PJSIP : Crash on pj_sockaddr_get_port when moving iOS app to background and then to foreground

Question

I have an iOS VOIP app using PJSIP v2.3.0.

After the iOS 11 release, I have been seeing a lot of instances of the crash below. I have fabric (crashlytics) integrated with my app and this is the backtrace of the thread that crashed.

Crashed: Thread
0  libsystem_kernel.dylib         0x186819348 __pthread_kill + 8
1  libsystem_pthread.dylib        0x18692d354 pthread_kill$VARIANT$mp + 396
2  libsystem_c.dylib              0x186788fd8 abort + 140
3  libsystem_c.dylib              0x18675cabc basename_r + 314
4  MyApp                          0x101a2ab58 pj_sockaddr_get_port + 10115892
5  MyApp                          0x101a24e28 udp_on_read_complete + 10092036
6  MyApp                          0x1019bba74 ioqueue_dispatch_read_event + 9661008
7  MyApp                          0x1019bd1f0 pj_ioqueue_poll + 9667020
8  MyApp                          0x101a08788 pjsip_endpt_handle_events2 + 9975652
9  MyApp                          0x1019df334 worker_thread + 9806608
10 MyApp                          0x1019cf274 thread_main + 9740880
11 libsystem_pthread.dylib        0x18692c32c _pthread_body + 308
12 libsystem_pthread.dylib        0x18692c1f8 _pthread_body + 310
13 libsystem_pthread.dylib        0x18692ac38 thread_start + 4

The thread crashes due to assertion on pj_sockaddr_get_port

PJ_ASSERT_RETURN(a->addr.sa_family == PJ_AF_INET ||
             a->addr.sa_family == PJ_AF_INET6, (pj_uint16_t)0xFFFF);

Note : PJ_ENABLE_EXTRA_CHECK is defined 0 for my app so PJ_ASSERT_RETURN is simply PJ_ASSERT here.

The PJSIP logs leading upto this crash tells something interesting. The app is backgrounded and it unregisters. When the app is brought to foreground after several minutes, it tries to register.

I see the following warning messages and at the same time crashlytics reported the crash mentioned above with the backtrace.

2017-09-28 21:00:11 TID=50691 [pjsua] Log Level-1 : 16:00:11.267     ioq_select  Error replacing socket: Invalid argument
2017-09-28 21:00:11 TID=50691 [pjsua] Log Level-1 : 16:00:11.267     udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120009] Bad file descriptor
2017-09-28 21:00:11 TID=50691 [pjsua] Log Level-1 : 16:00:11.267     udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120009] Bad file descriptor
.
.
.
2017-09-28 21:00:18 TID=50691 [pjsua] Log Level-1 : 16:00:15.256     udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120057] Socket is not connected
2017-09-28 21:00:18 TID=50691 [pjsua] Log Level-1 : 16:00:15.256     udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120057] Socket is not connected
2017-09-28 21:00:18 TID=50691 [pjsua] Log Level-1 : 16:00:15.256     udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120057] Socket is not connected
.
.
.
2017-09-28 21:00:18 TID=50691 [pjsua] Log Level-1 : 16:00:18.262 udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120038] Socket operation on non-socket
2017-09-28 21:00:18 TID=50691 [pjsua] Log Level-1 : 16:00:18.262 udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120038] Socket operation on non-socket
2017-09-28 21:00:18 TID=50691 [pjsua] Log Level-1 : 16:00:18.262 udp0x10de7f3a0  Warning: pj_ioqueue_recvfrom: [err 120038] Socket operation on non-socket

These warning messages appear because of spinning loop inside udp_on_read_complete from what I understand. Could iOS be re-claiming the socket that pjsip is trying to use?

Did anybody come across this crash? Any kind of pointers/guide is most welcome.

user_4634240 · Answer

The fix I made was to simply return from ioqueue_dispatch_read_event method in pjlib/src/pj/ioqueue_common_abs.c when the replace_udp_sock() fails. The crash was happening because the error was ignored and on_read_complete was called with bad socket.

Change I made:

rc = replace_udp_sock(h);
if (rc != PJ_SUCCESS) {
  PJ_LOG(3, (THIS_FILE, "UDP socket replacement failed with error status %d", rc));
  if (has_lock) {
      pj_ioqueue_unlock_key(h);
  }
  return;
}

Let me know if this solves the problem for you.

PJSIP : Crash on pj_sockaddr_get_port when moving iOS app to background and then to foreground

1 Answers