861048 - crash in sipcc::PeerConnectionMedia::ShutdownMediaTransport_s

Status: RESOLVED DUPLICATE of bug 856848

(Core :: WebRTC, defect)

Description

[Jason Smith [:jsmith]]

This bug was filed from the Socorro interface and is 
report bp-5a3287dd-b083-45f0-abdf-473152130411 .
============================================================= 

If this is a dupe of an existing bug, dupe it to the bug. I saw a couple of crashes in crash stats showing up with this stack today.

Frame 	Module 	Signature 	Source
0 	XUL 	sipcc::PeerConnectionMedia::ShutdownMediaTransport_s 	PeerConnectionMedia.cpp:346
1 	XUL 	mozilla::runnable_args_m_0<sipcc::PeerConnectionMedia*, void 	runnable_utils_generated.h:49
2 	XUL 	sipcc::PeerConnectionMedia::SelfDestruct 	runnable_utils.h:54
3 	XUL 	sipcc::PeerConnectionImpl::~PeerConnectionImpl 	PeerConnectionImpl.cpp:1251
4 	XUL 	sipcc::PeerConnectionImpl::~PeerConnectionImpl 	PeerConnectionImpl.cpp:281
5 	XUL 	sipcc::PeerConnectionImpl::Release 	PeerConnectionImpl.cpp:260
6 	XUL 	ReleaseSliceNow 	XPCJSRuntime.cpp:654
7 	XUL 	XPCIncrementalReleaseRunnable::ReleaseNow 	XPCJSRuntime.cpp:709
8 	XUL 	XPCIncrementalReleaseRunnable::Run 	XPCJSRuntime.cpp:738
9 	XUL 	nsThread::ProcessNextEvent 	nsThread.cpp:627
10 	CoreFoundation 	_CFRetain 	
11 	XUL 	NS_ProcessPendingEvents 	nsThreadUtils.cpp:188
12 	XUL 	nsBaseAppShell::NativeEventCallback 	nsBaseAppShell.cpp:97
13 	XUL 	nsAppShell::ProcessGeckoEvents 	nsAppShell.mm:387
14 	CoreFoundation 	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 	
15 	CoreFoundation 	__CFRunLoopDoSources0 	
16 	CoreFoundation 	__CFRunLoopRun 	
17 	CoreFoundation 	CFRunLoopRunSpecific 	
18 	HIToolbox 	RunCurrentEventLoopInMode 	
19 	HIToolbox 	ReceiveNextEventCommon 	
20 	HIToolbox 	BlockUntilNextEventMatchingListInMode 	
21 	AppKit 	_DPSNextEvent 	
22 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
23 	XUL 	-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	nsAppShell.mm:164
24 	AppKit 	-[NSApplication run] 	
25 	XUL 	nsAppShell::Run 	nsAppShell.mm:741
26 	XUL 	nsAppStartup::Run 	nsAppStartup.cpp:288
27 	XUL 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3881
28 	libmozglue.dylib 	arena_malloc 	jemalloc.c:1722
29 	XUL 	CMMFCertOrEncCertTemplate 	
30 	XUL 	CMMFCertOrEncCertTemplate 	
31 	libsystem_c.dylib 	pthread_create 	
32 	XUL 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3948
33 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4153

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

Very likely mMainThread == null

There was another bug related to this and where mMainThread is set in Init(), but I can't find the number right now.  It wasn't all that long ago (a week or two?)

Comment 2

[StevenLee[:slee]]

I encountered the crash problem, too. It happens when PeerConnectionMedia does not initialized correctly, PeerConnectionImpl fails in getting psm service in [1]. If I mark [2], then we can get psm service. But I am not sure about this code. Does anyone know about it?
I think we should not call SelfDestruct if PeerConnectionMedia::Init() is not called.

[1] https://mxr.mozilla.org/mozilla-central/source/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp#508
[2] https://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/nsNSSComponent.cpp#263

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

Both this and bug 856848 are due to mMainThread/mSTSThread not getting initialized until Init() time.  Steven, since you can reproduce this, can you apply that patch and verify if this is fixed by it?  If so, please dup it.

Comment 4

[StevenLee[:slee]]

(In reply to Randell Jesup [:jesup] from comment #3)
> Both this and bug 856848 are due to mMainThread/mSTSThread not getting
> initialized until Init() time.  Steven, since you can reproduce this, can
> you apply that patch and verify if this is fixed by it?  If so, please dup
> it
Sure, I will test it on the latest revision on my unagi.

Comment 5

[Jason Smith [:jsmith]]

Just for safety to get more info here:

Marcia - Can you dump a list of URLs that these crashes are coming from?

Comment 6

[Adam Roach [:abr]]

(In reply to Randell Jesup [:jesup] from comment #3)
> Both this and bug 856848 are due to mMainThread/mSTSThread not getting
> initialized until Init() time.  Steven, since you can reproduce this, can
> you apply that patch and verify if this is fixed by it?  If so, please dup
> it.

I agree that this appears to be the same pathology as that bug, and would be surprised if the patch on Bug 856848 doesn't fix it.

StevenLee: How did the test with that patch go?

Comment 8

[Jason Smith [:jsmith]]

Attachment: Test Case

Comment 9

[Jason Smith [:jsmith]]

Christophl included a test case in the duped bug. So we can reproduce this now easily.

Comment 10

[Jason Smith [:jsmith]]

Yup, this test case definitely is crashing for me on Win 7.

Comment 11

[Jason Smith [:jsmith]]

Now we've got a really easy way to reproduce this on desktop.

Adam - Can you quickly test to see if your patch in bug 856848 fixes this bug?

Comment 12

[Adam Roach [:abr]]

I can tell you by inspection that the patch will solve the problem in Bug 854899. It is functionally equivalent to the test in Bug 860143 (to wit: an invalid STUN or TURN URL) and will run the same code paths. I have verified that the patch on 856848 fixes the crash in Bug 840143.

As you seem to be certain that this is equivalent to Bug 854899, which I'm certain is equivalent to the test case in Bug 860143, the second crash from which is solved by the patch in Bug 856848 (and given that it's safe to assume transitivity of identity)... I'm marking this as a dupe of Bug 856848.

Comment 13

[StevenLee[:slee]]

(In reply to Adam Roach [:abr] from comment #6)
> I agree that this appears to be the same pathology as that bug, and would be
> surprised if the patch on Bug 856848 doesn't fix it.
> 
> StevenLee: How did the test with that patch go?
Bug 856848 fixed the crash problem on my unagi. Since the PeerConnectionMedia will be created after getting psm service. On my device, if it fails to get psm service, the initialization of PeerConnectionMedia is incomplete that causes the crash problem.