1517369 - Fatal error in src/media/webrtc/trunk/webrtc/video/video_send_stream.cc, line 797 # last system error: 1

Status: RESOLVED FIXED

(Core :: WebRTC, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

# Fatal error in src/media/webrtc/trunk/webrtc/video/video_send_stream.cc, line 797
# last system error: 1
# Check failed: 0 == rtp_rtcp->RegisterSendRtpHeaderExtension( StringToRtpExtensionType(extension), id) (0 vs. -1)

==23670==ERROR: AddressSanitizer: ABRT on unknown address 0x03e800005c76 (pc 0x7f641542f428 bp 0x7f639b1fbf50 sp 0x7f639b1fbd68 T79)
    #0 0x7f641542f427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/signal/../sysdeps/unix/sysv/linux/raise.c:54
    #1 0x7f6415431029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89
    #2 0x7f63ff1b23aa in rtc::FatalMessage::~FatalMessage() src/media/webrtc/trunk/webrtc/rtc_base/checks.cc:69:3
    #3 0x7f63ff244d46 in webrtc::internal::VideoSendStreamImpl::VideoSendStreamImpl(webrtc::SendStatisticsProxy*, rtc::TaskQueue*, webrtc::CallStats*, webrtc::RtpTransportControllerSendInterface*, webrtc::BitrateAllocator*, webrtc::SendDelayStats*, webrtc::VideoStreamEncoder*, webrtc::RtcEventLog*, webrtc::VideoSendStream::Config const*, int, std::map<unsigned int, webrtc::RtpState, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, webrtc::RtpState> > >, std::map<unsigned int, webrtc::RtpPayloadState, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, webrtc::RtpPayloadState> > >, webrtc::VideoEncoderConfig::ContentType) src/media/webrtc/trunk/webrtc/video/video_send_stream.cc:796:7
    #4 0x7f63ff2512bb in webrtc::internal::VideoSendStream::ConstructionTask::Run() src/media/webrtc/trunk/webrtc/video/video_send_stream.cc:417:29
    #5 0x7f63ff1dc0ac in rtc::TaskQueue::Impl::OnWakeup(int, short, void*) src/media/webrtc/trunk/webrtc/rtc_base/task_queue_libevent.cc:438:18
    #6 0x7f63f2470b77 in event_persist_closure src/ipc/chromium/src/third_party/libevent/event.c:1580:9
    #7 0x7f63f2470b77 in event_process_active_single_queue src/ipc/chromium/src/third_party/libevent/event.c:1639
    #8 0x7f63f24689a5 in event_process_active src/ipc/chromium/src/third_party/libevent/event.c
    #9 0x7f63f24689a5 in event_base_loop src/ipc/chromium/src/third_party/libevent/event.c:1961
    #10 0x7f63ff1db98c in rtc::TaskQueue::Impl::ThreadMain(void*) src/media/webrtc/trunk/webrtc/rtc_base/task_queue_libevent.cc:407:5
    #11 0x7f63ff1cbc15 in rtc::PlatformThread::Run() src/media/webrtc/trunk/webrtc/rtc_base/platform_thread.cc:242:5
    #12 0x7f63ff1cb30c in rtc::PlatformThread::StartThread(void*) src/media/webrtc/trunk/webrtc/rtc_base/platform_thread.cc:158:40
    #13 0x7f64164846b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #14 0x7f641550141c in clone /build/glibc-Cl5G7W/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Jonathan Watt [:jwatt]]

Alex, how is column layout involved in this testcase? Is this two separate bugs, or is it taking a bad code path in the column code that results in the WebRTC issues?

Additionally, if you have a decent understanding of what's happening here, could you set the Importance field of the bug?

Comment 2

[Tyson Smith [:tsmith]]

I'd like to note that the "Assertion failure: columnSet->IsColumnSetFrame(), at src/layout/generic/ColumnSetWrapperFrame.cpp:42" line was a copypaste error and was not part of the error message.

Comment 3

[Alex Chronopoulos [:achronop]]

Sorry about that, the triage list is huge after pto and I did it fast. I moved it in your component due to the assertion error mentioned above. I looked again, carefully, and I've realized the actual error is something else. Thanks.

Comment 4

[Dan Minor [:dminor]]

The SDP here contains:

a=extmap:2 urn:ietf:params:rtp-hdrext:toffset
a=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time

i.e. the extension id is repeated. According to RFC 8285:

A usable mapping MUST use IDs in the valid range, and each ID in this
range MUST be used only once for each media section (or only once if
the mappings are session level).  Mappings that do not conform to
these rules MAY be presented, for instance, during SDP Offer/Answer
[RFC3264] negotiation as described in the next section, but remapping
to conformant values is necessary before they can be applied.

so we need to remap the ids prior to getting to this point. We'll also fail the assertion here if an id is outside the valid range of 1 to 14.

Comment 5

[Dan Minor [:dminor]]

Attachment: Bug 1517369 - Check for invalid rtp extension ids; r=bwc!

This adds checks for invalid and duplicated rtp extension ids to
JsepSessionImpl. Since the version of webrtc.org we're using does not support
two byte extension ids, ids must be between 1 and 14 inclusive. Duplicated
extension ids are also disallowed by RFC 8285. Passing an invalid extension id
into the webrtc.org code will trigger a release assertion and a browser crash.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/98c7a85974c5
Check for invalid rtp extension ids; r=bwc

Comment 7

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/98c7a85974c5