1132395 - URL.createObjectURL crashes in SharedWorkers in debug builds

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Comment 1

[Andrea Marchesini [:baku]]

Attachment: url.patch

The issue here is that we assume that if the worker doesn't have a window, then it's a ChromeWorker. But it can be also a SharedWorker or ServiceWorker, so the assertion has to be removed.

Comment 2

[Andrea Marchesini [:baku]]

Attachment: url.patch

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8563321 [details] [diff] [review]
url.patch

Curious, how do we revoke object urls in case of Shared/ServiceWorkers?

Comment 4

[Andrea Marchesini [:baku]]

We have a list of URLs in the WorkerPrivate object. When the worker is deleted, we remove those URLs. All of this happens in the main-thread:

Here the registration into the WorkerPrivate obj:
https://mxr.mozilla.org/mozilla-central/source/dom/workers/URL.cpp#156

Then here we remove those URLs in the main-thread:
https://mxr.mozilla.org/mozilla-central/source/dom/workers/WorkerPrivate.cpp#768

https://hg.mozilla.org/integration/mozilla-inbound/rev/6aad679bbbc0

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6aad679bbbc0