1988454 - Messages delivered to wrong RTCDataChannel

Status: UNCONFIRMED

(Core :: WebRTC: Networking, defect)

Description

[alex]

Attachment: message-received-by-wrong-channel.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36

Steps to reproduce:

See the attached reproduction. Two RTCPeerConnections are set up and connected to each other.

The receiver listens for incoming datachannel events. When one occurs a message listener is attached to the datachannel. When a message event occurs, the data is sent back to the sender and the channel is closed.

The initiator opens a datachannel and attaches a message listener that asserts that the expected message is received. It waits for the open event to fire, writes a message into the datachannel and closes it, then waits for the close event to fire.

It then opens a second channel, performs the same actions as the first but waits for the receiver to close the channel.

It does this in a loop to increase the chances of seeing the error.

Actual results:

After a few of iterations, the second message channel receives a message sent by the first.

Expected results:

The second channel should only receive messages sent on and echoed back to the second channel. It should not receive messages sent on/to the first channel.

It appears to be related to the initiator closing the first datachannel - if it waits for the receiver to close the channel the bug does not occur (e.g. comment out line 154 in the repro).

This isn't much of a solution though, because the initiator can't rely on the receiver to "do the right thing" and close the channel - it will expose them to resource leaks if the receiver does not do this for whatever reason.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Messaging System' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:bwc, could you have a look please?

For more information, please visit BugBot documentation.