1692823 - Crash in [@ mozilla::AudioInputTrack::DestroyImpl]

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect, P1)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/10896b03-665a-4a68-88b2-06fb70210215

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll mozilla::AudioInputTrack::DestroyImpl dom/media/webrtc/MediaEngineWebRTCAudio.cpp:1264
1 xul.dll mozilla::MediaTrack::Destroy::Message::RunDuringShutdown dom/media/MediaTrackGraph.cpp:2043
2 xul.dll mozilla::MediaTrackGraphImpl::AppendMessage dom/media/MediaTrackGraph.cpp:1865
3 xul.dll mozilla::MediaTrack::Destroy dom/media/MediaTrackGraph.cpp:2054
4 xul.dll mozilla::AudioInputTrack::Destroy dom/media/webrtc/MediaEngineWebRTCAudio.cpp:1229
5 xul.dll mozilla::dom::MediaStreamTrackSource::UnregisterSink dom/media/MediaStreamTrack.h:233
6 xul.dll mozilla::dom::MediaStreamTrack::SetReadyState dom/media/MediaStreamTrack.cpp:546
7 xul.dll mozilla::dom::AudioStreamTrack::SetReadyState dom/media/AudioStreamTrack.cpp:69
8 xul.dll mozilla::dom::MediaStreamTrack::Destroy dom/media/MediaStreamTrack.cpp:239
9 xul.dll mozilla::dom::MediaStreamTrack::cycleCollection::Unlink dom/media/MediaStreamTrack.cpp:254

It seems like we're writing through a NULL pointer, all platforms appear to be affected.

Comment 1

[Gabriele Svelto [:gsvelto]]

Inspecting a minidump it seems that the crash is actually happening here and mInputProcessing is NULL.

Comment 2

[Michael Froman [:mjf]]

Andreas, is there any reason not to check mInputProcessing for null before calling ```End()``, or is this pointing to a larger issue?

Comment 3

[Andreas Pehrson [:pehrsons]]

I think we should check mInputProcessing for null here. There's plenty of indirection between creating the AudioInputTrack and setting AudioInputProcessing on it. It seems likely that it could be destroyed in between, by at least shutdown.

Comment 4

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1692823 - Only end AudioInputProcessing if it has been set. r?padenot

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/59fb95311b12
Only end AudioInputProcessing if it has been set. r=padenot

Comment 6

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/59fb95311b12