Closed Bug 1263667 Opened 8 years ago Closed 8 years ago

Crash [@ sigslot::_signal_base4<T>::disconnect_all]

Categories

(Core :: WebRTC, defect, P1)

Product:
Core
Component:
WebRTC
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox47 --- unaffected
firefox48 --- fixed

People

(Reporter: standard8, Assigned: mjf)

References

Details

(Keywords: crash, regression, Whiteboard: [fixed by bug 1264344])

Crash Data

This has started happening permanently on Loop's functional tests today on Linux. They are running on a ubuntu machine on a slowish machine. Running locally on my Mac I've only been able to reproduce once.

Likely a regression from bug 906986 as that fits the possible ranges for nightly.

The functional tests are:

- Starting up Firefox, creating a Loop room
- Entering the room as the link generator
- Also entering the room as the link clicker within the same Firefox instance
- Checking the media is connected
- Disconnecting media

At this last stage, it appears to crash. Here's the stack:

PROCESS-CRASH | runner.py | application crashed [@ sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::disconnect_all]
Crash dump filename: /tmp/tmp1aDuKJ.mozrunner/minidumps/182d0fc5-6984-22d3-77f47b77-5eb454cf.dmp
Operating system: Linux
                  0.0.0 Linux 3.13.0-83-generic #127-Ubuntu SMP Fri Mar 11 00:25:37 UTC 2016 x86_64
CPU: amd64
     family 6 model 45 stepping 7
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 3 (crashed)
 0  libxul.so!sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::disconnect_all [sigslot.h:e847cfcb315f : 1150 + 0x13]
    rbx = 0x00002aaf81efdd60   r12 = 0x00002aaf81efdd70
    r13 = 0x00002aaf81efdd68   r14 = 0x00002aaf81efdd70
    r15 = 0x00002aaf92d4f500   rip = 0x00002aaf70b6cf8d
    rsp = 0x00002aaf7c108800   rbp = 0x00002aaf7c108830
    Found by: given as instruction pointer in context
 1  libxul.so!sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::~_signal_base4 [sigslot.h:e847cfcb315f : 1131 + 0x4]
    rbx = 0x00002aaf81efdd60   r12 = 0x00002aaf81efdd70
    r13 = 0x00002aaf74309890   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b6d00b
    rsp = 0x00002aaf7c108840   rbp = 0x00002aaf7c108860
    Found by: call frame info
 2  libxul.so!mozilla::NrIceMediaStream::~NrIceMediaStream [sigslot.h:e847cfcb315f : 2494 + 0x1e]
    rbx = 0x00002aaf81efdd00   r12 = 0x00002aaf743098c0
    r13 = 0x00002aaf74309890   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b6d0f7
    rsp = 0x00002aaf7c108870   rbp = 0x00002aaf7c1088a0
    Found by: call frame info
 3  libxul.so!mozilla::NrIceMediaStream::Release [nricemediastream.h:e847cfcb315f : 201 + 0xc]
    rbx = 0x00002aaf81efdd00   r12 = 0x00002aaf90ad2e20
    r13 = 0x00002aaf90ad2e38   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b29f87
    rsp = 0x00002aaf7c1088b0   rbp = 0x00002aaf7c1088c0
    Found by: call frame info
 4  libxul.so!mozilla::NrIceCtx::~NrIceCtx [RefPtr.h:e847cfcb315f : 39 + 0x4]
    rbx = 0x00002aaf81efd040   r12 = 0x00002aaf90ad2e20
    r13 = 0x00002aaf90ad2e38   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b6b485
    rsp = 0x00002aaf7c1088d0   rbp = 0x00002aaf7c108a80
    Found by: call frame info
 5  libxul.so!mozilla::NrIceCtx::~NrIceCtx [nricectx.cpp:e847cfcb315f : 673 + 0x4]
    rbx = 0x00002aaf81efd040   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b6b55a
    rsp = 0x00002aaf7c108a90   rbp = 0x00002aaf7c108aa0
    Found by: call frame info
 6  libxul.so!mozilla::NrIceCtx::Release [nricectx.h:e847cfcb315f : 331 + 0xd]
    rbx = 0x00002aaf81efd040   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b29fc3
    rsp = 0x00002aaf7c108ab0   rbp = 0x00002aaf7c108ac0
    Found by: call frame info
 7  libxul.so!mozilla::NrIceCtxHandler::Release [RefPtr.h:e847cfcb315f : 39 + 0x4]
    rbx = 0x00002aaf90a66100   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b42dee
    rsp = 0x00002aaf7c108ad0   rbp = 0x00002aaf7c108ae0
    Found by: call frame info
 8  libxul.so!mozilla::PeerConnectionMedia::ShutdownMediaTransport_s [RefPtr.h:e847cfcb315f : 39 + 0x4]
    rbx = 0x00002aaf8b151de0   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b46a05
    rsp = 0x00002aaf7c108af0   rbp = 0x00002aaf7c108b00
