vcmCreateTransportFlow() can error out due mMedia becoming NULL and cause wrong-thread releases

RESOLVED DUPLICATE of bug 835283

Status

()

defect
--
critical
RESOLVED DUPLICATE of bug 835283
6 years ago
6 years ago

People

(Reporter: jesup, Assigned: ekr)

Tracking

({crash})

Trunk
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [webrtc][blocking-webrtc+])

Attachments

(1 attachment)

Posted file gdb logs
When calling VcmRxStartICE_m(), vcmCreateTransportFlow() can error out due mMedia becoming NULL and cause wrong-thread releases in VcmRxStartICE_m().  

This is likely due to the patch for bug 820538, and that we're still using DISPATCH_SYNC.

Since pc->mMedia became NULL, we can't store the flow in it, and we release it on mainthread, which due to bug 830100 can cause a thread-safety assertion.  (Note that this crashes on purpose even in an opt/release build, which limits any security implications).

Found when trying to reproduce bug 835238
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 835238
Duplicate of bug: 835283
You need to log in before you can comment on or make changes to this bug.