1153227 - WebRTC crashing in debug build - MOZ_CRASH() at memory/mozjemalloc/jemalloc.c:1610 (freeing DataBuffer in PipelineTransport runnable on SocketTransportService)

Status: RESOLVED DUPLICATE of bug 1153094

(Core :: WebRTC: Signaling, defect)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: stack trace and info

I can reproduce this consistently under OSX on a fresh pull of trunk.

STR:
1. Open http://jsfiddle.net/zy3e8rqo
2. Hit [Start] button and allow camera.

Expected result: my mug.
Actual result: crash.

See attached stacktrace. Crashes every time for me. Fairly debilitating.

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

I'm only able to make this crash in the debug build, so no mozregression range, but it feels very recent to me.

Comment 2

[Nils Ohlmeier [:drno]]

jib are you really experiencing this on 37, or was that just the browser you used for reporting?

Comment 3

[Nils Ohlmeier [:drno]]

I'm asking because I opened bug 1153094 yesterday, because I see the same thing, but in 40.

Comment 4

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Sorry that field seems to remember its value from last time I filed a bug.

Comment 5

[Martin Thomson [:mt:]]

I have the exact same problem, currently under debug.

Comment 6

[Martin Thomson [:mt:]]

OK, the theory was that ASAN would help.  It doesn't: the test that fails 100% without ASAN passes with ASAN.

ekr did discover that MediaPipeline is full of incorrect ScopeDeletePtr uses though.

Comment 7

[Martin Thomson [:mt:]]

Bisect reveals that bug 1150853 is the culprit.