vcmCreateTransportFlow() can error out due mMedia becoming NULL and cause wrong-thread releases

RESOLVED DUPLICATE of bug 835283

Status

()

--
critical
RESOLVED DUPLICATE of bug 835283
6 years ago
6 years ago

People

(Reporter: jesup, Assigned: ekr)

Tracking

({crash})

Trunk
crash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [webrtc][blocking-webrtc+])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 714961 [details]
gdb logs

When calling VcmRxStartICE_m(), vcmCreateTransportFlow() can error out due mMedia becoming NULL and cause wrong-thread releases in VcmRxStartICE_m().  

This is likely due to the patch for bug 820538, and that we're still using DISPATCH_SYNC.

Since pc->mMedia became NULL, we can't store the flow in it, and we release it on mainthread, which due to bug 830100 can cause a thread-safety assertion.  (Note that this crashes on purpose even in an opt/release build, which limits any security implications).

Found when trying to reproduce bug 835238
(Reporter)

Updated

6 years ago
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 835238
(Reporter)

Updated

6 years ago
Duplicate of bug: 835283
You need to log in before you can comment on or make changes to this bug.