Closed Bug 1132395 Opened 5 years ago Closed 5 years ago

URL.createObjectURL crashes in SharedWorkers in debug builds

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla38
Tracking Status
firefox38 --- fixed

People

(Reporter: baku, Assigned: baku)

References

Details

Attachments

(1 file, 1 obsolete file)

No description provided.
Attached patch url.patch (obsolete) — Splinter Review
The issue here is that we assume that if the worker doesn't have a window, then it's a ChromeWorker. But it can be also a SharedWorker or ServiceWorker, so the assertion has to be removed.
Attachment #8563319 - Flags: review?(bugs)
Attached patch url.patchSplinter Review
Attachment #8563319 - Attachment is obsolete: true
Attachment #8563319 - Flags: review?(bugs)
Attachment #8563321 - Flags: review?(bugs)
Comment on attachment 8563321 [details] [diff] [review]
url.patch

Curious, how do we revoke object urls in case of Shared/ServiceWorkers?
Attachment #8563321 - Flags: review?(bugs) → review+
We have a list of URLs in the WorkerPrivate object. When the worker is deleted, we remove those URLs. All of this happens in the main-thread:

Here the registration into the WorkerPrivate obj:
https://mxr.mozilla.org/mozilla-central/source/dom/workers/URL.cpp#156

Then here we remove those URLs in the main-thread:
https://mxr.mozilla.org/mozilla-central/source/dom/workers/WorkerPrivate.cpp#768

https://hg.mozilla.org/integration/mozilla-inbound/rev/6aad679bbbc0
https://hg.mozilla.org/mozilla-central/rev/6aad679bbbc0
Status: NEW → RESOLVED
Closed: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Depends on: 1134224
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.