Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PeerConnection] Fix crash: Old state information surfaced in SLD/SRD. #16350

Merged
merged 1 commit into from Apr 16, 2019

Conversation

chromium-wpt-export-bot
Copy link
Collaborator

@chromium-wpt-export-bot chromium-wpt-export-bot commented Apr 15, 2019

Because of WebRTC's blocking-invoke threading model, the order of events
are not always the same in the content and webrtc layers, causing bugs
in some edge-cases.

For example, addTrack() and setLocalDescription() both modify the set
of transceivers. addTrack() does so with a blocking-invoke, and SLD()
does so asynchronously, where the state change is surfaced in a
callback.

In rare cases, it is possible for addTrack() to modify the sender's
track and then for a setLocalDescription() callback carrying outdated
transceiver state information to null the track. And similarly this
could happen reverting changes to the transceiver's direction.

This makes the content layer not reflect the webrtc layer, which in
the referenced bug even causes a crash because a track adapter no
longer exists.

The fix is not to update "transceiver.sender.track" or
"transceiver.direction" in SLD/SRD callbacks for transceivers that
already exists. This is valid, because these fields can only be
modified by other APIs (addTrack, replaceTrack, direction, etc) and
not by SDP.

Bug: 950280
Change-Id: Icdcc65c5f8b5861550bda588597b88f6103c4f70
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1566346
Commit-Queue: Henrik Boström <hbos@chromium.org>
Reviewed-by: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651234}

Copy link
Collaborator

@wpt-pr-bot wpt-pr-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already reviewed downstream.

Because of WebRTC's blocking-invoke threading model, the order of events
are not always the same in the content and webrtc layers, causing bugs
in some edge-cases.

For example, addTrack() and setLocalDescription() both modify the set
of transceivers. addTrack() does so with a blocking-invoke, and SLD()
does so asynchronously, where the state change is surfaced in a
callback.

In rare cases, it is possible for addTrack() to modify the sender's
track and then for a setLocalDescription() callback carrying outdated
transceiver state information to null the track. And similarly this
could happen reverting changes to the transceiver's direction.

This makes the content layer not reflect the webrtc layer, which in
the referenced bug even causes a crash because a track adapter no
longer exists.

The fix is not to update "transceiver.sender.track" or
"transceiver.direction" in SLD/SRD callbacks for transceivers that
already exists. This is valid, because these fields can only be
modified by other APIs (addTrack, replaceTrack, direction, etc) and
not by SDP.

Bug: 950280
Change-Id: Icdcc65c5f8b5861550bda588597b88f6103c4f70
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1566346
Commit-Queue: Henrik Boström <hbos@chromium.org>
Reviewed-by: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651234}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants