7 crashes on macOS starting with the Firefox 110 branch, only reported for Nightly and DevEdition.

Crash report: https://crash-stats.mozilla.org/report/index/cdfc3aef-bf06-437f-a8ed-b33530230216

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0  XUL  std::__1::__tree<rtc::VideoSinkInterface<webrtc::VideoFrame>*, std::__1::less<rtc::VideoSinkInterface<webrtc::VideoFrame>*>, std::__1::allocator<rtc::VideoSinkInterface<webrtc::VideoFrame>*> >::__insert_node_at  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/__tree:2081
0  XUL  std::__1::__tree<rtc::VideoSinkInterface<webrtc::VideoFrame>*, std::__1::less<rtc::VideoSinkInterface<webrtc::VideoFrame>*>, std::__1::allocator<rtc::VideoSinkInterface<webrtc::VideoFrame>*> >::__emplace_unique_key_args<rtc::VideoSinkInterface<webrtc::VideoFrame>*, rtc::VideoSinkInterface<webrtc::VideoFrame>* const&>  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/__tree:2099
1  XUL  std::__1::__tree<rtc::VideoSinkInterface<webrtc::VideoFrame>*, std::__1::less<rtc::VideoSinkInterface<webrtc::VideoFrame>*>, std::__1::allocator<rtc::VideoSinkInterface<webrtc::VideoFrame>*> >::__insert_unique  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/__tree:1252
1  XUL  std::__1::set<rtc::VideoSinkInterface<webrtc::VideoFrame>*, std::__1::less<rtc::VideoSinkInterface<webrtc::VideoFrame>*>, std::__1::allocator<rtc::VideoSinkInterface<webrtc::VideoFrame>*> >::insert  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/set:673
1  XUL  webrtc::videocapturemodule::VideoCaptureImpl::RegisterCaptureDataCallback  third_party/libwebrtc/modules/video_capture/video_capture_impl.cc:97
2  XUL  mozilla::camera::CamerasParent::RecvStartCapture const  dom/media/systemservices/CamerasParent.cpp:946
2  XUL  std::__1::__invoke<mozilla::camera::CamerasParent::RecvStartCapture  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/type_traits:3918
2  XUL  std::__1::__invoke_void_return_wrapper<void, true>::__call<mozilla::camera::CamerasParent::RecvStartCapture  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/__functional/invoke.h:61
2  XUL  std::__1::__function::__alloc_func<mozilla::camera::CamerasParent::RecvStartCapture  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/__functional/function.h:178
2  XUL  std::__1::__function::__func<mozilla::camera::CamerasParent::RecvStartCapture  /builds/worker/fetches/MacOSX13.0.sdk/usr/include/c++/v1/__functional/function.h:352

Related to bug 1811641?

Why did you mark this as a sec bug?

I'm using bug 1817724 for this signature too.

(In reply to Andrew McCreight [:mccr8] from comment #2)

Why did you mark this as a sec bug?

Because its security status was unknown to me (pointer not nullish for an invalid address termination).

Let's just go ahead and unhide this then. It might be security related, but it isn't obviously so, and we already have an open bug on a similar thing. Feel free to dupe this as appropriate.