818867 - Firefox crashes when interacting with the attached testcase [ @sipcc::PeerConnectionMedia::GetRemoteStream(int)]

Status: VERIFIED FIXED

(Core :: WebRTC: Signaling, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko/20121205 Firefox/20.0 ID:20121205030759

The testcase which I will attach shortly I have saved locally from http://mozilla.github.com/webrtc-landing/pc_test.html and modified it so it always used faked streams. Clicking the start/stop button multiple times crashed Firefox

Report: bp-830661a7-5dfc-4abe-b506-3675f2121206

0 	XUL 	sipcc::PeerConnectionMedia::GetRemoteStream 	nsTArray.h:204
1 	XUL 	sipcc::PeerConnectionObserverDispatch::Run 	PeerConnectionImpl.cpp:199
2 	XUL 	nsThread::ProcessNextEvent 	nsThread.cpp:627
3 	XUL 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:221
4 	XUL 	nsThread::Dispatch 	nsThread.cpp:410
5 	XUL 	nsSocketTransportService::Dispatch 	nsSocketTransportService2.cpp:123
6 	XUL 	sipcc::PeerConnectionMedia::SelfDestruct 	PeerConnectionMedia.cpp:244
7 	XUL 	sipcc::PeerConnectionImpl::ShutdownMedia 	runnable_utils_generated.h:48
8 	XUL 	sipcc::PeerConnectionImpl::Close 	PeerConnectionImpl.cpp:957
9 	XUL 	NS_InvokeByIndex_P 	xptcinvoke_x86_64_unix.cpp:162
10 	XUL 	XPCWrappedNative::CallMethod 	XPCWrappedNative.cpp:3081 
[...]

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Hm, on Aurora we crash in a different stack. Erik, something I should file a separate bug for?

Report: bp-2615af28-3fd0-4526-b408-93d3a2121206

0 	XUL 	mozilla::MediaPipelineTransmit::Init 	ostream:198
1 	XUL 	mozilla::MediaPipelineTransmit::MediaPipelineTransmit 	MediaPipeline.h:172
2 	XUL 	vcmTxStartICE 	MediaPipeline.h:173
3 	XUL 	lsm_tx_start 	lsm.c:1266
4 	XUL 	lsm_update_media 	lsm.c:3873
5 	XUL 	cc_call_state 	lsm.c:3916
6 	XUL 	fsmdef_ev_setlocaldesc 	fsmdef.c:3167
7 	XUL 	sm_process_event 	sm.c:48
8 	XUL 	fim_process_event 	fim.c:636
9 	XUL 	gsm_process_msg 	gsm.c:132
10 	XUL 	GSMTask 	gsm.c:324 
[..]

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Ok, so this crashes in all kinds of different stacks. There is no easy way to minimize the testcase. I will add all the signatures I have seen while working with the testcase and Firefox crashes on that bug for now.

(In reply to Henrik Skupin (:whimboo) from comment #1)
> Hm, on Aurora we crash in a different stack. Erik, something I should file a
> separate bug for?

Not necessary for now I think. This also happens with Nightly and the same test case.

Report: bp-a3d32119-2d3f-4224-aa39-b3b732121206
0 	XUL 	vcmCreateTransportFlow 	stl_tree.h:476
1 	XUL 	vcmRxStartICE 	VcmSIPCCBinding.cpp:1208
2 	XUL 	lsm_rx_start 	lsm.c:1008
3 	XUL 	lsm_update_media 	lsm.c:3878
4 	XUL 	cc_call_state 	lsm.c:3924
5 	XUL 	fsmdef_ev_setlocaldesc 	fsmdef.c:3167
6 	XUL 	sm_process_event 	sm.c:48
7 	XUL 	fim_process_event 	fim.c:636
8 	XUL 	gsm_process_msg 	gsm.c:132
9 	XUL 	GSMTask 	gsm.c:324 

Report: bp-96afbc3e-0917-4680-9ced-8b7942121206
0 	XUL 	mozilla::MediaPipelineReceiveVideo::PipelineRenderer::PipelineRenderer 	nsDOMMediaStream.h:40
1 	XUL 	mozilla::MediaPipelineReceiveVideo::MediaPipelineReceiveVideo 	MediaPipeline.h:326
2 	XUL 	vcmRxStartICE 	MediaPipeline.h:328
3 	XUL 	lsm_rx_start 	lsm.c:1008
4 	XUL 	lsm_update_media 	lsm.c:3878
5 	XUL 	cc_call_state 	lsm.c:3924
6 	XUL 	fsmdef_ev_setlocaldesc 	fsmdef.c:3167
7 	XUL 	sm_process_event 	sm.c:48
8 	XUL 	fim_process_event 	fim.c:636
9 	XUL 	gsm_process_msg 	gsm.c:132
10 	XUL 	GSMTask 	gsm.c:324

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Attachment: testcase

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Report: bp-ded984a0-9882-4db6-a314-a7e792121206
0 	XUL 	sipcc::PeerConnectionMedia::GetRemoteStream 	nsTArray.h:204
1 	XUL 	vcmRxStartICE 	VcmSIPCCBinding.cpp:1200
2 	XUL 	lsm_rx_start 	lsm.c:1008
3 	XUL 	lsm_update_media 	lsm.c:3878
4 	XUL 	cc_call_state 	lsm.c:3924
5 	XUL 	fsmdef_ev_setremotedesc 	fsmdef.c:3299
6 	XUL 	sm_process_event 	sm.c:48
7 	XUL 	fim_process_event 	fim.c:636
8 	XUL 	gsm_process_msg 	gsm.c:132
9 	XUL 	GSMTask 	gsm.c:324

Comment 5

[Scoobidiver (away)]

In order to have a connection with crash stats, the space must be after @ not before. The easiest way to have a right signature is to copy everything after Crash Report in the first line.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

This is the pipeline bug; bug 820102 or bug 807238 (which may be partially the same bug).  The stacks here might come from both.

Comment 8

[Maire Reavy [:mreavy]]

Closing as fixed since both bugs (820102 and 807238) are now resolved.

Comment 9

[Jason Smith [:jsmith]]

Not seeing a crash on 1/25. Verified then.