[Webkit-unassigned] [Bug 233174] New: Safari 15.1 regression: RTCRtpSender.replaceTrack with a disabled track crashes safari

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=233174

            Bug ID: 233174
           Summary: Safari 15.1 regression: RTCRtpSender.replaceTrack with
                    a disabled track crashes safari
           Product: WebKit
           Version: Safari 15
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Major
          Priority: P2
         Component: WebRTC
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: avade at dialpad.com
                CC: youennf at gmail.com

Steps to reproduce:
1.Visit https://webrtc.github.io/samples/src/content/peerconnection/pc1/
2. Click on Start and Call buttons. Note that this app/demo exposes `pc1` on console which is a RTCPeerConnection object
3. Invoke the following code from the dev tools console:


black = ({ width = 640, height = 480 } = {}) => {
  const canvas = Object.assign(document.createElement('canvas'), { width, height });
  canvas.getContext('2d').fillRect(0, 0, width, height);
  const stream = canvas.captureStream();
  return Object.assign(stream.getVideoTracks()[0], { enabled: false }); // Note: changing enabled to true doesn't crash safari
};

dummyTrack = black();

pc1.getSenders()[0].replaceTrack(dummyTrack)

4. Notice that safari crashes.

Happens only on Safari 15.1, earlier versions were fine, so this is a regression. Happens both on BigSur and Monterey

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20211116/817285b3/attachment.htm>