Bug 192697 – [GStreamer] Crash in webrtc::RTCStatsReport::AddStats

• Component: Media
• Status: REOPENED

[Michael Catanzaro]

I tried to join a Jitsi Meet meeting (using Igalia's Jitsi Meet) instance using a debug MiniBrowser built using build-webkit. After entering the meeting password, WebKit crashed immediately.

$ run-minibrowser --gtk
Starting MiniBrowser.
GLib-GIO-Message: 06:14:48.200: Using the 'memory' GSettings backend.  Your settings will not be saved or shared with other applications.
GLib-GIO-Message: 06:14:48.526: Using the 'memory' GSettings backend.  Your settings will not be saved or shared with other applications.
GLib-GIO-Message: 06:14:48.829: Using the 'memory' GSettings backend.  Your settings will not be saved or shared with other applications.
(delay_based_bwe.cc:311): BWE Setting start bitrate to: 300000
(webrtcvoiceengine.cc:1614): Unknown codec opus/48000/2 { minptime=10 useinbandfec=1 } (111)
(webrtcmediaengine.cc:168): Unsupported RTP extension: {uri: urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id, id: 4}
(delay_based_bwe.cc:311): BWE Setting start bitrate to: 800000


#
# Fatal error in ../../Source/ThirdParty/libwebrtc/Source/webrtc/stats/rtcstatsreport.cc, line 75
# last system error: 0
# Check failed: result.second
# A stats object with ID RTCMediaStreamTrack_receiver_0 is already present in this stats report.
#

==== C stack trace ===============================

 1: rtc::FatalMessage::~FatalMessage()
 2: webrtc::RTCStatsReport::AddStats(std::unique_ptr<webrtc::RTCStats const, std::default_delete<webrtc::RTCStats const> >)
/home/mcatanzaro/Projects/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xc102c35) [0x7fbf22106c35]
 4: webrtc::RTCStatsCollector::ProduceMediaStreamAndTrackStats_s(long, webrtc::RTCStatsReport*) const
 5: webrtc::RTCStatsCollector::ProducePartialResultsOnSignalingThread(long)
 6: webrtc::RTCStatsCollector::GetStatsReport(rtc::scoped_refptr<webrtc::RTCStatsCollectorCallback>)
 7: webrtc::PeerConnection::GetStats(webrtc::RTCStatsCollectorCallback*)
 8: void webrtc::ReturnType<void>::Invoke<webrtc::PeerConnectionInterface, void (webrtc::PeerConnectionInterface::*)(webrtc::RTCStatsCollectorCallback*), webrtc::RTCStatsCollectorCallback*>(webrtc::PeerConnectionInterface*, void (webrtc::PeerConnectionInterface::*)(webrtc::RTCStatsCollectorCallback*), webrtc::RTCStatsCollectorCallback*)
 9: webrtc::MethodCall1<webrtc::PeerConnectionInterface, void, webrtc::RTCStatsCollectorCallback*>::OnMessage(rtc::Message*)
10: webrtc::internal::SynchronousMethodCall::OnMessage(rtc::Message*)
11: rtc::MessageQueue::Dispatch(rtc::Message*)
12: rtc::Thread::ProcessMessages(int)
13: rtc::Thread::Run()
14: rtc::Thread::PreRun(void*)
/lib64/libpthread.so.0(+0x858e) [0x7fbf1020958e]
16: clone



The crash is on a secondary thread so the backtrace is relatively simple:

