In free_stream() function, the stream is freed, but the stream reference is not removed from  the client->streams list and the client->nstreams counter is not decremented.The stream cleanup logic exists in free_session(). But there are cases when free_stream() is called without removing the session. One such case is when the "autoremove" property is set on gstrtpbin. If this property is set, the rtpjitterbuffer and the ptdemuxer associated with the stream is cleaned up, but the session might still be receiving media from another SSRC. Now if a new stream is received from the same client (same cname) as which was removed, the client->nstreams counter is incremented and now refelcts incorrect number of streams belonging to this client. As a result in gst_rtp_bin_associate() while walking the client->streams list, the stale stream is operated upon, causing assertion failures downstream since the stream's jitterbuffer has already been cleaned up and is no longer a valid GObject.