835023 - WebRTC crash [@mozilla::StaticRefPtr<mozilla::PeerConnectionCtxShutdown>::operator->() const]

Status: RESOLVED FIXED

(Core :: WebRTC, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This crash occurs during fuzzing the SDP with an interval of 3.0 seconds between each testcase.

Tested with m-c changeset: 119623:b0dcc10f4768

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

Note: this code has changed; the line flagged for frame 1 was:
  res = PeerConnectionCtx::InitializeGlobal(mThread);

and Frame 0 appears to be
    if (!sipcc::PeerConnectionCtx::gPeerConnectionCtxShutdown) {
      sipcc::PeerConnectionCtx::gPeerConnectionCtxShutdown = new PeerConnectionCtxShutdown();
      sipcc::PeerConnectionCtx::gPeerConnectionCtxShutdown->Init();
    }

StaticRefPtr<mozilla::PeerConnectionCtxShutdown> PeerConnectionCtx::gPeerConnectionCtxShutdown;

This might be racing against Observe()'s destruction of gPeerConnectionCtxShutdown in the same file.

Comment 2

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

> This might be racing against Observe()'s destruction of gPeerConnectionCtxShutdown
> in the same file.

It has to be, because nothing else touches this variable. http://mxr.mozilla.org/mozilla-central/search?string=gPeerConnectionCtxShutdown&find=&findi=&filter=&hitlimit=&tree=mozilla-central

What's unsettling about this is that it must mean a new gPeerConnectionCtxShutdown object is being created and initialized during shutdown (!)

gInstance is null both at startup and shutdown, but the code isn't distinguishing between the two situations, and I think this suggests it may be starting up again when it should be winding down.

Randell showed me that PeerConnection.js tears down all PeerConnections on shutdown, but I think the queue is still there, so there may still be jobs queued up and it seems to be that these need to be neutralized during shutdown.

Comment 3

[Maire Reavy [:mreavy]]

We believe this bug was fixed when the patch for bug 844493 landed.  Please reopen if this happens again.