1582190 - Crash in [@ mozilla::PeerConnectionImpl::GetDatachannelParameters]

Status: RESOLVED FIXED

(Core :: WebRTC: Signaling, defect, P2)

Description

[Byron Campen [:bwc]]

This bug is for crash report bp-7eff701d-b283-41cd-93cf-dab630190915.

Top 10 frames of crashing thread:

0 xul.dll nsresult mozilla::PeerConnectionImpl::GetDatachannelParameters media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:912
1 xul.dll nsresult mozilla::PeerConnectionImpl::InitializeDataChannel media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:1024
2 xul.dll mozilla::PeerConnectionImpl::SetSignalingState_m media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:2261
3 xul.dll mozilla::PeerConnectionImpl::SetLocalDescription media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:1303
4 xul.dll static bool mozilla::dom::PeerConnectionImpl_Binding::setLocalDescription dom/bindings/PeerConnectionImplBinding.cpp:227
5 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3181
6 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:540
7 xul.dll static bool InternalCall js/src/vm/Interpreter.cpp:595
8 xul.dll static bool Interpret js/src/vm/Interpreter.cpp:3088
9 xul.dll js::RunScript js/src/vm/Interpreter.cpp:425

Looks like a nullptr crash, perhaps caused by not checking whether a JsepTransceiver is closed before trying to get transport parameters out of it.

Comment 1

[Byron Campen [:bwc]]

Yeah, the transport object does not necessarily live on the datachannel transceiver. This code is just broken. I'm going to write some tests.

Comment 2

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=64ce10d00830c276638bfb03d37a570e006833a8

Comment 3

[Byron Campen [:bwc]]

Attachment: Bug 1582190: Add test-case that reproduces this bug. r?jib

Comment 4

[Byron Campen [:bwc]]

Attachment: Bug 1582190: Get transport-related parameters for datachannel from the bundle-tag, if bundle is being used. r?mjf

Depends on D46355

Comment 5

[Byron Campen [:bwc]]

Attachment: Bug 1582190: Close DataChannelConnection when datachannel negotiation fails for some reason. r?ng

Depends on D46356

Comment 6

[Byron Campen [:bwc]]

Try looks good.

Comment 7

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=570fb3794adcf1fbec4ff97afb6a284aefb68440

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/650cdeb64391
Add test-case that reproduces this bug. r=jib
https://hg.mozilla.org/integration/autoland/rev/298906d6f07e
Get transport-related parameters for datachannel from the bundle-tag, if bundle is being used. r=mjf
https://hg.mozilla.org/integration/autoland/rev/147fe8671a55
Close DataChannelConnection when datachannel negotiation fails for some reason. r=ng

Comment 9

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Failed to create upstream wpt PR due to merge conflicts. This requires fixup from a wpt sync admin.

Comment 10

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/19468 for changes under testing/web-platform/tests

Comment 11

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream web-platform-tests status checks passed, PR will merge once commit reaches central.

Comment 12

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/650cdeb64391
https://hg.mozilla.org/mozilla-central/rev/298906d6f07e
https://hg.mozilla.org/mozilla-central/rev/147fe8671a55

Comment 13

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot