1335524 - Calling URL.createObjectURL on a file from webkitGetAsEntry crashes

Status: RESOLVED DUPLICATE of bug 1332003

(Core :: DOM: Core & HTML, defect)

Description

[Nika Layzell [:nika] (ni? for response)]

Attachment: repro.html

In a debug build, the assertion is hit here:
http://searchfox.org/mozilla-central/rev/4e0c5c460318fb9ef7d92b129ac095ce04bc4795/dom/file/ipc/Blob.cpp#824-827

In a release build, an error is produced which kills the parent process.

STR:
Open the attached repro.html document
Drag a folder containing at least one file onto the red drop area

Expected Result:
Nothing happens

Actual Result:
The browser crashes

Comment 1

[Nika Layzell [:nika] (ni? for response)]

Olli, IIRC you implemented the webkitGetAsEntry API, do you know what might be going on here?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

baku has been looking into IPC blob handling recently.

But let me build a debug build to get stack trace.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Probably a dup of bug 1332003

Comment 4

[Nika Layzell [:nika] (ni? for response)]

I should also mention that this is an e10s-only failure.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

part 1 in bug 1332003 seems to fix this locally. Or at least the crash.
Worth to test createObjectURL handling some more though.

Comment 7

[Andrea Marchesini [:baku]]

Yes, the bug is fixed by moving the blob creation on the parent side.
I tested how the blobURL is created and it's fine. Maybe we can add this test as mochitest.