Found while fuzzing m-c 20230607-2c8e99462d7d (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

==13389==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x7fe795c84a37 bp 0x7ffca864b0d0 sp 0x7ffca864b0d0 T0)
==13389==The signal is caused by a READ memory access.
==13389==Hint: address points to the zero page.
    #0 0x7fe795c84a37 in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:325:27
    #1 0x7fe795c84a37 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:355:12
    #2 0x7fe795c84a37 in mozilla::dom::RTCRtpReceiver::SetJitterBufferTarget(mozilla::dom::Nullable<double> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webrtc/jsapi/RTCRtpReceiver.cpp:558:3
    #3 0x7fe791ce6a57 in mozilla::dom::RTCRtpReceiver_Binding::set_jitterBufferTarget(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/RTCRtpReceiverBinding.cpp:437:24
    #4 0x7fe793516684 in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3277:8
    #5 0x7fe79e117d23 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
    #6 0x7fe79e117d23 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
    #7 0x7fe79e119e56 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #8 0x7fe79e119e56 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
    #9 0x7fe79e11bf93 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:810:10
    #10 0x7fe79e4bb3d8 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2602:8
    #11 0x7fe79e4b7a26 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2636:14
    #12 0x7fe79e136bcf in SetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:306:10
    #13 0x7fe79e136bcf in SetObjectElementOperation /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:1881:10
    #14 0x7fe79e136bcf in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3141:12
    #15 0x7fe79e116a9b in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:400:10
    #16 0x7fe79e116a9b in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
    #17 0x7fe79e117edc in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
    #18 0x7fe79e119e56 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #19 0x7fe79e119e56 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
    #20 0x7fe79e673903 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/SelfHosting.cpp:1499:10
    #21 0x7fe79e230eef in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/AsyncFunction.cpp:149:8
    #22 0x7fe79e5853b0 in AsyncFunctionPromiseReactionJob /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2111:12
    #23 0x7fe79e5853b0 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2174:12
    #24 0x7fe79e117d23 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
    #25 0x7fe79e117d23 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
    #26 0x7fe79e119e56 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #27 0x7fe79e119e56 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
    #28 0x7fe79e26d7fb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #29 0x7fe791abd353 in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:83:8
    #30 0x7fe78c849726 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:198:12
    #31 0x7fe78c849726 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:211:12
    #32 0x7fe78c849726 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:213:18
    #33 0x7fe78c8202bb in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:676:17
    #34 0x7fe78c8215bf in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:463:3
    #35 0x7fe78ea1ce7f in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1488:28
    #36 0x7fe78caafe09 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1278:24
    #37 0x7fe78cac3698 in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
    #38 0x7fe78cac3698 in SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:473:31)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
    #39 0x7fe78cac3698 in nsThreadPool::ShutdownWithTimeout(int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:472:3
    #40 0x7fe78ca821df in operator()<> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1164:18
    #41 0x7fe78ca821df in __invoke_impl<nsresult, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
    #42 0x7fe78ca821df in __invoke<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
    #43 0x7fe78ca821df in __apply_impl<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
    #44 0x7fe78ca821df in apply<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
    #45 0x7fe78ca821df in apply<nsIThreadPool, nsresult (nsIThreadPool::*)()> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1162:12
    #46 0x7fe78ca821df in mozilla::detail::RunnableMethodImpl<nsCOMPtr<nsIThreadPool>, nsresult (nsIThreadPool::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1213:13
    #47 0x7fe78ca7e34a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
    #48 0x7fe78ca6f07e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879:26
    #49 0x7fe78ca6bf97 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702:15
    #50 0x7fe78ca6c87f in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
    #51 0x7fe78ca83964 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:221:37
    #52 0x7fe78ca83964 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #53 0x7fe78caaf3bc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1240:16
    #54 0x7fe78cac3698 in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
    #55 0x7fe78cac3698 in SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:473:31)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
    #56 0x7fe78cac3698 in nsThreadPool::ShutdownWithTimeout(int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:472:3
    #57 0x7fe78ca821df in operator()<> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1164:18
    #58 0x7fe78ca821df in __invoke_impl<nsresult, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
    #59 0x7fe78ca821df in __invoke<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
    #60 0x7fe78ca821df in __apply_impl<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
    #61 0x7fe78ca821df in apply<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
    #62 0x7fe78ca821df in apply<nsIThreadPool, nsresult (nsIThreadPool::*)()> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1162:12
    #63 0x7fe78ca821df in mozilla::detail::RunnableMethodImpl<nsCOMPtr<nsIThreadPool>, nsresult (nsIThreadPool::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1213:13
    #64 0x7fe78ca7e34a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
    #65 0x7fe78ca6f07e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879:26
    #66 0x7fe78ca6bf97 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702:15
    #67 0x7fe78ca6c87f in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
    #68 0x7fe78ca83931 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
    #69 0x7fe78ca83931 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #70 0x7fe78caaf3bc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1240:16
    #71 0x7fe78cabcd94 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
    #72 0x7fe78e6c7c4e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #73 0x7fe78e4f5afa in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #74 0x7fe78e4f5afa in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #75 0x7fe78e4f5afa in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #76 0x7fe797e47999 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #77 0x7fe79dcc08ee in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:717:20
    #78 0x7fe78e4f5afa in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #79 0x7fe78e4f5afa in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #80 0x7fe78e4f5afa in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #81 0x7fe79dcbffa4 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:34
    #82 0x55ae49ae16de in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #83 0x55ae49ae16de in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
    #84 0x7fe7b3629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #85 0x7fe7b3629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #86 0x55ae49a0ad18 in _start (/home/user/workspace/browsers/m-c-20230607214358-fuzzing-asan-opt/firefox+0x107d18) (BuildId: 617fa83271e68d58e0b0d2cdaf913a555ab9dd29)

Daniel, can you take a look at this?

Set release status flags based on info from the regressing bug 1592988

Looking into this now.

Verified bug as reproducible on mozilla-central 20230609214634-501ade4b55d9.
The bug appears to have been introduced in the following build range:

Start: 96e1951eae03fa3c9f2f9ad28348bf158297a334 (20230522122431)
End: 38320c197609eae03222a0bf0678b364576c8c9f (20230522151207)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=96e1951eae03fa3c9f2f9ad28348bf158297a334&tochange=38320c197609eae03222a0bf0678b364576c8c9f

https://hg.mozilla.org/mozilla-central/rev/9ba5a5405490

The patch landed in nightly and beta is affected.
:dbaker, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox115 to wontfix.

For more information, please visit BugBot documentation.

Verified bug as fixed on rev mozilla-central 20230615094111-6a3e55888810.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1592988
[User impact if declined]: There is a potential crash
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No
[Why is the change risky/not risky?]: Added simple check for conduit before setting jitterBufferTarget
[String changes made/needed]: None

Comment on attachment 9339174 [details]
Bug 1837483 - Add check for conduit before setting jitterBufferTarget.r?bwc

Moving beta uplift request to the patch

Comment on attachment 9339174 [details]
Bug 1837483 - Add check for conduit before setting jitterBufferTarget.r?bwc

Approved for 115.0b7.

https://hg.mozilla.org/releases/mozilla-beta/rev/e0877f8df852