chromium-browser mishandles video playback, hanging the system

[perbilse]

Describe the bug
After I upgraded to Bullseye a few weeks ago I've been running into a video playback problem that hangs the system, requiring a reboot. The symptoms are identical to what's described in this gstreamer issue:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1729
And in an older issue here:
raspberrypi/linux#3791
The problem has to do with how chromium-browser handles some aspects of video playback; I don't know exactly which, but it may have to do with interrupting or terminating playback. Different sites and video players are more or less susceptible, and it's easier to trigger with Bing than eg Google/YouTube. The problem doesn't occur with regular chromium. Both the chromium and chromium-browser packages are the latest, and the system is otherwise up to date.

To reproduce
With a freshly booted system I start chromium-browser, go to Bing, search for something, click "Videos" in the menu, and then mouse randomly around, hovering to activate preview when one is available, then move on without actually watching the video. The raspinfo output in pastebin below contains dmesg output from one instance of doing this.

Expected behaviour
Uninterrupted system operation.

Actual behaviour
Error messages as shown in the dmesg output below soon appear, followed by more serious messages. At this point the browser becomes unresponsive. Other utilities, especially the GUI, also become unresponsive, and don't react to mouse actions. If a functioning terminal window is available it may be possible to issue a reboot, but this will often hang after the GUI has exited (if it gets that far). Sometimes the system will reboot after a delay (10-30 seconds), at other times it has to be powercycled. There has been occasional damage to the boot partition file system, requiring this to be restored.

System
https://pastebin.com/0d178bUU

Logs

[...]
[129401.142966] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 105984)
[129401.143380] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 105984)
[129401.147857] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 105984)
[129529.267017] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.268334] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.742572] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.743990] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.747799] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.749398] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.751118] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129529.751180] bcm2835-codec bcm2835-codec: bcm2835_codec_buf_prepare data will not fit into plane (1536 < 122880)
[129539.753991] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129539.754035] bcm2835-codec bcm2835-codec: bcm2835_codec_stop_streaming: Failed disabling i/p port, ret -62
[129541.770108] bcm2835-codec bcm2835-codec: bcm2835_codec_flush_buffers: Timeout waiting for buffers to be returned - 8 outstanding
[129541.770314] ------------[ cut here ]------------
[129541.770325] WARNING: CPU: 1 PID: 33013 at drivers/media/common/videobuf2/videobuf2-core.c:1995 __vb2_queue_cancel+0x1b8/0x220 [videobuf2_common]
[129541.770396] Modules linked in: xt_addrtype xt_tcpudp xt_REDIRECT xt_hl nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink rfcomm cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc libaes uinput joydev sg rpivid_hevc(C) brcmfmac brcmutil cfg80211 rfkill vc4 snd_soc_hdmi_codec si2157 bcm2835_v4l2(C) bcm2835_codec(C) bcm2835_isp(C) cec v3d bcm2835_mmal_vchiq(C) drm_kms_helper v4l2_mem2mem videobuf2_vmalloc videobuf2_dma_contig si2168 videobuf2_memops videobuf2_v4l2 gpu_sched videobuf2_common raspberrypi_hwmon snd_soc_core snd_compress i2c_brcmstb snd_bcm2835(C) snd_pcm_dmaengine dvb_usb_dvbsky m88ds3103 videodev vc_sm_cma(C) snd_pcm dvb_usb_v2 snd_timer dvb_core snd i2c_mux mc syscopyarea sysfillrect sysimgblt regmap_i2c fb_sys_fops uio_pdrv_genirq uio nvmem_rmem binfmt_misc drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6
[129541.770834] CPU: 1 PID: 33013 Comm: V4L2DecoderThre Tainted: G        WC        5.15.84-v8+ #1613
[129541.770850] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)
[129541.770862] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[129541.770875] pc : __vb2_queue_cancel+0x1b8/0x220 [videobuf2_common]
[129541.770910] lr : __vb2_queue_cancel+0x3c/0x220 [videobuf2_common]
[129541.770940] sp : ffffffc00b76baf0
[129541.770948] x29: ffffffc00b76baf0 x28: 0000000000000000 x27: ffffffc00b76bd28
[129541.770972] x26: 0000000000000000 x25: ffffff8140aca800 x24: ffffff8102c8ee28
[129541.770993] x23: 0000000000000001 x22: ffffffd980e989a8 x21: ffffff81bf36c298
[129541.771013] x20: ffffff81bf36c298 x19: ffffff81bf36c298 x18: 0000000000000005
[129541.771034] x17: 756f656d6954203a x16: ffffffd9802c76a8 x15: ffffff8109640030
[129541.771054] x14: ffffff804379d048 x13: 0000000000000000 x12: 0000000000000000
[129541.771074] x11: ffffff804379cff8 x10: ffffff8109640038 x9 : ffffffd9802c7598
[129541.771095] x8 : 000000000010000f x7 : 0000000000000000 x6 : ffffffc00b76b840
[129541.771115] x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffffffd981329000
[129541.771135] x2 : ffffffd981329078 x1 : 043bfe8238fbad00 x0 : 0000000000000008
[129541.771157] Call trace:
[129541.771164]  __vb2_queue_cancel+0x1b8/0x220 [videobuf2_common]
[129541.771195]  vb2_core_streamoff+0x2c/0xc8 [videobuf2_common]
[129541.771225]  vb2_streamoff+0x24/0x78 [videobuf2_v4l2]
[129541.771252]  v4l2_m2m_streamoff+0x44/0x130 [v4l2_mem2mem]
[129541.771284]  v4l2_m2m_ioctl_streamoff+0x20/0x30 [v4l2_mem2mem]
[129541.771310]  v4l_streamoff+0x2c/0x38 [videodev]
[129541.771407]  __video_do_ioctl+0x188/0x410 [videodev]
[129541.771484]  video_usercopy+0x310/0x7d0 [videodev]
[129541.771559]  video_ioctl2+0x20/0x38 [videodev]
[129541.771635]  v4l2_ioctl+0x48/0x68 [videodev]
[129541.771712]  __arm64_sys_ioctl+0xb0/0xf0
[129541.771743]  invoke_syscall+0x4c/0x110
[129541.771761]  el0_svc_common.constprop.3+0x98/0x120
[129541.771775]  do_el0_svc+0x2c/0x90
[129541.771788]  el0_svc+0x24/0x60
[129541.771802]  el0t_64_sync_handler+0x90/0xb8
[129541.771813]  el0t_64_sync+0x1a0/0x1a4
[129541.771826] ---[ end trace 7db3712405ddf16d ]---
[129541.771839] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000584016bc in active state
[129541.771865] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000e6bdd515 in active state
[129541.771881] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000abe92da7 in active state
[129541.771899] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000ba09ee67 in active state
[129541.771915] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000f18ae2eb in active state
[129541.771931] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000b0b3add5 in active state
[129541.771947] videobuf2_common: driver bug: stop_streaming operation is leaving buf 00000000408ded34 in active state
[129541.771962] videobuf2_common: driver bug: stop_streaming operation is leaving buf 0000000074232a35 in active state
[129544.874032] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129547.946107] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129551.018139] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129554.090173] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129557.162194] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129560.238223] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129563.306237] bcm2835_mmal_vchiq: timed out waiting for sync completion
[129566.378317] bcm2835_mmal_vchiq: timed out waiting for sync completion

Additional context

[nicoske]

I've observed exactly the same issue with WPEWebkit

[ph818]

I have these errors when casting from Chromium and from the android youtube app. I described them here raspberrypi/linux#3791