#0  0x00007fbf0e76c53f in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007fbf0e756895 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007fbf21e6c521 in rtc::FatalMessage::~FatalMessage (
    this=0x7fbde97fb460, __in_chrg=<optimized out>)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/checks.cc:125
No locals.
#3  0x00007fbf21ea706b in webrtc::RTCStatsReport::AddStats (
    this=0x7fbc586a3650, stats=std::unique_ptr<const webrtc::RTCStats> = {...})
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/stats/rtcstatsreport.cc:75
        result = {first = 
    {first = "RTCMediaStreamTrack_receiver_0", second = std::unique_ptr<const webrtc::RTCStats> = {get() = 0x7fbc586a5510}}, second = false}
#4  0x00007fbf22106c35 in webrtc::(anonymous namespace)::ProduceReceiverMediaTrackStats (timestamp_us=1544789780959336, track_media_info_map=..., 
    receivers=std::vector of length 8, capacity 8 = {...}, 
    report=0x7fbc586a3650)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtcstatscollector.cc:610
        track = 0x7fbc5869f240
        video_receiver_info = 0x7fbc586a1ed8
        video_track_stats = std::unique_ptr<webrtc::RTCMediaStreamTrackStats> = {get() = 0x0}
        receiver = {ptr_ = 0x7fbc5869f280}
        __for_range = std::vector of length 8, capacity 8 = {{
            ptr_ = 0x7fbc5869d7a0}, {ptr_ = 0x7fbc5869dc80}, {
            ptr_ = 0x7fbc5869e200}, {ptr_ = 0x7fbc5869ed20}, {
            ptr_ = 0x7fbc5869f280}, {ptr_ = 0x7fbc5869f950}, {
            ptr_ = 0x7fbc5869ffa0}, {ptr_ = 0x7fbc586a03c0}}
        __for_begin = {ptr_ = 0x7fbc5869f280}
        __for_end = {ptr_ = 0x0}
#5  0x00007fbf2210b0f4 in webrtc::RTCStatsCollector::ProduceMediaStreamAndTrackStats_s (this=0x7fbc580909e0, timestamp_us=1544789780959336, 
    report=0x7fbc586a3650)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtcstatscollector.cc:1019
No locals.
#6  0x00007fbf22108d10 in webrtc::RTCStatsCollector::ProducePartialResultsOnSignalingThread (this=0x7fbc580909e0, timestamp_us=1544789780959336)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtcstatscollector.cc:773
        report = {ptr_ = 0x7fbc586a3650}
#7  0x00007fbf221089a4 in webrtc::RTCStatsCollector::GetStatsReport (
    this=0x7fbc580909e0, callback=...)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtcstatscollector.cc:746
        timestamp_us = 1544789780959336
        cache_now_us = 223975051893
        __FUNCTION__ = "GetStatsReport"
#8  0x00007fbf220b8c93 in webrtc::PeerConnection::GetStats (
    this=0x7fbc5808fa60, callback=0x15abce0)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/pc/peerconnection.cc:1473
No locals.
#9  0x00007fbf21e15760 in webrtc::ReturnType<void>::Invoke<webrtc::PeerConnectionInterface, void (webrtc::PeerConnectionInterface::*)(webrtc::RTCStatsCollectorCallback*), webrtc::RTCStatsCollectorCallback*> (this=0x7fbde87fa5e0, 
    c=0x7fbc5808fa60, 
    m=&virtual webrtc::PeerConnectionInterface::GetStats(webrtc::RTCStatsCollectorCallback*), a1=0x15abce0)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/api/proxy.h:106
No locals.
#10 0x00007fbf21e13157 in webrtc::MethodCall1<webrtc::PeerConnectionInterface, void, webrtc::RTCStatsCollectorCallback*>::OnMessage (this=0x7fbde87fa590)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/api/proxy.h:193
No locals.
#11 0x00007fbf21db471c in webrtc::internal::SynchronousMethodCall::OnMessage (
    this=0x7fbde87fa550)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/api/proxy.cc:33
No locals.
#12 0x00007fbf21e74bcc in rtc::MessageQueue::Dispatch (this=0xfe4800, 
    pmsg=0x7fbde97fc950)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/messagequeue.cc:531
        trace_event_unique_catstatic529 = 0x7fbf24931cf8 ""
        trace_event_unique_profileScope529 = {p_data_ = 0x0, data_ = {
            category_enabled = 0x702578302000 <error: Cannot access memory at address 0x702578302000>, name = 0x0}}
        start_time = 223975051
        end_time = 223974788
        diff = -1
#13 0x00007fbf21e9dfa2 in rtc::Thread::ProcessMessages (this=0xfe4800, 
    cmsLoop=-1)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/thread.cc:485
        msg = {posted_from = {
            function_name_ = 0x7fbf248f0978 <webrtc::PeerConnectionProxyWithInternal<webrtc::PeerConnectionInterface>::GetStats(webrtc::RTCStatsCollectorCallback*)::__FUNCTION__> "GetStats", 
            file_and_line_ = 0x7fbf248ef2a8 "../../Source/ThirdParty/libwebrtc/Source/webrtc/api/peerconnectionproxy.h:72"}, phandler = 0x7fbde87fa558, 
          message_id = 0, pdata = 0x0, ts_sensitive = 0}
        msEnd = 0
        cmsNext = -1
#14 0x00007fbf21e9d519 in rtc::Thread::Run (this=0xfe4800)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/thread.cc:314
No locals.
#15 0x00007fbf21e9d4d6 in rtc::Thread::PreRun (pv=0x1529150)
    at ../../Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/thread.cc:301
        init = 0x1529150
#16 0x00007fbf1020958e in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#17 0x00007fbf0e8316a3 in clone () from /lib64/libc.so.6
No symbol table info available.
Undefined command: "exit".  Try "help".

[Thibault Saunier]

That is with a jhbuild en right? I only tested with flatpak (successfully) I have the impression the opus encoder hasen't been built. The error is a bit strange but I think it might be some weirdness of libwebrtc caused by unbuilt opus support.

[Michael Catanzaro]

Yes, WebKit's JHBuild. (I'm anxiously awaiting a resolution to bug #191196.)

I guess it goes without saying that a missing encoder or decoder shouldn't cause a crash, so perhaps it's fortunate if the jhbuild is missing something that uncovered this.

[Thibault Saunier]

We should make opus a hard dependency fmpov

[Xabier Rodríguez Calvar]

I am seeing now:

ASSERTION FAILED: isInWebProcess()
../../Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp(242) : bool WebCore::ensureGStreamerInitialized()
1   0x7f2a91ecd1f1 WTFCrash
2   0x7f2a95110ba1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xc7aba1) [0x7f2a95110ba1]
3   0x7f2a966d5338 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x223f338) [0x7f2a966d5338]
4   0x7f2a9a06af21 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x5bd4f21) [0x7f2a9a06af21]
5   0x7f2a98f67b24 WebCore::CaptureDeviceManager::getCaptureDevices(WTF::CompletionHandler<void (WTF::Vector<WebCore::CaptureDevice, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&)>&&)
6   0x7f2a98f7b50a WebCore::RealtimeMediaSourceCenter::getMediaStreamDevices(WTF::CompletionHandler<void (WTF::Vector<WebCore::CaptureDevice, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&)>&&)
7   0x7f2a95c51736 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17bb736) [0x7f2a95c51736]
8   0x7f2a95c517b2 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17bb7b2) [0x7f2a95c517b2]
9   0x7f2a95c5bee2 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17c5ee2) [0x7f2a95c5bee2]
10  0x7f2a95c59922 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17c3922) [0x7f2a95c59922]
11  0x7f2a95c57377 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17c1377) [0x7f2a95c57377]
12  0x7f2a95c573a1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17c13a1) [0x7f2a95c573a1]
13  0x7f2a95c573b2 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17c13b2) [0x7f2a95c573b2]
14  0x7f2a8e1ffaaf /usr/lib/x86_64-linux-gnu/libpthread.so.0(+0x10aaf) [0x7f2a8e1ffaaf]
15  0x7f2a95c4b6e2 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17b56e2) [0x7f2a95c4b6e2]
16  0x7f2a95c57447 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17c1447) [0x7f2a95c57447]
17  0x7f2a95c51840 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x17bb840) [0x7f2a95c51840]
18  0x7f2a95ccbd3d /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x1835d3d) [0x7f2a95ccbd3d]
19  0x7f2a953e775d /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xf5175d) [0x7f2a953e775d]
20  0x7f2a953d7c35 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xf41c35) [0x7f2a953d7c35]
21  0x7f2a953cdcfc /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xf37cfc) [0x7f2a953cdcfc]
22  0x7f2a953c04ee /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xf2a4ee) [0x7f2a953c04ee]
23  0x7f2a95abb5f9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x16255f9) [0x7f2a95abb5f9]
24  0x7f2a95bf3155 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x175d155) [0x7f2a95bf3155]
25  0x7f2a95d8bc40 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x18f5c40) [0x7f2a95d8bc40]
26  0x7f2a95a991cb /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x16031cb) [0x7f2a95a991cb]
27  0x7f2a95a99435 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x1603435) [0x7f2a95a99435]
28  0x7f2a95a99bab /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x1603bab) [0x7f2a95a99bab]
29  0x7f2a95a98f56 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x1602f56) [0x7f2a95a98f56]
30  0x7f2a95a9ed80 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x1608d80) [0x7f2a95a9ed80]
31  0x7f2a90f8b1f7 /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0xd4c1f7) [0x7f2a90f8b1f7]

but I don't really get to entering a password, this happens before entering the password.

[Philippe Normand]

(In reply to Xabier Rodríguez Calvar from comment #4)
> I am seeing now:
> 
> ASSERTION FAILED: isInWebProcess()
> ../../Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp(242) :
> bool WebCore::ensureGStreamerInitialized()

This is https://bugs.webkit.org/show_bug.cgi?id=222888

[Xabier Rodríguez Calvar]

So we have to wait until bug 222888 is fixed before coming back to have a look at this.

[Xabier Rodríguez Calvar]

Tried to open it in debug mode and found:

ASSERTION FAILED: m_frames.size() < maxCallStackSizeToCapture
/app/webkit/Source/JavaScriptCore/inspector/ScriptCallStack.cpp(56) : Inspector::ScriptCallStack::ScriptCallStack(WTF::Vector<Inspector::ScriptCallFrame>&&, bool, Inspector::AsyncStackTrace*)
1   0x7f451eaedb65 WTFCrash
2   0x7f451c99c442 /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.1.so.0(+0x1f9c442) [0x7f451c99c442]
3   0x7f451dd1ee3b Inspector::ScriptCallStack::ScriptCallStack(WTF::Vector<Inspector::ScriptCallFrame, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&, bool, Inspector::AsyncStackTrace*)
4   0x7f451dd1ecee Inspector::ScriptCallStack::create(WTF::Vector<Inspector::ScriptCallFrame, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&, bool, Inspector::AsyncStackTrace*)
5   0x7f451dd23c4a /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.1.so.0(+0x3323c4a) [0x7f451dd23c4a]
6   0x7f451dd1f556 Inspector::createScriptCallStackForConsole(JSC::JSGlobalObject*, unsigned long)
7   0x7f451dc3dd5a Inspector::ConsoleMessage::autogenerateMetadata(JSC::JSGlobalObject*)
8   0x7f451dc3d903 Inspector::ConsoleMessage::ConsoleMessage(JSC::MessageSource, JSC::MessageType, JSC::MessageLevel, WTF::String const&, WTF::Ref<Inspector::ScriptArguments, WTF::RawPtrTraits<Inspector::ScriptArguments> >&&, JSC::JSGlobalObject*, unsigned long, WTF::Seconds)
9   0x7f452d67c22a /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xd67c22a) [0x7f452d67c22a]
10  0x7f452d674824 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xd674824) [0x7f452d674824]
11  0x7f452d64b8b1 WebCore::PageConsoleClient::messageWithTypeAndLevel(JSC::MessageType, JSC::MessageLevel, JSC::JSGlobalObject*, WTF::Ref<Inspector::ScriptArguments, WTF::RawPtrTraits<Inspector::ScriptArguments> >&&)
12  0x7f451e18b2fd /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.1.so.0(+0x378b2fd) [0x7f451e18b2fd]
13  0x7f451e18b350 /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.1.so.0(+0x378b350) [0x7f451e18b350]
14  0x7f451e18c8ee /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.1.so.0(+0x378c8ee) [0x7f451e18c8ee]
15  0x7f451e18c9da /app/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.1.so.0(+0x378c9da) [0x7f451e18c9da]
16  0x7f44bc008038 [0x7f44bc008038]

[Xabier Rodríguez Calvar]

After trying on release mode to avoid the JSC crash I see no crash after using --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36".

[Philippe Normand]

How did you manage to make a Jitsi video call with the current GstWebRTC backend?

[Philippe Normand]

Reopening, we'll check this again whenever we have Jitsi working with the GstWebRTC backend.