    Found by: call frame info
 9  libxul.so!mozilla::runnable_args_memfn<mozilla::PeerConnectionMedia*, void (mozilla::PeerConnectionMedia::*)()>::Run [runnable_utils.h:e847cfcb315f : 102 + 0x12]
    rbx = 0x00002aaf674453a8   r12 = 0x00002aaf7c108bc0
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf70b4061b
    rsp = 0x00002aaf7c108b10   rbp = 0x00002aaf7c108b10
    Found by: call frame info
10  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:e847cfcb315f : 994 + 0x1]
    rbx = 0x00002aaf674453a8   r12 = 0x00002aaf7c108bc0
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x00002aaf6747e310   rip = 0x00002aaf723420a2
    rsp = 0x00002aaf7c108b20   rbp = 0x00002aaf7c108ba0
    Found by: call frame info
11  libxul.so!NS_ProcessNextEvent [nsThreadUtils.cpp:e847cfcb315f : 297 + 0xd]
    rbx = 0x00002aaf6747e300   r12 = 0x00002aaf6747e3e4
    r13 = 0x0000000000000000   r14 = 0x00002aaf7c108c80
    r15 = 0x0000000000000001   rip = 0x00002aaf7235402c
    rsp = 0x00002aaf7c108bb0   rbp = 0x00002aaf7c108be0
    Found by: call frame info
12  libxul.so!nsSocketTransportService::Run [nsSocketTransportService2.cpp:e847cfcb315f : 943 + 0x4]
    rbx = 0x00002aaf6747e300   r12 = 0x00002aaf6747e3e4
    r13 = 0x0000000000000000   r14 = 0x00002aaf7c108c80
    r15 = 0x0000000000000001   rip = 0x00002aaf7237d766
    rsp = 0x00002aaf7c108bf0   rbp = 0x00002aaf7c108cc0
    Found by: call frame info
13  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:e847cfcb315f : 994 + 0x1]
    rbx = 0x00002aaf674453a8   r12 = 0x00002aaf7c108d70
    r13 = 0x0000000000000000   r14 = 0x00002aaf67445390
    r15 = 0x0000000000000000   rip = 0x00002aaf723420a2
    rsp = 0x00002aaf7c108cd0   rbp = 0x00002aaf7c108d50
    Found by: call frame info
14  libxul.so!NS_ProcessNextEvent [nsThreadUtils.cpp:e847cfcb315f : 297 + 0xd]
    rbx = 0x00002aaf6746d540   r12 = 0x00002aaf7c2ec040
    r13 = 0x00002aaf67445390   r14 = 0x00002aaf74297750
    r15 = 0x00002aaf7c2ec060   rip = 0x00002aaf7235402c
    rsp = 0x00002aaf7c108d60   rbp = 0x00002aaf7c108d90
    Found by: call frame info
15  libxul.so!mozilla::ipc::MessagePumpForNonMainThreads::Run [MessagePump.cpp:e847cfcb315f : 340 + 0x9]
    rbx = 0x00002aaf6746d540   r12 = 0x00002aaf7c2ec040
    r13 = 0x00002aaf67445390   r14 = 0x00002aaf74297750
    r15 = 0x00002aaf7c2ec060   rip = 0x00002aaf723a645a
    rsp = 0x00002aaf7c108da0   rbp = 0x00002aaf7c108df0
    Found by: call frame info
16  libxul.so!MessageLoop::Run [message_loop.cc:e847cfcb315f : 230 + 0x5]
    rbx = 0x00002aaf67445390   r12 = 0x00002aaf6746d540
    r13 = 0x00002aaf7c108e30   r14 = 0x00002aaf7c108e40
    r15 = 0x00002aaf674453a8   rip = 0x00002aaf72c72203
    rsp = 0x00002aaf7c108e00   rbp = 0x00002aaf7c108e20
    Found by: call frame info
17  libxul.so!nsThread::ThreadFunc [nsThread.cpp:e847cfcb315f : 396 + 0x7]
    rbx = 0x00002aaf67445390   r12 = 0x00002aaf6746d540
    r13 = 0x00002aaf7c108e30   r14 = 0x00002aaf7c108e40
    r15 = 0x00002aaf674453a8   rip = 0x00002aaf72b877cd
    rsp = 0x00002aaf7c108e30   rbp = 0x00002aaf7c108e80
    Found by: call frame info
18  libnspr4.so!_pt_root [ptthread.c:e847cfcb315f : 216 + 0x6]
    rbx = 0x00002aaf67467fe0   r12 = 0x0000000000000000
    r13 = 0x000000000000301a   r14 = 0x00002aaf7c109700
    r15 = 0x00002aaf7c109630   rip = 0x00002aaf67528bec
    rsp = 0x00002aaf7c108e90   rbp = 0x00002aaf7c108ed0
    Found by: call frame info
19  libpthread-2.19.so + 0x8181
    rbx = 0x00002aaf7c109700   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00002aaf7c1099c0
    r15 = 0x00002aaf7c109700   rip = 0x00002aaf6604a182
    rsp = 0x00002aaf7c108ee0   rbp = 0x0000000000000000
    Found by: call frame info
20  libc-2.19.so + 0xfa47c
    rip = 0x00002aaf66f8647d   rsp = 0x00002aaf7c108f80
    Found by: stack scanning
If I try this within the same Firefox instance (either a different window or different tab) when I click the "Join this conversation" button I always get the message "You're already in this conversation".  Can you explain how you make this work on the same Firefox instance?
Flags: needinfo?(standard8)
(In reply to Michael Froman [:mjf] from comment #1)
> Can you explain how you make this work on the same Firefox instance?

Bah, sorry I meant to add it yesterday and forgot.

For testing locally in your own profile, you can change loop.linkClicker.url to any random url that's not the default one.

If you want to test with the functional tests themselves, then you can do the following. Note I've only reproduced this once or twice on my Mac locally, though the automation on linux is crashing virtually every time.

- Checkout https://github.com/mozilla/loop
- make install
- make build
- TEST_SERVER=dev TEST_BROWSER=/path/to/firefox make functional

More details around functional here: https://github.com/mozilla/loop/blob/master/docs/Developing.md#functional-tests
Flags: needinfo?(standard8)
Adding stacks from bug 1263929.
Crash Signature: [@sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::disconnect_all] → [@sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::disconnect_all] [@sigslot::_signal_base4<T>::disconnect_all] [@sigslot::_signal_base2<T>::disconnect_all] [@sigslot::_signal_base4<T>::~_sig…
Summary: Crash [@ sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::disconnect_all] → Crash [@ sigslot::_signal_base4<T>::disconnect_all]
Assignee: nobody → mfroman
Rank: 10
Priority: -- → P1
Seems that bug 1264344 fixed this. Thanks Michael.
Status: NEW → RESOLVED
Closed: 8 years ago
Depends on: 1264344
Resolution: --- → FIXED
Whiteboard: [fixed by bug 1264344]
You need to log in before you can comment on or make changes to this bug.