Closed Bug 1517369 Opened 6 years ago Closed 5 years ago

Fatal error in src/media/webrtc/trunk/webrtc/video/video_send_stream.cc, line 797 # last system error: 1

Categories

(Core :: WebRTC, defect, P2)

Product:
Core
Component:
WebRTC
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla71
Tracking Flags:
Tracking Status
firefox-esr60 --- wontfix
firefox-esr68 --- wontfix
firefox66 --- wontfix
firefox67 --- wontfix
firefox68 --- wontfix
firefox69 --- wontfix
firefox70 --- wontfix
firefox71 --- fixed

People

(Reporter: tsmith, Assigned: dminor)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase)

Attachments

(2 files)

testcase.html
(deleted), text/html
Details
Bug 1517369 - Check for invalid rtp extension ids; r=bwc!
(deleted), text/x-phabricator-request
Details
Attached file testcase.html (deleted) —
# Fatal error in src/media/webrtc/trunk/webrtc/video/video_send_stream.cc, line 797 # last system error: 1 # Check failed: 0 == rtp_rtcp->RegisterSendRtpHeaderExtension( StringToRtpExtensionType(extension), id) (0 vs. -1) ==23670==ERROR: AddressSanitizer: ABRT on unknown address 0x03e800005c76 (pc 0x7f641542f428 bp 0x7f639b1fbf50 sp 0x7f639b1fbd68 T79) #0 0x7f641542f427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/signal/../sysdeps/unix/sysv/linux/raise.c:54 #1 0x7f6415431029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89 #2 0x7f63ff1b23aa in rtc::FatalMessage::~FatalMessage() src/media/webrtc/trunk/webrtc/rtc_base/checks.cc:69:3 #3 0x7f63ff244d46 in webrtc::internal::VideoSendStreamImpl::VideoSendStreamImpl(webrtc::SendStatisticsProxy*, rtc::TaskQueue*, webrtc::CallStats*, webrtc::RtpTransportControllerSendInterface*, webrtc::BitrateAllocator*, webrtc::SendDelayStats*, webrtc::VideoStreamEncoder*, webrtc::RtcEventLog*, webrtc::VideoSendStream::Config const*, int, std::map<unsigned int, webrtc::RtpState, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, webrtc::RtpState> > >, std::map<unsigned int, webrtc::RtpPayloadState, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, webrtc::RtpPayloadState> > >, webrtc::VideoEncoderConfig::ContentType) src/media/webrtc/trunk/webrtc/video/video_send_stream.cc:796:7 #4 0x7f63ff2512bb in webrtc::internal::VideoSendStream::ConstructionTask::Run() src/media/webrtc/trunk/webrtc/video/video_send_stream.cc:417:29 #5 0x7f63ff1dc0ac in rtc::TaskQueue::Impl::OnWakeup(int, short, void*) src/media/webrtc/trunk/webrtc/rtc_base/task_queue_libevent.cc:438:18 #6 0x7f63f2470b77 in event_persist_closure src/ipc/chromium/src/third_party/libevent/event.c:1580:9 #7 0x7f63f2470b77 in event_process_active_single_queue src/ipc/chromium/src/third_party/libevent/event.c:1639 #8 0x7f63f24689a5 in event_process_active src/ipc/chromium/src/third_party/libevent/event.c #9 0x7f63f24689a5 in event_base_loop src/ipc/chromium/src/third_party/libevent/event.c:1961 #10 0x7f63ff1db98c in rtc::TaskQueue::Impl::ThreadMain(void*) src/media/webrtc/trunk/webrtc/rtc_base/task_queue_libevent.cc:407:5 #11 0x7f63ff1cbc15 in rtc::PlatformThread::Run() src/media/webrtc/trunk/webrtc/rtc_base/platform_thread.cc:242:5 #12 0x7f63ff1cb30c in rtc::PlatformThread::StartThread(void*) src/media/webrtc/trunk/webrtc/rtc_base/platform_thread.cc:158:40 #13 0x7f64164846b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) #14 0x7f641550141c in clone /build/glibc-Cl5G7W/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Flags: in-testsuite?
Summary: Assertion failure: columnSet->IsColumnSetFrame(), at src/layout/generic/ColumnSetWrapperFrame.cpp:42 → Fatal error in src/media/webrtc/trunk/webrtc/video/video_send_stream.cc, line 797 # last system error: 1
Component: WebRTC → Layout: Columns
Flags: needinfo?(aethanyc)

Alex, how is column layout involved in this testcase? Is this two separate bugs, or is it taking a bad code path in the column code that results in the WebRTC issues?

Additionally, if you have a decent understanding of what's happening here, could you set the Importance field of the bug?

Flags: needinfo?(achronop)

I'd like to note that the "Assertion failure: columnSet->IsColumnSetFrame(), at src/layout/generic/ColumnSetWrapperFrame.cpp:42" line was a copypaste error and was not part of the error message.

Sorry about that, the triage list is huge after pto and I did it fast. I moved it in your component due to the assertion error mentioned above. I looked again, carefully, and I've realized the actual error is something else. Thanks.

Component: Layout: Columns → WebRTC
Flags: needinfo?(achronop)
Rank: 15
Priority: -- → P2
Assignee: nobody → dminor
Flags: needinfo?(aethanyc)
Status: NEW → ASSIGNED

The SDP here contains:

a=extmap:2 urn:ietf:params:rtp-hdrext:toffset
a=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time

i.e. the extension id is repeated. According to RFC 8285:

A usable mapping MUST use IDs in the valid range, and each ID in this
range MUST be used only once for each media section (or only once if
the mappings are session level).  Mappings that do not conform to
these rules MAY be presented, for instance, during SDP Offer/Answer
[RFC3264] negotiation as described in the next section, but remapping
to conformant values is necessary before they can be applied.

so we need to remap the ids prior to getting to this point. We'll also fail the assertion here if an id is outside the valid range of 1 to 14.

This adds checks for invalid and duplicated rtp extension ids to
JsepSessionImpl. Since the version of webrtc.org we're using does not support
two byte extension ids, ids must be between 1 and 14 inclusive. Duplicated
extension ids are also disallowed by RFC 8285. Passing an invalid extension id
into the webrtc.org code will trigger a release assertion and a browser crash.

Pushed by dminor@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/98c7a85974c5 Check for invalid rtp extension ids; r=bwc

https://hg.mozilla.org/mozilla-central/rev/98c7a85974c5

Status: ASSIGNED → RESOLVED
Closed: 5 years ago
status-firefox71: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: