Setting local offer, then transceiver.stop(), then local rollback, then a remote offer, then addIceCandidate can cause nullptr crashes

RESOLVED FIXED in Firefox 68

Status

()

defect
P1
normal
RESOLVED FIXED
2 months ago
2 months ago

People

(Reporter: bwc, Assigned: bwc)

Tracking

unspecified
mozilla68
Points:
---

Firefox Tracking Flags

(firefox68 fixed)

Details

Attachments

(2 attachments)

Assignee

Description

2 months ago
No description provided.
Assignee

Updated

2 months ago
Summary: transceiver.stop(), followed by local rollback, followed by a remote offer, followed by addIceCandidate can cause nullptr crashes → Setting local offer, then transceiver.stop(), then local rollback, then a remote offer, then addIceCandidate can cause nullptr crashes
Assignee

Comment 1

2 months ago

Depends on D26932

Comment 4

2 months ago
Pushed by bcampen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b271704f20f7
Part 0: Test-case for the bug. r=jib
https://hg.mozilla.org/integration/autoland/rev/be0d3112f763
Part 1: Do not prevent rollback from disassociating a stopped transceiver. r=mjf

Comment 5

2 months ago
bugherder
Status: NEW → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/16622 for changes under testing/web-platform/tests
You need to log in before you can comment on or make changes to this bug.