All users were logged out of Bugzilla on October 13th, 2018

URL.createObjectURL crashes in SharedWorkers in debug builds

RESOLVED FIXED in Firefox 38

Status

()

RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: baku, Assigned: baku)

Tracking

Trunk
mozilla38
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox38 fixed)

Details

Attachments

(1 attachment, 1 obsolete attachment)

Comment hidden (empty)
(Assignee)

Comment 1

4 years ago
Created attachment 8563319 [details] [diff] [review]
url.patch

The issue here is that we assume that if the worker doesn't have a window, then it's a ChromeWorker. But it can be also a SharedWorker or ServiceWorker, so the assertion has to be removed.
Attachment #8563319 - Flags: review?(bugs)
(Assignee)

Comment 2

4 years ago
Created attachment 8563321 [details] [diff] [review]
url.patch
Attachment #8563319 - Attachment is obsolete: true
Attachment #8563319 - Flags: review?(bugs)
Attachment #8563321 - Flags: review?(bugs)

Comment 3

4 years ago
Comment on attachment 8563321 [details] [diff] [review]
url.patch

Curious, how do we revoke object urls in case of Shared/ServiceWorkers?
Attachment #8563321 - Flags: review?(bugs) → review+
(Assignee)

Comment 4

4 years ago
We have a list of URLs in the WorkerPrivate object. When the worker is deleted, we remove those URLs. All of this happens in the main-thread:

Here the registration into the WorkerPrivate obj:
https://mxr.mozilla.org/mozilla-central/source/dom/workers/URL.cpp#156

Then here we remove those URLs in the main-thread:
https://mxr.mozilla.org/mozilla-central/source/dom/workers/WorkerPrivate.cpp#768

https://hg.mozilla.org/integration/mozilla-inbound/rev/6aad679bbbc0
https://hg.mozilla.org/mozilla-central/rev/6aad679bbbc0
Status: NEW → RESOLVED
Last Resolved: 4 years ago
status-firefox38: --- → fixed
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Depends on: 1134224
You need to log in before you can comment on or make changes to this bug.