1763654 - Crash in [@ mozilla::dom::ToJSValue | mozilla::dom::PeerConnectionImpl_Binding::getStats_promiseWrapper]

Status: VERIFIED FIXED

(Core :: WebRTC: Signaling, defect)

Description

[Calixte Denizet (:calixte)]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/5fe807e2-918e-4fc4-adb2-368a30220406

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 4 frames of crashing thread:

0 xul.dll mozilla::dom::ToJSValue dom/bindings/ToJSValue.cpp:64
1 xul.dll mozilla::dom::PeerConnectionImpl_Binding::getStats_promiseWrapper dom/bindings/PeerConnectionImplBinding.cpp:398
2 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises> dom/bindings/BindingUtils.cpp:3270
3 None @0x000000cc9b8f18c9 

There are 10 crashes (from 9 installations) in nightly 101 starting with buildid 20220406093646. In looking at the pushlog for this build, it could be related to bug 1624989.

Comment 1

[Byron Campen [:bwc]]

This has been happening since before 20220406093646, although the frequency has increased substantially:

https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Adom%3A%3AToJSValue%20%7C%20mozilla%3A%3Adom%3A%3APeerConnectionImpl_Binding%3A%3AgetStats_promiseWrapper&date=%3E%3D2021-10-07T16%3A14%3A00.000Z&date=%3C2022-04-07T16%3A14%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1#reports

Comment 2

[Byron Campen [:bwc]]

I'm thinking that we're running into a situation where PeerConnectionImpl::GetStats returns a nullptr.

Comment 3

[Jim Mathies [:jimm]]

Here's an old test case from another bug that reproduced this for me on Windows -

https://nils-ohlmeier.github.io/webrtc-landing/pc_test_loop_h264.html

https://crash-stats.mozilla.org/report/index/d79b2d14-7173-4ce3-97dd-7748a0220407#tab-details

Comment 4

[Byron Campen [:bwc]]

Thanks! That will help tremendously.

Comment 5

[Jim Mathies [:jimm]]

FYI, Just got this again on whereby when in a meeting the other person reloaded their session and my tab crashed as a result. This was on a different system running Windows 11.

https://crash-stats.mozilla.org/report/index/5b5d8b2d-d4b8-4e54-ae2e-ddd7e0220407#tab-bugzilla

Comment 6

[Byron Campen [:bwc]]

Not having any luck reproducing on OS X. Going to try windows next.

Comment 7

[Byron Campen [:bwc]]

No luck reproducing on windows either, although I do not have access to a Windows 11 system currently. crash-stats has crashes from both 10 and 11, so it does not look specific to 11, so maybe that does not matter.

Here's a try run, which fixes one possibility for the crash, and that converts a couple of other possibilities into easier to diagnose crashes:

https://treeherder.mozilla.org/jobs?repo=try&revision=e674bf7b721539e6fb2d9c87c89205fdeac5ec72

Comment 8

[Byron Campen [:bwc]]

wpt try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=f5a0f6b9218c6a9f63e3f30c876a191f80eecee0

Comment 9

[Byron Campen [:bwc]]

Attachment: Bug 1763654: MOZ_CRASH instead of returning nullptr in here. r?mjf

Returning nullptr still release crashes, but is harder to tell what happened.

Comment 10

[Byron Campen [:bwc]]

Try looks fine.

Comment 11

[tgn-ff]

STR, in case you need them:

1. Install the DevTools Media Panel extension.
2. Visit https://www.tiktok.com/.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1cbfaa700ba7
MOZ_CRASH instead of returning nullptr in here. r=mjf

Comment 13

[Tyson Smith [:tsmith]]

I think bug 1764216 may be a duplicate. It has a test case and will have a Pernosco session shortly.

Comment 14

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/1cbfaa700ba7

Comment 15

[Byron Campen [:bwc]]

From the pernoso session mentioned in comment 13:

https://pernos.co/debug/MkUgoRBlnv1nH2GsGKnnKA/index.html#f{m[A/Ek,C3Oc_,t[ow,K+M_,f{e[A/Ek,C3OP_,s{aeHY3iVAA,bARk,uC9+z/Q,oC/3CKw___/

Looks like the nullptr was being returned due to the PC being closed. The patches landed here should solve that particular issue. I'll check back on crash-stats in a few days to see if the bug has been resolved.

Comment 17

[Paul Adenot (:padenot)]

Byron, fwiw I can repro this by attempting to join a call on Zoom Web. 100% repro on my M1 Max here.

Comment 18

[Byron Campen [:bwc]]

Does it happen with the patch from this bug? If so, what's the signature like?

Comment 19

[Paul Adenot (:padenot)]

(In reply to Byron Campen [:bwc] from comment #18)

Does it happen with the patch from this bug? If so, what's the signature like?

I think so it was recent enough but I'm not sure: https://crash-stats.mozilla.org/report/index/0142bd76-0160-4fc8-a3e9-11f1b0220413

Comment 20

[Paul Adenot (:padenot)]

I can't repro now with a nightly I just updated though, but I don't know if I was lucky before, reproducing a couple times in a row.

Comment 21

[Byron Campen [:bwc]]

So that's the build from the 11th, which was before this patch. If you have any time to pull down the latest nightly, and try, that would be useful. Otherwise, we can keep an eye on crash-stats and see if this signature, or any signatures from PeerConnectionImpl::GetStats, continue to show up.

Edit: Mid-air collision, it seems like it is fixed for you now.

Comment 22

[Byron Campen [:bwc]]

ni self to check back on crash-stats, maybe on Friday.

Comment 23

[Byron Campen [:bwc]]

Not seeing any crashes that match on crash-stats, nor do I see any crashes in PeerConnectionImpl::GetStats. I think this is fixed.

Comment 24

[Ardelean Oana, Desktop QA [:oardelean]]

I managed to reproduce the crash on a 2022-04-06 Nightly build on Win10, Ubuntu 20.04 and macOS 11. Verified as fixed on Nightly 102.0a1(20220516215740) and Firefox 101.0b7(20220515185854) on Win10, Ubuntu 20.04, macOS 11.