Closed Bug 1122553 Opened 11 years ago Closed 11 years ago

BroadcastChannel crashes when a blob is sent to the same page.

Categories

(Core :: DOM: Core & HTML, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla38

People

(Reporter: baku, Assigned: baku)

Details

Attachments

(1 file, 2 obsolete files)

Attached patch crash.patch (obsolete) — Splinter Review
The issue is that, when a blob actor is created by the same Manager who owns it, we have a crash. This patch fixes the issue for the BroadcastChannel API, but maybe we want a more generic solution.
Attachment #8550297 - Flags: review?(bent.mozilla)
Attached patch crash.patch (obsolete) — Splinter Review
Attachment #8550297 - Attachment is obsolete: true
Attachment #8550297 - Flags: review?(bent.mozilla)
Attachment #8550549 - Flags: review?(bent.mozilla)
Comment on attachment 8550549 [details] [diff] [review] crash.patch Review of attachment 8550549 [details] [diff] [review]: ----------------------------------------------------------------- ::: dom/broadcastchannel/BroadcastChannelParent.cpp @@ +81,5 @@ > { > AssertIsOnBackgroundThread(); > > if (aOrigin == mOrigin && aChannel == mChannel) { > // We need to duplicate data only if we have blobs. You should update this comment to explain why you're doing the extra stuff ::: dom/broadcastchannel/BroadcastChannelService.cpp @@ +131,5 @@ > AssertIsOnBackgroundThread(); > MOZ_ASSERT(aParent); > MOZ_ASSERT(mAgents.Contains(aParent)); > > + nsAutoTArray<nsRefPtr<FileImpl>, 1> files; You could probably get away with 10 :) And comment why you're doing this. You could also move this to the PostMessageData struct... @@ +138,5 @@ > + > + for (uint32_t i = 0, len = aData.blobsParent().Length(); i < len; ++i) { > + nsRefPtr<FileImpl> impl = > + static_cast<BlobParent*>(aData.blobsParent()[i])->GetBlobImpl(); > + files.AppendElement(impl); MOZ_ASSERT(impl)
Attachment #8550549 - Flags: review?(bent.mozilla) → review+
Keywords: checkin-needed
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: