Closed Bug 1754797 Opened 3 years ago Closed 3 years ago

Assert in nricectx.cpp due to invalid subscript

Categories

(Core :: WebRTC: Signaling, defect, P2)

x86_64
Linux
defect

Tracking

()

RESOLVED FIXED
99 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox97 --- unaffected
firefox98 --- unaffected
firefox99 --- fixed

People

(Reporter: heftig, Assigned: bwc)

References

(Regression, )

Details

(Keywords: regression)

Attachments

(1 file)

Attempting to start a WebRTC peer connection (e.g. via https://webrtc.github.io/samples/src/content/peerconnection/audio/) causes the Socket Process to crash with an assert.

/usr/include/c++/11.1.0/bits/stl_vector.h:1045: std::vector::reference std::vector<nr_ice_stun_server_>::operator[](std::vector::size_type) [_Tp = nr_ice_stun_server_, _Alloc = std::allocator<nr_ice_stun_server_>]: Assertion '__n < this->size()' failed.
Redirecting call to abort() to mozalloc_abort

See e.g. bp-6ccca384-8c51-471b-aeb3-465460220210, which points us at nricectx.cpp:812. servers[0] is invalid when servers is empty.

This is only happening because we compile with stdlib assertions enabled (CXXFLAGS contains -Wp,-D_GLIBCXX_ASSERTIONS).

Bug 1253706, specifically 3bbb2706fe05 removed the guards that presumably kept this from exploding before.

Some other lines, nricectx.cpp:265 and nricectx.cpp:921 correctly turn an empty vector into a nullptr instead of trying to subscript it like SetStunServers and SetTurnServers do.

Assignee: nobody → docfaraday
Severity: -- → S2
Priority: -- → P2

The right fix here is probably to use servers.data() instead of &servers[0]

Try looks good.

Pushed by bcampen@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/a7d2fd1431db Use .data() instead of subscripting at 0. r=mjf,heftig
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 99 Branch

Set release status flags based on info from the regressing bug 1253706

Has Regression Range: --- → yes
Flags: qe-verify+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: