Closed
Bug 1109544
Opened 10 years ago
Closed 9 years ago
Mismatched free() / delete / delete [] in webrtc::ModuleRtpRtcpImpl::SetRtcpReceiverSsrcs
Categories
(Core :: WebRTC, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: mitchwharper, Unassigned)
Details
(Keywords: valgrind)
User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 Build ID: 20141126041045 Actual results: ==6262== Mismatched free() / delete / delete [] ==6262== at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==6262== by 0x40334D8: moz_free (mozalloc.cpp:46) ==6262== by 0x845DD63: std::_Rb_tree<unsigned int, unsigned int, std::_Identity<unsigned int>, std::less<unsigned int>, std::allocator<unsigned int> >::_M_erase(std::_Rb_tree_node<unsigned int>*) (mozalloc.h:225) ==6262== by 0x97008AE: webrtc::ModuleRtpRtcpImpl::SetRtcpReceiverSsrcs(unsigned int) (stl_tree.h:671) ==6262== by 0x9700ADB: webrtc::ModuleRtpRtcpImpl::ModuleRtpRtcpImpl(webrtc::RtpRtcp::Configuration const&) (rtp_rtcp_impl.cc:112) ==6262== by 0x9700BDB: webrtc::RtpRtcp::CreateRtpRtcp(webrtc::RtpRtcp::Configuration const&) (rtp_rtcp_impl.cc:57) ==6262== by 0x975182A: webrtc::voe::Channel::Channel(int, unsigned int, webrtc::Config const&) (channel.cc:1040) ==6262== by 0x97519A0: webrtc::voe::Channel::CreateChannel(webrtc::voe::Channel*&, int, unsigned int, webrtc::Config const&) (channel.cc:836) ==6262== by 0x9752852: webrtc::voe::ChannelManager::CreateChannelInternal(webrtc::Config const&) (channel_manager.cc:64) ==6262== by 0x97528BC: webrtc::voe::ChannelManager::CreateChannel() (channel_manager.cc:55) ==6262== by 0x975C495: webrtc::VoEBaseImpl::CreateChannel() (voe_base_impl.cc:540) ==6262== by 0x926CE62: mozilla::MediaEngineWebRTCAudioSource::Init() (MediaEngineWebRTCAudio.cpp:441) ==6262== Address 0x3a860460 is 0 bytes inside a block of size 40 alloc'd ==6262== at 0x4C2B0E0: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==6262== by 0x8467D43: std::pair<std::_Rb_tree_iterator<unsigned int>, bool> std::_Rb_tree<unsigned int, unsigned int, std::_Identity<unsigned int>, std::less<unsigned int>, std::allocator<unsigned int> >::_M_insert_unique<unsigned int const&>(unsigned int const&) (new_allocator.h:104) ==6262== by 0x9700843: webrtc::ModuleRtpRtcpImpl::SetRtcpReceiverSsrcs(unsigned int) (stl_set.h:463) ==6262== by 0x9700ADB: webrtc::ModuleRtpRtcpImpl::ModuleRtpRtcpImpl(webrtc::RtpRtcp::Configuration const&) (rtp_rtcp_impl.cc:112) ==6262== by 0x9700BDB: webrtc::RtpRtcp::CreateRtpRtcp(webrtc::RtpRtcp::Configuration const&) (rtp_rtcp_impl.cc:57) ==6262== by 0x975182A: webrtc::voe::Channel::Channel(int, unsigned int, webrtc::Config const&) (channel.cc:1040) ==6262== by 0x97519A0: webrtc::voe::Channel::CreateChannel(webrtc::voe::Channel*&, int, unsigned int, webrtc::Config const&) (channel.cc:836) ==6262== by 0x9752852: webrtc::voe::ChannelManager::CreateChannelInternal(webrtc::Config const&) (channel_manager.cc:64) ==6262== by 0x97528BC: webrtc::voe::ChannelManager::CreateChannel() (channel_manager.cc:55) ==6262== by 0x975C495: webrtc::VoEBaseImpl::CreateChannel() (voe_base_impl.cc:540) ==6262== by 0x926CE62: mozilla::MediaEngineWebRTCAudioSource::Init() (MediaEngineWebRTCAudio.cpp:441) ==6262== by 0x92687AF: mozilla::MediaEngineWebRTC::EnumerateAudioDevices(mozilla::MediaSourceType, nsTArray<nsRefPtr<mozilla::MediaEngineAudioSource> >*) (MediaEngineWebRTC.h:311)
Reporter | ||
Updated•10 years ago
|
OS: Windows 8 → Linux
Reporter | ||
Comment 1•10 years ago
|
||
