Custom Query (2195 matches)

Scenario:

• we receive INVITE
• we send 200/OK with G.722.1 (pt=119) as the selected codec
• call is confirmed, media is OK
• we disabled all codecs except G.722 (pt=9)
• we send UPDATE
• we receive 401, we resend UPDATE
• we receive 200/OK for UPDATE, with G.722 codec (pt=9) in the answer
• at this point, we should be using G.722 codec (pt=9) in the media, but it looks like we're still expecting G.722.1:

  09:29:01.429  strm0x12ebca8  Bad RTP pt 9 (expecting 119)
  

Call to AudioConverterNew() for the iLBC codec may take long time to complete, causing timeout in acquiring pjsua lock (when doing get call info on incoming call).

This happens on iPhone 3GS with iOS 4.0.2 and SDK 4.0.

Reported that this occurred on "slow CPU" (iPhone 3G) in "heavy CPU load" and barely reproducible.

The stack when crashing:

0   0x0018bdb4 auth_get_tag_length (auth.c:64)
1   0x001898dc srtp_unprotect (srtp.c:885)
2   0x00135310 srtp_rtp_cb (transport_srtp.c:864)
3   0x0011ce70 ice_on_rx_data (transport_ice.c:1641)
4   0x0014907c stun_on_rx_data (ice_strans.c:1395)
5   0x001404ac on_data_recvfrom (stun_sock.c:815)
6   0x000f08a0 ioqueue_on_read_complete (activesock.c:573)
7   0x000fb4bc ioqueue_dispatch_read_event (ioqueue_common_abs.c:560)
8   0x000fbb7c pj_ioqueue_poll

After investigation, a possible scenario is:

1. the call is disconnecting, so media deinitialization steps are on progress
2. an RTP packet is coming and ice_on_rx_data() is about to call SRTP callback rtp_cb in media worker thread
3. context switch happens, now pjsua_media_channel_deinit() is executed (at least until pjmedia_transport_media_stop()) in signaling worker thread
4. when the context back to media worker thread, SRTP callback is called after SRTP backend states (or even the SRTP instance itself) have been destroyed