854899 - WebRTC crash [@sipcc::PeerConnectionMedia::ShutdownMediaTransport_s]

Status: RESOLVED DUPLICATE of bug 861048

(Core :: WebRTC, defect, P2)

Description

[Christoph Diehl [:posidron]]

This happened randomly while fuzzing the JSEP API. I could not reproduce it with a single testcase.

==74810==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00010387240f sp 0x7fff5fbfb720 bp 0x7fff5fbfb730 T0)
AddressSanitizer can not provide additional info.
    #0 0x10387240e in mozalloc_abort mozalloc_abort.cpp:30
    #1 0x106cd42e5 in Abort nsDebugImpl.cpp:430
    #2 0x106cd3b8e in NS_DebugBreak_P nsDebugImpl.cpp:417
    #3 0x1038af52a in nsCOMPtr<nsIThread>::operator-> const nsCOMPtr.h:783
    #4 0x107c9f1c1 in sipcc::PeerConnectionMedia::ShutdownMediaTransport_s PeerConnectionMedia.cpp:330
    #5 0x107ca3831 in mozilla::runnable_args_m_0<sipcc::PeerConnectionMedia*, void >::Run runnable_utils_generated.h:48
    #6 0x107c9e881 in mozilla::RUN_ON_THREAD runnable_utils.h:54
    #7 0x107c9f061 in sipcc::PeerConnectionMedia::SelfDestruct PeerConnectionMedia.cpp:280
    #8 0x107c91ebb in sipcc::PeerConnectionImpl::ShutdownMedia PeerConnectionImpl.cpp:1194
    #9 0x107c8be43 in sipcc::PeerConnectionImpl::CloseInt PeerConnectionImpl.cpp:1177
    #10 0x107c8bc5e in sipcc::PeerConnectionImpl::~PeerConnectionImpl PeerConnectionImpl.cpp:274
    #11 0x107c8badd in sipcc::PeerConnectionImpl::~PeerConnectionImpl PeerConnectionImpl.cpp:265
    #12 0x107c8b584 in sipcc::PeerConnectionImpl::Release PeerConnectionImpl.cpp:245
    #13 0x105912904 in ReleaseSliceNow XPCJSRuntime.cpp:637
    #14 0x105912fb2 in XPCIncrementalReleaseRunnable::ReleaseNow XPCJSRuntime.cpp:692
    #15 0x1059134fa in XPCIncrementalReleaseRunnable::Run XPCJSRuntime.cpp:721
    #16 0x106cb9b2b in nsThread::ProcessNextEvent nsThread.cpp:627
    #17 0x106bf811e in NS_ProcessPendingEvents_P nsThreadUtils.cpp:188
    #18 0x106119dd3 in nsBaseAppShell::NativeEventCallback nsBaseAppShell.cpp:97
    #19 0x106090f9d in nsAppShell::ProcessGeckoEvents nsAppShell.mm:387
    #20 0x7fff8e0b9b30 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (in CoreFoundation) + 16
    #21 0x7fff8e0b9454 in __CFRunLoopDoSources0 (in CoreFoundation) + 244
    #22 0x7fff8e0dc7f4 in __CFRunLoopRun (in CoreFoundation) + 788
    #23 0x7fff8e0dc0e1 in CFRunLoopRunSpecific (in CoreFoundation) + 289
    #24 0x7fff8f4c6eb3 in RunCurrentEventLoopInMode (in HIToolbox) + 208
    #25 0x7fff8f4c6c51 in ReceiveNextEventCommon (in HIToolbox) + 355
    #26 0x7fff8f4c6ae2 in BlockUntilNextEventMatchingListInMode (in HIToolbox) + 61
    #27 0x7fff902ac562 in _DPSNextEvent (in AppKit) + 684
    #28 0x7fff902abe21 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (in AppKit) + 127
    #29 0x10608f68b in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] nsAppShell.mm:164
    #30 0x7fff902a31d2 in -[NSApplication run] (in AppKit) + 516
    #31 0x106091b65 in nsAppShell::Run nsAppShell.mm:741
    #32 0x105c3791d in nsAppStartup::Run nsAppStartup.cpp:288
    #33 0x10388a0f3 in XREMain::XRE_mainRun nsAppRunner.cpp:3880
    #34 0x10388b21e in XREMain::XRE_main nsAppRunner.cpp:3947
    #35 0x10388b799 in XRE_main nsAppRunner.cpp:4152
    #36 0x100003303 in do_main nsBrowserApp.cpp:232
    #37 0x100002578 in main nsBrowserApp.cpp:533
    #38 0x100001b03 in start (in firefox) + 51
    #39 0x3 in 0x00000003 (in firefox)

Tested with m-i changeset: 126222:2c58eaf2ac80

Comment 1

[Eric Rescorla (:ekr)]

Looks to me like the problem is that mMainThread == nullptr.

Perhaps PCMedia::Init() is never getting called.

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

Now that the DISPATCH_SYNC bug has landed, can you tell us if you've seen this in a build since then?   It landed in mozilla-central around the same time this report was filed (3/16 ~ just before 8am PDT)

Thanks

Comment 3

[Christoph Diehl [:posidron]]

Seems fixed the crash did not pop anymore.

Comment 4

[Christoph Diehl [:posidron]]

Attachment: testcase

Tested with m-i changeset: 128608:5a92cfb2d1c3

Comment 5

[Jason Smith [:jsmith]]

Going to dupe this now against the new bug I filed yesterday on this and collapse the info into one bug.