Related, but a different method signature: ==6262== Mismatched free() / delete / delete [] ==6262== at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==6262== by 0x40334D8: moz_free (mozalloc.cpp:46) ==6262== by 0x845DD63: std::_Rb_tree<unsigned int, unsigned int, std::_Identity<unsigned int>, std::less<unsigned int>, std::allocator<unsigned int> >::_M_erase(std::_Rb_tree_node<unsigned int>*) (mozalloc.h:225) ==6262== by 0x96EEADA: webrtc::RTCPReceiver::SetSsrcs(unsigned int, std::set<unsigned int, std::less<unsigned int>, std::allocator<unsigned int> > const&) (stl_tree.h:860) ==6262== by 0x97008A1: webrtc::ModuleRtpRtcpImpl::SetRtcpReceiverSsrcs(unsigned int) (rtp_rtcp_impl.cc:1626) ==6262== by 0x9700CC4: webrtc::ModuleRtpRtcpImpl::SetSendingStatus(bool) (rtp_rtcp_impl.cc:520) ==6262== by 0x974FBFE: webrtc::voe::Channel::StartSend() (channel.cc:1405) ==6262== by 0x975CECA: webrtc::VoEBaseImpl::StartSend(int) (voe_base_impl.cc:757) ==6262== by 0x926D23D: mozilla::MediaEngineWebRTCAudioSource::Start(mozilla::SourceMediaStream*, int) (MediaEngineWebRTCAudio.cpp:348) ==6262== by 0x8E273D8: mozilla::MediaOperationTask::Run() (MediaManager.h:397) ==6262== by 0x800FAF3: MessageLoop::RunTask(Task*) (message_loop.cc:362) ==6262== by 0x801015D: MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) (message_loop.cc:370) ==6262== Address 0x3a8604d0 is 0 bytes inside a block of size 40 alloc'd ==6262== at 0x4C2B0E0: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==6262== by 0x8467F0A: std::_Rb_tree<unsigned int, unsigned int, std::_Identity<unsigned int>, std::less<unsigned int>, std::allocator<unsigned int> >::_M_copy(std::_Rb_tree_node<unsigned int> const*, std::_Rb_tree_node<unsigned int>*) (new_allocator.h:104) ==6262== by 0x96EEB16: webrtc::RTCPReceiver::SetSsrcs(unsigned int, std::set<unsigned int, std::less<unsigned int>, std::allocator<unsigned int> > const&) (stl_tree.h:997) ==6262== by 0x97008A1: webrtc::ModuleRtpRtcpImpl::SetRtcpReceiverSsrcs(unsigned int) (rtp_rtcp_impl.cc:1626) ==6262== by 0x9700ADB: webrtc::ModuleRtpRtcpImpl::ModuleRtpRtcpImpl(webrtc::RtpRtcp::Configuration const&) (rtp_rtcp_impl.cc:112) ==6262== by 0x9700BDB: webrtc::RtpRtcp::CreateRtpRtcp(webrtc::RtpRtcp::Configuration const&) (rtp_rtcp_impl.cc:57) ==6262== by 0x975182A: webrtc::voe::Channel::Channel(int, unsigned int, webrtc::Config const&) (channel.cc:1040) ==6262== by 0x97519A0: webrtc::voe::Channel::CreateChannel(webrtc::voe::Channel*&, int, unsigned int, webrtc::Config const&) (channel.cc:836) ==6262== by 0x9752852: webrtc::voe::ChannelManager::CreateChannelInternal(webrtc::Config const&) (channel_manager.cc:64) ==6262== by 0x97528BC: webrtc::voe::ChannelManager::CreateChannel() (channel_manager.cc:55) ==6262== by 0x975C495: webrtc::VoEBaseImpl::CreateChannel() (voe_base_impl.cc:540) ==6262== by 0x926CE62: mozilla::MediaEngineWebRTCAudioSource::Init() (MediaEngineWebRTCAudio.cpp:441)
Updated•10 years ago
|
Component: Untriaged → WebRTC
Product: Firefox → Core
Reporter | ||
Comment 2•10 years ago
|
||
Valgrind command: `G_SLICE=always-malloc valgrind --tool=memcheck --vex-iropt-register-updates=allregs-at-mem-access --smc-check=all-non-file ./firefox` on 34.0.5 release built for valgrind Steps taken: 1. Start the browser 2. Open a new tab 3. Visit https://www.webrtc-experiment.com/RTCMultiConnection/MultiRTC/ in two separate tabs 4. Input the same room ID for both instances 5. Enable video and audio on the second tab, and allow access 6. Share my microphone and camera 7. Switch to other tab 8. Enable video and audio on first tab 9. Share camera and microphone 10. Preview camera from second user (this is where the first jump on uninitialized memory occured) 11. Preview microphone from second user 12. Switch tabs 13. Preview camera and mic from first user 14. Exit browser
Comment 3•10 years ago
|
||
In another bug, jseward said these mismatched allocator reports in Valgrind are often bogus, so clearing the needinfos for now.
Flags: needinfo?(rjesup)
Reporter | ||
Comment 4•10 years ago
|
||
Reproducible in Firefox 37
Comment 5•9 years ago
|
||
Invalid, caused by differential inlining of new vs delete. Please use --show-mismatched-frees=no for the time being.
Status: UNCONFIRMED → RESOLVED
Closed: 9 years ago
Resolution: --- → INVALID
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•