproduce this issue here btw, in TP, without or without VA
> decoders.

I can't reproduce it either (did not try VA decoders).
Comment 5 Kdwk 2023-09-07 06:54:32 PDT
Created attachment 467583 [details]
gdb (thread 14; f 2; p *mutex; into threads) output 2

I triggered the bug again and re-did the gdb commands, and the output was different
Comment 6 Philippe Normand 2023-09-07 07:28:21 PDT
I was asking about the first crash report... Load it in gdb again and type the commands.
Comment 7 Kdwk 2023-09-07 07:29:55 PDT
How do I load it in gdb again?
Comment 8 Kdwk 2023-09-07 07:30:25 PDT
(I was under the impression that it gets overridden every time there's a new crash)
Comment 9 Philippe Normand 2023-09-07 07:44:32 PDT
coredumps accumulate and periodically get cleaned up (by systemd or something). So look it up with `coredumpctl list`, get the PID and then run `coredumpctl gdb <pid goes here without brackets>`
Comment 10 Kdwk 2023-09-07 18:47:05 PDT
Is there a way to do that with flatpak-coredumpctl? I use Epiphany Tech Preview in Flatpak, so coredumpctl gdb just says ?? ()
Comment 11 Philippe Normand 2023-09-08 02:40:01 PDT
(In reply to Kdwk from comment #10)
> Is there a way to do that with flatpak-coredumpctl? I use Epiphany Tech
> Preview in Flatpak, so coredumpctl gdb just says ?? ()

flatpak-coredumpctl -h mentions a -m option, so use it?
Comment 12 Kdwk 2023-09-08 03:20:57 PDT
I'm afraid I couldn't make it work. Perhaps I could trigger the crash again and give you a new gdb (t a a bt; c) output.
Comment 13 Kdwk 2023-09-08 03:37:32 PDT
Created attachment 467599 [details]
gdb (t a a bt; c) output 2.txt

This is another gdb output after freshly triggering the bug. I did not quit gdb so if you would like to see the output of some other gdb command I can still get it
Comment 14 Philippe Normand 2023-09-08 03:47:39 PDT
t 5
f 2
p *mutex
Comment 15 Kdwk 2023-09-08 03:48:34 PDT
(gdb) t 5
[Switching to thread 5 (Thread 0x7f6362ad4a00 (LWP 2))]
#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
38		cmpq $-4095, %rax	/* Check %rax for error.  */
(gdb) f 2
#2  0x00007f6366478477 in g_mutex_lock (mutex=mutex@entry=0x55c691d94418)
    at ../glib/gthread-posix.c:1417
1417	    g_mutex_lock_slowpath (mutex);
(gdb) p *mutex
$1 = {p = 0x2, i = {2, 0}}
Comment 16 Philippe Normand 2023-09-08 04:09:12 PDT
Damn this isn't a pthread mutex, can't see the owning thread :(
Comment 17 Michael Catanzaro 2023-09-08 05:22:34 PDT
If we could reproduce the crash then we could probably force/hack GLib to use pthread mutexes somehow, or get a GStreamer debug log. But we'll never find a reproducer. So I don't know what to do.

I've never seen a deadlock like this before. :( Normally it's obvious from the backtrace which threads might have the mutex locked. But here, every thread looks innocent. The only other thread using GStreamer at all is thread 25.
Comment 18 Philippe Normand 2023-09-11 07:51:02 PDT
Maybe this is specific to nvidia?

Can you get logs? GST_DEBUG="3,webkit*:7"