Bug 174323 – Accessing localDescription, remoteDescription, etc. after setTimeout raises EXC_BAD_ACCESS

• Component: WebCore JavaScript
• Status: RESOLVED FIXED

[Mark Roberts]

The following code raises an EXC_BAD_ACCESS error and crashes the tab in Safari 11 Tech Preview.

    (async () => {
      const pc = new RTCPeerConnection()
      pc.close()
      await new Promise(resolve => setTimeout(resolve))
      console.log(pc.localDescription)
    })()

Even simpler:

    const pc = new RTCPeerConnection()
    pc.close()
    setTimeout(() => {
      console.log(pc.localDescription)
    })

You can replace the access to `localDescription` with any of

    * localDescription
    * currentLocalDescription
    * pendingLocalDescription
    * remoteDescription
    * currentRemoteDescription
    * pendingRemoteDescription

Expected output:

    null

Actual output:

    Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
    0   com.apple.WebCore             	0x000000010b59e8dd WebCore::LibWebRTCMediaEndpoint::pendingRemoteDescription() const + 13
    1   com.apple.WebCore             	0x000000010b5aa872 WebCore::LibWebRTCPeerConnectionBackend::pendingRemoteDescription() const + 18
    2   com.apple.WebCore             	0x000000010b89a1a6 WebCore::RTCPeerConnection::pendingRemoteDescription() const + 22
    3   com.apple.WebCore             	0x000000010b3d4b77 WebCore::jsRTCPeerConnectionPendingRemoteDescription(JSC::ExecState*, long long, JSC::PropertyName) + 231
    ...

[Radar WebKit Bug Importer]

<rdar://problem/33267876>

[youenn fablet]

Created attachment 315275 [details]
Patch

[Eric Carlson]

Comment on attachment 315275 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=315275&action=review

> Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp:384
> +void PeerConnectionBackend::cleanPendingPromises()

Nit: rejectPendingPromises, or maybe clearPendingPromises, would be a more accurate name.

[Build Bot]

Comment on attachment 315275 [details]
Patch

Attachment 315275 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/4109254

New failing tests:
imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-createOffer.html
webrtc/libwebrtc/release-while-creating-offer.html
imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-createAnswer.html
imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setRemoteDescription.html

[Build Bot]

Created attachment 315282 [details]
Archive of layout-test-results from ews106 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[youenn fablet]

Created attachment 315283 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 315283 [details]
Patch for landing

Clearing flags on attachment: 315283

Committed r219428: <http://trac.webkit.org/changeset/219428>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.