Summary: | REGRESSION (r262776): Flaky crash under -[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:] | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryan Haddad <ryanhaddad> | ||||||
Component: | New Bugs | Assignee: | Rob Buis <rbuis> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | achristensen, rbuis, rwlbuis, webkit-bot-watchers-bugzilla, webkit-bug-importer | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
See Also: | https://bugs.webkit.org/show_bug.cgi?id=211999 | ||||||||
Bug Depends on: | |||||||||
Bug Blocks: | 213690 | ||||||||
Attachments: |
|
Description
Ryan Haddad
2020-06-10 16:30:06 PDT
I think this started after: XMLHTTPRequest.send should not send Content-Type headers when Blob has no type https://trac.webkit.org/changeset/262776/webkit I was able to reproduce a crash locally with: run-webkit-tests js/dom/promise-stack-overflow.html -1 --no-retry --iterations 100 -g --exit-after-n-crashes-or-timeouts 1 The 10th iteration hit the crash. This very likely needs a check that m_handle is not null. Created attachment 401636 [details]
Patch
(In reply to Ryan Haddad from comment #3) > I was able to reproduce a crash locally with: > run-webkit-tests js/dom/promise-stack-overflow.html -1 --no-retry > --iterations 100 -g --exit-after-n-crashes-or-timeouts 1 > > The 10th iteration hit the crash. I was able to repro (for me it was the 30th iteration), and I verified adding m_handle null check fixes the problem. Thanks! Should the patch be flagged for review? Comment on attachment 401636 [details]
Patch
Sorry, I forgot to set the review flag (again!) :)
Thanks, Rob! Committed r262925: <https://trac.webkit.org/changeset/262925> All reviewed patches have been landed. Closing bug and clearing flags on attachment 401636 [details]. |