Crash with camera config changed event

[ethanhugg]

Ran into this while demoing the add-on here at Mozilla on Friday
(fortunately during the setup, rather than the actual demo):

SIPCC-SIP_CC_PROV: capset_get_idleset: updating idleset
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd01fe710 (LWP 7923)]
0x00007fffe2c0b9a0 in linked_ptr_internal::depart (this=0x7fffd01fd888)
at third_party/chromium_base/base/linked_ptr.h:68
68 while (p->next_ != this) p = p->next_;
(gdb) bt
#0 0x00007fffe2c0b9a0 in linked_ptr_internal::depart (this=0x7fffd01fd888)

 at third_party/chromium_base/base/linked_ptr.h:68

#1 0x00007fffe2c0b9cf in linked_ptrCSF::CC_Device::depart (

 this=0x7fffd01fd880) at third_party/chromium_base/base/linked_ptr.h:147

#2 0x00007fffe2c0f9f0 in linked_ptrCSF::CC_Device::~linked_ptr() ()

from /home/derf/src/mozilla/git/cisco/ikran/ikran/libsessioncontrol.so

#3 0x00007fffe2c0eb61 in

CSF::CallControlManagerImpl::notifyDeviceEventObservers
(this=0x7fffd8d880c0,
deviceEvent=CCAPI_DEVICE_EV_CAMERA_ADMIN_CONFIG_CHANGED,
devicePtr=...,
info=...) at src/callcontrol/CallControlManagerImpl.cpp:389
#4 0x00007fffe2c0e86f in CSF::CallControlManagerImpl::onDeviceEvent (

 this=0x7fffd8d880c0,
 deviceEvent=CCAPI_DEVICE_EV_CAMERA_ADMIN_CONFIG_CHANGED,

devicePtr=...,
info=...) at src/callcontrol/CallControlManagerImpl.cpp:367
#5 0x00007fffe2c1959d in CSF::CC_SIPCCService::notifyDeviceEventObservers (

 this=0x7fffd9b4b890,
 eventType=CCAPI_DEVICE_EV_CAMERA_ADMIN_CONFIG_CHANGED, devicePtr=...,
 info=...) at src/softphonewrapper/CC_SIPCCService.cpp:910

#6 0x00007fffe2c18201 in CSF::CC_SIPCCService::onDeviceEvent (

 type=CCAPI_DEVICE_EV_CAMERA_ADMIN_CONFIG_CHANGED, handle=0,
 info=0x7fffd32a5f90) at src/softphonewrapper/CC_SIPCCService.cpp:794

#7 0x00007fffe2c15d26 in CCAPI_DeviceListener_onDeviceEvent (

 type=CCAPI_DEVICE_EV_CAMERA_ADMIN_CONFIG_CHANGED, hDevice=0,
 dev_info=0x7fffd32a5f90) at

src/softphonewrapper/CC_SIPCCService.cpp:424
#8 0x00007fffe2c25867 in ccsnap_gen_deviceEvent (

 event=CCAPI_DEVICE_EV_CAMERA_ADMIN_CONFIG_CHANGED, handle=0)
 at src/sipcc/core/ccapp/ccapi_snapshot.c:449

#9 0x00007fffe2c63013 in cc_media_update_native_video_txcap (enable=1

'\001')
at src/sipcc/core/gsm/media_cap_tbl.c:166
#10 0x00007fffe2c28d96 in processProviderEvent (line_id=0, event=17, data=1)

 at src/sipcc/core/ccapp/ccprovider.c:401

#11 0x00007fffe2c28f33 in ccp_handler (msg=0x7fffd039f2d4, type=13)

 at src/sipcc/core/ccapp/ccprovider.c:1779

#12 0x00007fffe2cb3479 in CCApp_task (arg=)

 at src/sipcc/core/ccapp/ccapp_task.c:203

#13 0x00007ffff7bc8a36 in start_thread (arg=0x7fffd01fe710)

 at pthread_create.c:297

#14 0x00007ffff44ff94d in clone ()

 at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

(gdb) p p
$1 = (const void *) 0x0

This is on a 64-bit Linux build from 8c669eb with the patches I sent
earlier applied (I haven't touched that particular build since before
OVC because once I got it working I didn't want to break it).

[ethanhugg]

I have tried but have not been able to reproduce this, I have tried swapping out cameras, and on both mac and linux. I may need to do it on 64-bit to reproduce I have just been trying on 32-bit, and maybe on a machine that does not have an inbuilt camera.

It seems there is an issue with the CC_Device pointer when destructing as part of the chromium class linked_ptr in CallControlManagerImpl::notifyDeviceEventObservers on function exit.

Enda