1519535 - Crash in CFPasteboardPromiseDataUsingBlock

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect, P2, critical)

Description

[Marcia Knous [:marcia - needinfo? me/PTO 12/6-12/12)]]]

This bug was filed from the Socorro interface and is
report bp-a61fb8d4-1591-4b51-aa44-34bbf0190111.

Seen while reviewing nightly crash stats - 1 Mac crash so far in 20190110093854 with MOZ_CRASH(Unhandled exception) as the crash reason.

Top 10 frames of crashing thread:

0 XUL CrashReporter::TerminateHandler toolkit/crashreporter/nsExceptionHandler.cpp:1374
1 libc++abi.dylib std::__terminate
2 libc++abi.dylib __cxa_throw
3 libobjc.A.dylib objc_begin_catch
4 CoreFoundation CFPasteboardPromiseDataUsingBlock
5 CoreFoundation __CFStringDecodeByteStream3
6 XUL +[DeviceInfoIosObjC captureDeviceForIndex:] media/webrtc/trunk/webrtc/modules/video_capture/objc/device_info_objc.mm:50
7 XUL +[DeviceInfoIosObjC deviceNameForIndex:] media/webrtc/trunk/webrtc/modules/video_capture/objc/device_info_objc.mm:66
8 XUL webrtc::videocapturemodule::DeviceInfoIos::GetDeviceName media/webrtc/trunk/webrtc/modules/video_capture/objc/device_info.mm:92
9 XUL mozilla::media::LambdaRunnable<mozilla::camera::CamerasParent::RecvGetCaptureDevice dom/media/systemservices/CamerasParent.cpp:632

=============================================================

Comment 1

[Dan Minor [:dminor]]

This looks like a regression from the switchover to the newer OS X video capture code in Bug 1376873. The crashes on November 15th and December 10th with this signature appear to be same problem.

Comment 2

[Marcia Knous [:marcia - needinfo? me/PTO 12/6-12/12)]]]

All the URLs for these crashes are youtube - one example is https://www.youtube.com/watch?v=GIZWi8JZ0dQ. The crashes appear to be all 10.13 users as well.

Comment 3

[Tim Spurway [:tspurway]]

no recent crashes in 66

Comment 4

[Dan Minor [:dminor]]

Looking at the code at [1] and [2], I don't see anything in this function or any of the functions in the stack that ensure that index is less than the number of capture devices. The older video capture library used to do checks like this [3].

Since we get the number of capture devices and then ask for the device name in separate calls over IPC [4], it's not impossible that the number of capture devices has changed between getting the number and asking for the name, maybe if a device were unplugged.

[1] https://searchfox.org/mozilla-central/rev/00f3836a87b844b5e4bc82f698c559b9966e4be2/media/webrtc/trunk/webrtc/modules/video_capture/objc/device_info_objc.mm#51
[2] https://searchfox.org/mozilla-central/rev/00f3836a87b844b5e4bc82f698c559b9966e4be2/media/webrtc/trunk/webrtc/modules/video_capture/objc/device_info_objc.mm#66
[3] https://hg.mozilla.org/mozilla-central/file/e1faf5fa77a6/media/webrtc/trunk/webrtc/modules/video_capture/mac/avfoundation/video_capture_avfoundation_info_objc.mm#l231
[4] https://searchfox.org/mozilla-central/rev/00f3836a87b844b5e4bc82f698c559b9966e4be2/dom/media/webrtc/MediaEngineWebRTC.cpp#84

Comment 5

[Dan Minor [:dminor]]

Attachment: Bug 1519535 - Check that deviceNumber is valid in GetDeviceName; r=jib

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cc9a46d41684
Check that deviceNumber is valid in GetDeviceName; r=jib

Comment 7

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/cc9a46d41684