1547278 - Assertion failure: false, at /builds/worker/workspace/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:493

Status: RESOLVED FIXED

(Core :: WebRTC, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 0ec836eceb96.

Assertion failure: false, at /builds/worker/workspace/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:493

rax = 0x000056516d6aae40 rdx = 0x0000000000000000
rcx = 0x00007fc7bccbdc5b rbx = 0x00007fc7aeb0e400
rsi = 0x00007fc7c8d848b0 rdi = 0x00007fc7c8d83680
rbp = 0x00007fc7b1b690d0 rsp = 0x00007fc7b1b69000
r8 = 0x00007fc7c8d848b0 r9 = 0x00007fc7b1b6a700
r10 = 0x0000000000000002 r11 = 0x0000000000000000
r12 = 0x00007fc7aeb0e650 r13 = 0x0000000000000001
r14 = 0x00007fc7b1b69058 r15 = 0x00007fc7ae74a420
rip = 0x00007fc7b8aafa8b
OS|Linux|0.0.0 Linux 4.18.0-17-generic #18~18.04.1-Ubuntu SMP Fri Mar 15 15:27:12 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|11
11|0|libxul.so|mozilla::MediaTransportHandlerSTS::ActivateTransport(std::string const&, std::string const&, std::string const&, unsigned long, std::string const&, std::string const&, nsTArray<unsigned char> const&, nsTArray<unsigned char> const&, SSLKEAType, bool, std::vector<mozilla::DtlsDigest, std::allocator<mozilla::DtlsDigest> > const&, bool)|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|487|0x29
11|1|libxul.so|mozilla::runnable_args_memfn<RefPtr<mozilla::MediaTransportHandler>, void (mozilla::MediaTransportHandler::)(std::string const&, std::string const&, std::string const&, unsigned long, std::string const&, std::string const&, nsTArray<unsigned char> const&, nsTArray<unsigned char> const&, SSLKEAType, bool, std::vector<mozilla::DtlsDigest, std::allocator<mozilla::DtlsDigest> > const&, bool), std::string, std::string, std::string, unsigned long, std::string, std::string, nsTArray<unsigned char>, nsTArray<unsigned char>, SSLKEAType, bool, std::vector<mozilla::DtlsDigest, std::allocator<mozilla::DtlsDigest> >, bool>::Run()|hg:hg.mozilla.org/mozilla-central:media/mtransport/runnable_utils.h:0ec836eceb969c548067cee6de2ea213513a43d5|148|0x74
11|2|libxul.so|nsThread::ProcessNextEvent(bool, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|1180|0x15
11|3|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|486|0x11
11|4|libxul.so|mozilla::net::nsSocketTransportService::Run()|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsSocketTransportService2.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|1013|0x5
11|5|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|1180|0x15
11|6|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|486|0x11
11|7|libxul.so|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|333|0xd
11|8|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0ec836eceb969c548067cee6de2ea213513a43d5|315|0x17
11|9|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0ec836eceb969c548067cee6de2ea213513a43d5|290|0x8
11|10|libxul.so|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0ec836eceb969c548067cee6de2ea213513a43d5|454|0x38
11|11|libnspr4.so|_pt_root|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:0ec836eceb969c548067cee6de2ea213513a43d5|201|0x7
11|12|libpthread-2.27.so||||0x76db
11|13|libc-2.27.so|clone|||0x3f

Comment 1

[Alastor Wu [:alwu]]

Hi, Byron,
Because you've worked on this file before, may you have a look for this assertion failure?
Thank you!

Comment 2

[Byron Campen [:bwc]]

This is going to be safe in release, so it looks like it might just be a bad assertion. I'll look into it more deeply.

Comment 3

[Byron Campen [:bwc]]

I've found a minimal fiddle for this here: https://jsfiddle.net/fxyt89Lw/

This seems to be related to the implicit rollback performed during a repeated setLocalDescription.

Comment 4

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

Adding a priority to get this out of triage queue. Please update as appropriate.

Comment 5

[Byron Campen [:bwc]]

Attachment: Bug 1547278 - Part 0: Test case for the bug. r?jib

Comment 6

[Byron Campen [:bwc]]

Attachment: Bug 1547278 - Part 1: Ensure that transports are created for a repeated sLD(offer). r?mjf

Depends on D29404

Comment 7

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=a1acc21d5bb235ac96357f4c1fa3c970cb095a97

Comment 8

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=c5d9b1f719a14ac1e552dfc67dfd46520419d1fa

Comment 9

[Byron Campen [:bwc]]

Try in comment 7 looks good. Try in comment 8 is for a review change.

Comment 10

[Byron Campen [:bwc]]

Try looks good.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7b505a8a1ad9
Part 0: Test case for the bug. r=jib
https://hg.mozilla.org/integration/autoland/rev/6df281b93888
Part 1: Ensure that transports are created for a repeated sLD(offer). r=mjf

Comment 12

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/7b505a8a1ad9
https://hg.mozilla.org/mozilla-central/rev/6df281b93888

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/16707 for changes under testing/web-platform/tests