microsoft / MixedReality-WebRTC

MixedReality-WebRTC is a collection of components to help mixed reality app developers integrate audio and video real-time communication into their application and improve their collaborative experience
https://microsoft.github.io/MixedReality-WebRTC/
MIT License
898 stars 278 forks source link

Crash around when webrtc answer is received - mrsVideoTrackSourceRegisterArgb32FrameCallback #806

Open carllelandtaylor opened 2 years ago

carllelandtaylor commented 2 years ago

Describe the bug I'm getting a crash pretty consistently in the Unity editor, and relatively often in a PC build. It seems to happen around when a webrtc connection is made or renegotiated, but because it's happening in a worker thread down in the mrwebrtc DLL and our version of mrwebrtc (2.0.2) doesn't ship with debug symbols, I'm having a hard time figuring out what exactly the problem is. Anyone have any ideas, or suggestions for how to debug further?

mrwebrtc.dll caused an Access Violation (0xc0000005)
  in module mrwebrtc.dll at 0033:2cbe4e53.

Read from location 0000000000000000 caused an access violation.

Stack Trace of Crashed Thread 97600:
0x00007FFF45574E53 (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFF4572CC59 (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFF45728D99 (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFF456F781C (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFF455BABB0 (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFF45584B3E (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFF45584AA5 (mrwebrtc) mrsVideoTrackSourceRegisterArgb32FrameCallback
0x00007FFFCD807034 (KERNEL32) BaseThreadInitThunk
0x00007FFFCEA82651 (ntdll) RtlUserThreadStart

To Reproduce Unfortunately, I don't have a repro setup that I can share publicly.

SDP messages Here's an example of the offer and answer in a case where I got a crash. Note that both clients were on my local machine, so the IP address here is just localhost.

Offer message (sent by the app that will crash)
v=0
o=- 172087196051946788 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0 1
a=msid-semantic: WMS
m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 102 0 8 106 105 13 110 112 113 126
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:15+G
a=ice-pwd:+F+OV7xHVDN5979XPoO45ljF
a=ice-options:trickle
a=fingerprint:sha-256 BE:54:7E:92:24:00:B2:49:6A:A4:AD:02:38:C6:CA:F7:1F:2C:A8:D1:6C:26:85:DF:31:21:D6:C7:AD:DE:FF:C1
a=setup:actpass
a=mid:0
a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=extmap:9 urn:ietf:params:rtp-hdrext:sdes:mid
a=recvonly
a=rtcp-mux
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:103 ISAC/16000
a=rtpmap:104 ISAC/32000
a=rtpmap:9 G722/8000
a=rtpmap:102 ILBC/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:106 CN/32000
a=rtpmap:105 CN/16000
a=rtpmap:13 CN/8000
a=rtpmap:110 telephone-event/48000
a=rtpmap:112 telephone-event/32000
a=rtpmap:113 telephone-event/16000
a=rtpmap:126 telephone-event/8000
m=application 9 DTLS/SCTP 5000
c=IN IP4 0.0.0.0
a=ice-ufrag:15+G
a=ice-pwd:+F+OV7xHVDN5979XPoO45ljF
a=ice-options:trickle
a=fingerprint:sha-256 BE:54:7E:92:24:00:B2:49:6A:A4:AD:02:38:C6:CA:F7:1F:2C:A8:D1:6C:26:85:DF:31:21:D6:C7:AD:DE:FF:C1
a=setup:actpass
a=mid:1
a=sctpmap:5000 webrtc-datachannel 1024
... Many ICE messages here ... Answer message (received by the app that will crash)
v=0
o=- 843531618361467966 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0 1
a=msid-semantic: WMS
m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 102 0 8 106 105 13 110 112 113 126
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:/vmj
a=ice-pwd:FC4RTzTYiQWINOyRtt4s2x5K
a=ice-options:trickle
a=fingerprint:sha-256 F8:33:C9:4D:B6:08:D8:13:59:BC:65:96:5F:7B:43:1E:99:49:A7:B7:3F:F6:DD:43:59:54:D4:91:29:CE:52:1A
a=setup:active
a=mid:0
a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=extmap:9 urn:ietf:params:rtp-hdrext:sdes:mid
a=sendonly
a=msid:- 840d79ab-0816-40f7-b49f-70ee0a416631
a=rtcp-mux
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:103 ISAC/16000
a=rtpmap:104 ISAC/32000
a=rtpmap:9 G722/8000
a=rtpmap:102 ILBC/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:106 CN/32000
a=rtpmap:105 CN/16000
a=rtpmap:13 CN/8000
a=rtpmap:110 telephone-event/48000
a=rtpmap:112 telephone-event/32000
a=rtpmap:113 telephone-event/16000
a=rtpmap:126 telephone-event/8000
a=ssrc:3261950306 cname:vd5ZvSA+UQLwJf6X
a=ssrc:3261950306 msid: 840d79ab-0816-40f7-b49f-70ee0a416631
a=ssrc:3261950306 mslabel:
a=ssrc:3261950306 label:840d79ab-0816-40f7-b49f-70ee0a416631
m=application 9 DTLS/SCTP 5000
c=IN IP4 0.0.0.0
b=AS:30
a=ice-ufrag:/vmj
a=ice-pwd:FC4RTzTYiQWINOyRtt4s2x5K
a=ice-options:trickle
a=fingerprint:sha-256 F8:33:C9:4D:B6:08:D8:13:59:BC:65:96:5F:7B:43:1E:99:49:A7:B7:3F:F6:DD:43:59:54:D4:91:29:CE:52:1A
a=setup:active
a=mid:1
a=sctpmap:5000 webrtc-datachannel 1024

At this point, PeerConnection.HandleConnectionMessageAsync runs and the crash seems to occur sometime during its execution. It doesn't always happen at the same point in that C# because the crash is on a different thread.

We also sometimes do get another ICE message or two after the answer. Not sure if that's related? It could be our signaling solution is receiving messages out of order.

Environment

Additional context