Closed Bug 1109549 Opened 5 years ago Closed 5 years ago

Mismatched free() / delete / delete [] in webrtc::RTCPReceiver::~RTCPReceiver()

Categories

(Core :: WebRTC, defect)

34 Branch
x86_64
Windows 8
defect
Not set

Tracking

()

RESOLVED INVALID

People

(Reporter: mitchwharper, Unassigned)

Details

(Keywords: valgrind)

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Build ID: 20141126041045



Actual results:

==6262== Mismatched free() / delete / delete []
==6262==    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6262==    by 0x40334D8: moz_free (mozalloc.cpp:46)
==6262==    by 0x845DD63: std::_Rb_tree<unsigned int, unsigned int, std::_Identity<unsigned int>, std::less<unsigned int>, std::allocator<unsigned int> >::_M_erase(std::_Rb_tree_node<unsigned int>*) (mozalloc.h:225)
==6262==    by 0x96EE3B6: webrtc::RTCPReceiver::~RTCPReceiver() (stl_tree.h:671)
==6262==    by 0x9701335: webrtc::ModuleRtpRtcpImpl::~ModuleRtpRtcpImpl() (rtp_rtcp_impl.cc:117)
==6262==    by 0x9701364: webrtc::ModuleRtpRtcpImpl::~ModuleRtpRtcpImpl() (rtp_rtcp_impl.cc:134)
==6262==    by 0x96D18B8: webrtc::ViEChannel::~ViEChannel() (scoped_ptr.h:154)
==6262==    by 0x96D19E6: webrtc::ViEChannel::~ViEChannel() (vie_channel.cc:258)
==6262==    by 0x96D331D: webrtc::ViEChannelManager::DeleteChannel(int) (vie_channel_manager.cc:284)
==6262==    by 0x96C69B3: webrtc::ViEBaseImpl::DeleteChannel(int) (vie_base_impl.cc:216)
==6262==    by 0x845460D: mozilla::WebrtcVideoConduit::~WebrtcVideoConduit() (VideoConduit.cpp:140)
==6262==    by 0x845494C: mozilla::WebrtcVideoConduit::~WebrtcVideoConduit() (VideoConduit.cpp:173)
==6262==  Address 0x3ab0caf0 is 0 bytes inside a block of size 40 alloc'd
==6262==    at 0x4C2B0E0: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6262==    by 0x8467F0A: std::_Rb_tree<unsigned int, unsigned int, std::_Identity<unsigned int>, std::less<unsigned int>, std::allocator<unsigned int> >::_M_copy(std::_Rb_tree_node<unsigned int> const*, std::_Rb_tree_node<unsigned int>*) (new_allocator.h:104)
==6262==    by 0x96EEB16: webrtc::RTCPReceiver::SetSsrcs(unsigned int, std::set<unsigned int, std::less<unsigned int>, std::allocator<unsigned int> > const&) (stl_tree.h:997)
==6262==    by 0x97008A1: webrtc::ModuleRtpRtcpImpl::SetRtcpReceiverSsrcs(unsigned int) (rtp_rtcp_impl.cc:1626)
==6262==    by 0x9700CC4: webrtc::ModuleRtpRtcpImpl::SetSendingStatus(bool) (rtp_rtcp_impl.cc:520)
==6262==    by 0x96D078A: webrtc::ViEChannel::StopSend() (vie_channel.cc:1654)
==6262==    by 0x96C6EDD: webrtc::ViEBaseImpl::StopSend(int) (vie_base_impl.cc:327)
==6262==    by 0x84545E0: mozilla::WebrtcVideoConduit::~WebrtcVideoConduit() (VideoConduit.cpp:137)
==6262==    by 0x845494C: mozilla::WebrtcVideoConduit::~WebrtcVideoConduit() (VideoConduit.cpp:173)
==6262==    by 0x84812C0: std::_Rb_tree<int, std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> >, std::_Select1st<std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> > >, std::less<int>, std::allocator<std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> > > >::_M_erase(std::_Rb_tree_node<std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> > >*) (MediaConduitInterface.h:197)
==6262==    by 0x848129E: std::_Rb_tree<int, std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> >, std::_Select1st<std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> > >, std::less<int>, std::allocator<std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> > > >::_M_erase(std::_Rb_tree_node<std::pair<int const, mozilla::RefPtr<mozilla::MediaSessionConduit> > >*) (stl_tree.h:1125)
==6262==    by 0x84827F4: sipcc::PeerConnectionMedia::~PeerConnectionMedia() (stl_tree.h:671)
Component: Untriaged → WebRTC
Product: Firefox → Core
Keywords: valgrind
Reproducible in Firefox 37
Invalid, caused by differential inlining of new vs delete.
Please use --show-mismatched-frees=no for the time being.
Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → INVALID
Group: core-security
You need to log in before you can comment on or make changes to this bug.