Skip to content

[MSE] Crashfix on seeking MediaSource re-opening - #1712

Open
asurdej-comcast wants to merge 1 commit into
WebPlatformForEmbedded:wpe-2.46from
asurdej-comcast:mse_seek_detach
Open

[MSE] Crashfix on seeking MediaSource re-opening#1712
asurdej-comcast wants to merge 1 commit into
WebPlatformForEmbedded:wpe-2.46from
asurdej-comcast:mse_seek_detach

Conversation

@asurdej-comcast

@asurdej-comcast asurdej-comcast commented Aug 7, 2026

Copy link
Copy Markdown

When a seek was pending at detach time, m_seekTargetPromise was correctly rejected and cleared but m_pendingSeekTarget was left set. On the next attach/append cycle, monitorSourceBuffers() would call completeSeek() with a live m_pendingSeekTarget but an empty m_seekTargetPromise, causing a crash dereferencing the empty optional.

Fixes crash when HTMLMediaElement reuses the same MediaSource for a new source after a seek-then-detach sequence.
3daf035

Build-Tests Layout-Tests
✅ 🛠 wpe-246-amd64-build ✅ 🧪 wpe-246-amd64-layout
✅ 🛠 wpe-246-arm32-build ✅ 🧪 wpe-246-arm32-layout

When a seek was pending at detach time, m_seekTargetPromise was correctly
rejected and cleared but m_pendingSeekTarget was left set. On the next
attach/append cycle, monitorSourceBuffers() would call completeSeek() with
a live m_pendingSeekTarget but an empty m_seekTargetPromise, causing a
crash dereferencing the empty optional.

Fixes crash when HTMLMediaElement reuses the same MediaSource for a new
source after a seek-then-detach sequence.
@asurdej-comcast

Copy link
Copy Markdown
Author

Crash reported from one of web apps. Backtrace below.
Scenario is:

  1. Play MSE at non zero position
  2. Seek to unbuffered (possibly "0")
  3. reset HTML media element
  4. Reuse the same MediaSource and create new SourceBuffers
  5. Append data at zero position (seek target)

something like:

            await asyncFetchAndAppend(ms, audioSb, audioUrl.replace('$Number$', 0))
            await asyncFetchAndAppend(ms, videoSb, videoUrl.replace('$Number$', 0))

            // skip segment nr 1 with zero position
            await asyncFetchAndAppend(ms, audioSb, audioUrl.replace('$Number$', 2))
            await asyncFetchAndAppend(ms, videoSb, videoUrl.replace('$Number$', 2))

            video.currentTime = 5
            video.play()
            // sleep 1
            
            video.currentTime = 0
            const oldUrl = video.src
            video.removeAttribute('src')
            video.load()
            window.URL.revokeObjectURL(oldUrl)

            await new Promise(resolve => {
                ms.onsourceopen = () => { ms.onsourceopen = null; resolve() }
                video.src = URL.createObjectURL(ms)
            })

            const audioSb2 = await asyncPrepareSourceBuffer(ms, 'audio/mp4; codecs="mp4a.40.2"')
            const videoSb2 = await asyncPrepareSourceBuffer(ms, 'video/mp4; codecs="avc1.640028"')

            await asyncFetchAndAppend(ms, audioSb2, audioUrl.replace('$Number$', 0))
            await asyncFetchAndAppend(ms, videoSb2, videoUrl.replace('$Number$', 0))

            await asyncFetchAndAppend(ms, audioSb2, audioUrl.replace('$Number$', 1))
            await asyncFetchAndAppend(ms, videoSb2, videoUrl.replace('$Number$', 1))

            video.play()
0
void WTF::NativePromise
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../recipe-sysroot/usr/include/c++/11.3.0/bits/atomic_base.h:522
1
WebCore::MediaSource::completeSeek
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/Modules/mediasource/MediaSource.cpp:409
2
WebCore::MediaSource::monitorSourceBuffers
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/Modules/mediasource/MediaSource.cpp:622
3
WebCore::MediaSource::updateBufferedIfNeeded
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/Modules/mediasource/MediaSource.cpp:1431
4
operator
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/Modules/mediasource/MediaSource.cpp:1412
5
WebCore::SourceBuffer::updateBuffered
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/WTF/Headers/wtf/Scope.h:53
6
WTF::Detail::CallableWrapper
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/Modules/mediasource/SourceBuffer.cpp:1397
7
WTF::Detail::CallableWrapper
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/WTF/Headers/wtf/Function.h:82
8
WebCore::ScriptExecutionContext::ensureOnContextThread
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/WTF/Headers/wtf/Function.h:82
9
WebCore::SourceBufferClientImpl::sourceBufferPrivateBufferedChanged
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/Modules/mediasource/SourceBuffer.cpp:143
10
WebCore::SourceBufferPrivate::updateBuffered
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/platform/graphics/SourceBufferPrivate.cpp:144
11
call
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebCore/platform/graphics/SourceBufferPrivate.cpp:772
12
WTF::NativePromise
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/WTF/Headers/wtf/Function.h:82
13
WTF::RunLoop::RunLoop
‎:
14
_FUN
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WTF/wtf/glib/RunLoopGLib.cpp:53
15
g_main_context_dispatch
‎/usr/src/debug/glib-2.0/1_2.74.6-r0/build/../glib-2.74.6/glib/gmain.c:3454
16
g_main_context_iterate
‎/usr/src/debug/glib-2.0/1_2.74.6-r0/build/../glib-2.74.6/glib/gmain.c:4248
17
g_main_loop_run
‎/usr/src/debug/glib-2.0/1_2.74.6-r0/build/../glib-2.74.6/glib/gmain.c:4448
18
WTF::RunLoop::run
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WTF/wtf/glib/RunLoopGLib.cpp:108
19
WebKit::WebProcessMain
‎/usr/src/debug/wpe-webkit/2.46.2-r0/build/../git/Source/WebKit/Shared/AuxiliaryProcessMain.h:72
20
__libc_start_call_main
‎/usr/src/debug/glibc/2.35-r1/git/csu/../sysdeps/nptl/libc_start_call_main.h:58
21
__libc_start_main_impl
‎/usr/src/debug/glibc/2.35-r1/git/csu/libc-start.c:389
22
_start
‎:
23
_dl_find_object_freeres
‎/usr/src/debug/glibc/2.35-r1/git/elf/dl-find_object.c:857
24
‎:

@emutavchi
emutavchi requested a review from eocanha August 7, 2026 15:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants