Bug 76150

Summary:

PeerConnection crashes when adding a NULL media stream

Product:

WebKit

Reporter:

Jeremy Mao <yujie.mao>

Component:

DOM

Assignee:

Tommy Widenflycht <tommyw>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

adam.bergkvist, tommyw, webkit.review.bot, yujie.mao

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

URL:

http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html#video-conferencing-and-peer-to-peer-communication

Bug Depends on:

58550

Bug Blocks:

Attachments:

Description	Flags
Patch	none

Jeremy Mao

Reported 2012-01-11 23:23:14 PST

void PeerConnection::addStream(PassRefPtr<MediaStream> prpStream, ExceptionCode& ec) { ...... // The MediaStream object is guaranteed to exist since StrictTypeChecking is set in the idl. RefPtr<MediaStream> stream = prpStream; if (m_localStreams->contains(stream.get())) return; m_localStreams->append(stream); MediaStreamDescriptor* streamDescriptor = stream->descriptor(); ....... } if prpStream is a NULL media stream, then stream->descriptor() may cause memory leak

Attachments
Patch (5.61 KB, patch) 2012-01-27 06:34 PST, Tommy Widenflycht	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Adam Bergkvist

Comment 1 2012-01-12 02:42:55 PST

I'm not sure what you mean by memory leak here. The comment about StrictTypeChecking implies that null media streams are handled by the JS binding so that this method will never be called with a null MediaStream.

Jeremy Mao

Comment 2 2012-01-12 23:34:33 PST

(In reply to comment #1) > I'm not sure what you mean by memory leak here. The comment about StrictTypeChecking implies that null media streams are handled by the JS binding so that this method will never be called with a null MediaStream. You are right, I can see the JS binding code deal with addStream arguments, but it's weird in my platform, if I try to new a peerconnection object, then add a null media stream, it doesn't throw any exception. I try to trace the code, and always get a <stream = 0>, then the renderer crashes.

Tommy Widenflycht

Comment 3 2012-01-27 06:34:05 PST

Created attachment 124305 [details] Patch

WebKit Review Bot

Comment 4 2012-01-30 12:25:32 PST

Comment on attachment 124305 [details] Patch Clearing flags on attachment: 124305 Committed r106275: <http://trac.webkit.org/changeset/106275>

WebKit Review Bot

Comment 5 2012-01-30 12:25:37 PST

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.