Opened 7 years ago

Closed 7 years ago

#1852 closed defect (fixed)

Assertion due to premature destroy of dialog when media channel init fails during incoming call

Reported by: ming Owned by: bennylp
Priority: normal Milestone: release-2.4.5
Component: pjsua-lib Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description

Scenario (thanks to Fredrik Hansson for the report):

  1. In pjsua_call_on_incoming() function, after pjsua_media_channel_init() call returns PJ_SUCCESS, on_incoming_call_med_tp_complete() is called.
  2. on_incoming_call_med_tp_complete() returns !PJ_SUCCESS
  3. pjsip_dlg_respond() is entered.
  4. The response is created without problem and the pjsip_dlg_send_response() is called.
  5. We end up on the call to pjsip_dlg_dec_lock_().
  6. In the pjsip_dlg_dec_lock() function the session_count == 0 and tsx_count == 0 and we call the unregister_and_destroy_dialog() function.
  7. Then the destroy_dialog() is called which destroys the dlg->mutex_ if it exists.
  8. After the mutex is destroyed we returns all the way back from the pjsip_dlg_respond() call.
  9. After returning from pjsip_dlg_respond() the pjsip_inv_terminate() function is called.
  10. In the pjsip_inv_terminate() function the dialog is locked which will lead to an assert since the mutex is already destroyed

Change History (2)

comment:1 Changed 7 years ago by ming

  • Component changed from applications to pjsua-lib

comment:2 Changed 7 years ago by ming

  • Resolution set to fixed
  • Status changed from new to closed

In 5096:

Fixed #1852: Assertion due to premature destroy of dialog when media channel init fails during incoming call

Note: See TracTickets for help on using tickets.