Closed Bug 1692823 Opened 8 months ago Closed 8 months ago

Crash in [@ mozilla::AudioInputTrack::DestroyImpl]

Categories

(Core :: WebRTC: Audio/Video, defect, P1)

Firefox 84
Unspecified
All
defect

Tracking

()

RESOLVED FIXED
87 Branch
Tracking Status
firefox-esr78 --- unaffected
firefox85 --- wontfix
firefox86 --- wontfix
firefox87 --- fixed

People

(Reporter: gsvelto, Assigned: pehrsons)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Crash report: https://crash-stats.mozilla.org/report/index/10896b03-665a-4a68-88b2-06fb70210215

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll mozilla::AudioInputTrack::DestroyImpl dom/media/webrtc/MediaEngineWebRTCAudio.cpp:1264
1 xul.dll mozilla::MediaTrack::Destroy::Message::RunDuringShutdown dom/media/MediaTrackGraph.cpp:2043
2 xul.dll mozilla::MediaTrackGraphImpl::AppendMessage dom/media/MediaTrackGraph.cpp:1865
3 xul.dll mozilla::MediaTrack::Destroy dom/media/MediaTrackGraph.cpp:2054
4 xul.dll mozilla::AudioInputTrack::Destroy dom/media/webrtc/MediaEngineWebRTCAudio.cpp:1229
5 xul.dll mozilla::dom::MediaStreamTrackSource::UnregisterSink dom/media/MediaStreamTrack.h:233
6 xul.dll mozilla::dom::MediaStreamTrack::SetReadyState dom/media/MediaStreamTrack.cpp:546
7 xul.dll mozilla::dom::AudioStreamTrack::SetReadyState dom/media/AudioStreamTrack.cpp:69
8 xul.dll mozilla::dom::MediaStreamTrack::Destroy dom/media/MediaStreamTrack.cpp:239
9 xul.dll mozilla::dom::MediaStreamTrack::cycleCollection::Unlink dom/media/MediaStreamTrack.cpp:254

It seems like we're writing through a NULL pointer, all platforms appear to be affected.

Inspecting a minidump it seems that the crash is actually happening here and mInputProcessing is NULL.

Component: Audio/Video → WebRTC: Audio/Video

Andreas, is there any reason not to check mInputProcessing for null before calling ```End()``, or is this pointing to a larger issue?

Flags: needinfo?(apehrson)
Severity: -- → S3
Priority: -- → P1

I think we should check mInputProcessing for null here. There's plenty of indirection between creating the AudioInputTrack and setting AudioInputProcessing on it. It seems likely that it could be destroyed in between, by at least shutdown.

Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)
Keywords: regression
Regressed by: 1651745
Version: unspecified → Firefox 84
Pushed by pehrsons@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/59fb95311b12
Only end AudioInputProcessing if it has been set. r=padenot
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → 87 Branch
You need to log in before you can comment on or make changes to this bug.