Bug 76150 - PeerConnection crashes when adding a NULL media stream
Summary: PeerConnection crashes when adding a NULL media stream
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Tommy Widenflycht
URL: http://www.whatwg.org/specs/web-apps/...
Keywords:
Depends on: 58550
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-11 23:23 PST by Jeremy Mao
Modified: 2012-01-30 12:25 PST (History)
4 users (show)

See Also:


Attachments
Patch (5.61 KB, patch)
2012-01-27 06:34 PST, Tommy Widenflycht
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jeremy Mao 2012-01-11 23:23:14 PST
void PeerConnection::addStream(PassRefPtr<MediaStream> prpStream, ExceptionCode& ec)
{
    ......

    // The MediaStream object is guaranteed to exist since StrictTypeChecking is set in the idl.
 
    RefPtr<MediaStream> stream = prpStream;

    if (m_localStreams->contains(stream.get()))
         return;

    m_localStreams->append(stream);
 
    MediaStreamDescriptor* streamDescriptor = stream->descriptor();

    .......
}

if prpStream is a NULL media stream, then stream->descriptor() may cause memory leak
Comment 1 Adam Bergkvist 2012-01-12 02:42:55 PST
I'm not sure what you mean by memory leak here. The comment about StrictTypeChecking implies that null media streams are handled by the JS binding so that this method will never be called with a null MediaStream.
Comment 2 Jeremy Mao 2012-01-12 23:34:33 PST
(In reply to comment #1)
> I'm not sure what you mean by memory leak here. The comment about StrictTypeChecking implies that null media streams are handled by the JS binding so that this method will never be called with a null MediaStream.

You are right, I can see the JS binding code deal with addStream arguments, but it's weird in my platform, if I try to new a peerconnection object, then add a null media stream, it doesn't throw any exception. I try to trace the code, and always get a <stream = 0>, then the renderer crashes.
Comment 3 Tommy Widenflycht 2012-01-27 06:34:05 PST
Created attachment 124305 [details]
Patch
Comment 4 WebKit Review Bot 2012-01-30 12:25:32 PST
Comment on attachment 124305 [details]
Patch

Clearing flags on attachment: 124305

Committed r106275: <http://trac.webkit.org/changeset/106275>
Comment 5 WebKit Review Bot 2012-01-30 12:25:37 PST
All reviewed patches have been landed.  Closing bug.