Closed Bug 1547278 Opened 2 years ago Closed 2 years ago

Assertion failure: false, at /builds/worker/workspace/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:493

Categories

(Core :: WebRTC, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla68
Tracking Status
firefox-esr60 --- wontfix
firefox67 --- wontfix
firefox68 --- fixed

People

(Reporter: jkratzer, Assigned: bwc)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 0ec836eceb96.

Assertion failure: false, at /builds/worker/workspace/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:493

rax = 0x000056516d6aae40 rdx = 0x0000000000000000
rcx = 0x00007fc7bccbdc5b rbx = 0x00007fc7aeb0e400
rsi = 0x00007fc7c8d848b0 rdi = 0x00007fc7c8d83680
rbp = 0x00007fc7b1b690d0 rsp = 0x00007fc7b1b69000
r8 = 0x00007fc7c8d848b0 r9 = 0x00007fc7b1b6a700
r10 = 0x0000000000000002 r11 = 0x0000000000000000
r12 = 0x00007fc7aeb0e650 r13 = 0x0000000000000001
r14 = 0x00007fc7b1b69058 r15 = 0x00007fc7ae74a420
rip = 0x00007fc7b8aafa8b
OS|Linux|0.0.0 Linux 4.18.0-17-generic #18~18.04.1-Ubuntu SMP Fri Mar 15 15:27:12 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|11
11|0|libxul.so|mozilla::MediaTransportHandlerSTS::ActivateTransport(std::string const&, std::string const&, std::string const&, unsigned long, std::string const&, std::string const&, nsTArray<unsigned char> const&, nsTArray<unsigned char> const&, SSLKEAType, bool, std::vector<mozilla::DtlsDigest, std::allocator<mozilla::DtlsDigest> > const&, bool)|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|487|0x29
11|1|libxul.so|mozilla::runnable_args_memfn<RefPtr<mozilla::MediaTransportHandler>, void (mozilla::MediaTransportHandler::)(std::string const&, std::string const&, std::string const&, unsigned long, std::string const&, std::string const&, nsTArray<unsigned char> const&, nsTArray<unsigned char> const&, SSLKEAType, bool, std::vector<mozilla::DtlsDigest, std::allocator<mozilla::DtlsDigest> > const&, bool), std::string, std::string, std::string, unsigned long, std::string, std::string, nsTArray<unsigned char>, nsTArray<unsigned char>, SSLKEAType, bool, std::vector<mozilla::DtlsDigest, std::allocator<mozilla::DtlsDigest> >, bool>::Run()|hg:hg.mozilla.org/mozilla-central:media/mtransport/runnable_utils.h:0ec836eceb969c548067cee6de2ea213513a43d5|148|0x74
11|2|libxul.so|nsThread::ProcessNextEvent(bool, bool
)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|1180|0x15
11|3|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|486|0x11
11|4|libxul.so|mozilla::net::nsSocketTransportService::Run()|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsSocketTransportService2.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|1013|0x5
11|5|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|1180|0x15
11|6|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|486|0x11
11|7|libxul.so|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|333|0xd
11|8|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0ec836eceb969c548067cee6de2ea213513a43d5|315|0x17
11|9|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0ec836eceb969c548067cee6de2ea213513a43d5|290|0x8
11|10|libxul.so|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|454|0x38
11|11|libnspr4.so|_pt_root|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:0ec836eceb969c548067cee6de2ea213513a43d5|201|0x7
11|12|libpthread-2.27.so||||0x76db
11|13|libc-2.27.so|clone|||0x3f

Flags: in-testsuite?

Hi, Byron,
Because you've worked on this file before, may you have a look for this assertion failure?
Thank you!

Flags: needinfo?(docfaraday)

This is going to be safe in release, so it looks like it might just be a bad assertion. I'll look into it more deeply.

Assignee: nobody → docfaraday
Flags: needinfo?(docfaraday)

I've found a minimal fiddle for this here: https://jsfiddle.net/fxyt89Lw/

This seems to be related to the implicit rollback performed during a repeated setLocalDescription.

Adding a priority to get this out of triage queue. Please update as appropriate.

Priority: -- → P3
Rank: 18
Priority: P3 → P2

Try in comment 7 looks good. Try in comment 8 is for a review change.

Try looks good.

Pushed by bcampen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/7b505a8a1ad9
Part 0: Test case for the bug. r=jib
https://hg.mozilla.org/integration/autoland/rev/6df281b93888
Part 1: Ensure that transports are created for a repeated sLD(offer). r=mjf
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/16707 for changes under testing/web-platform/tests
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.