id summary reporter owner description type status priority milestone component version resolution keywords cc backport_to_milestone backported 1773 Crash caused by race condition between transport destroy and callback nanang bennylp "Call stack: {{{ Thread 14 Crashed: pj_list_insert_nodes_before (list_i.h:25) int_parse_msg (sip_parser.c:1033) pjsip_parse_rdata (sip_parser.c:761) pjsip_tpmgr_receive_packet (sip_transport.c:1651) on_data_read (sip_transport_tcp.c:1292) ioqueue_on_read_complete (activesock.c:495) Thread 15: pj_mutex_lock (os_core_unix.c:1243) pj_ioqueue_unregister (ioqueue_common_abs.c:1326) pj_activesock_close (activesock.c:305) tcp_destroy (sip_transport_tcp.c:775) tcp_destroy_transport (sip_transport_tcp.c:724) destroy_transport (sip_transport.c:1092) pj_timer_heap_poll (timer.c:748) }}} The call stack shows that the transport callback is being invoked when transport destroy is on progress. As reported, a possible scenario is that the {{{tp_info}}} of the {{{rdata}}} is accessed after the memory pool has been released. Thanks Itay Bianco for the report." defect closed normal release-2.3 pjsip trunk fixed 0