Bug 222724

Summary:

nullopt in ReadableStreamSource::controller() via FileReaderLoader::failed

Product:

WebKit

Reporter:

Ryosuke Niwa <rniwa>

Component:

WebCore Misc.

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

achristensen, bfulgham, cgarcia, ews-feeder, fred.wang, gpoo, product-security, rbuis, sihui_liu, svillar, webkit-bug-importer, youennf

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Test	none
Patch	none

Ryosuke Niwa

Reported 2021-03-04 01:46:58 PST

Created attachment 422202 [details] Test e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000011e1e3596 WTF::Optional<WebCore::ReadableStreamDefaultController>::value() & + 38 (Optional.h:550) 1 com.apple.WebCore 0x000000011e1e356d WebCore::ReadableStreamSource::controller() + 13 (ReadableStreamSource.h:49) 2 com.apple.WebCore 0x000000011fc1b031 WebCore::Blob::stream(WebCore::ScriptExecutionContext&)::BlobStreamSource::didFail(WebCore::ExceptionCode) + 193 (Blob.cpp:287) 3 com.apple.WebCore 0x000000011fc3ca6f WebCore::FileReaderLoader::failed(WebCore::ExceptionCode) + 319 (FileReaderLoader.cpp:243) 4 com.apple.WebCore 0x000000011fc3def3 WebCore::FileReaderLoader::didFail(WebCore::ResourceError const&) + 99 (FileReaderLoader.cpp:235) 5 com.apple.WebCore 0x0000000120656c88 WebCore::DocumentThreadableLoader::logErrorAndFail(WebCore::ResourceError const&) + 264 (DocumentThreadableLoader.cpp:736) 6 com.apple.WebCore 0x000000012065780e WebCore::DocumentThreadableLoader::loadRequest(WebCore::ResourceRequest&&, WebCore::SecurityCheckPolicy) + 2414 (DocumentThreadableLoader.cpp:578) 7 com.apple.WebCore 0x000000012065636f WebCore::DocumentThreadableLoader::DocumentThreadableLoader(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::DocumentThreadableLoader::BlockingBehavior, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::RefPtr<WebCore::SecurityOrigin, WTF::RawPtrTraits<WebCore::SecurityOrigin>, WTF::DefaultRefDerefTraits<WebCore::SecurityOrigin> >&&, std::__1::unique_ptr<WebCore::ContentSecurityPolicy, std::__1::default_delete<WebCore::ContentSecurityPolicy> >&&, WTF::String&&, WebCore::DocumentThreadableLoader::ShouldLogError) + 2111 (DocumentThreadableLoader.cpp:174) 8 com.apple.WebCore 0x0000000120655216 WebCore::DocumentThreadableLoader::DocumentThreadableLoader(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::DocumentThreadableLoader::BlockingBehavior, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::RefPtr<WebCore::SecurityOrigin, WTF::RawPtrTraits<WebCore::SecurityOrigin>, WTF::DefaultRefDerefTraits<WebCore::SecurityOrigin> >&&, std::__1::unique_ptr<WebCore::ContentSecurityPolicy, std::__1::default_delete<WebCore::ContentSecurityPolicy> >&&, WTF::String&&, WebCore::DocumentThreadableLoader::ShouldLogError) + 22 (DocumentThreadableLoader.cpp:129) 9 com.apple.WebCore 0x00000001206554e6 WebCore::DocumentThreadableLoader::create(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::RefPtr<WebCore::SecurityOrigin, WTF::RawPtrTraits<WebCore::SecurityOrigin>, WTF::DefaultRefDerefTraits<WebCore::SecurityOrigin> >&&, std::__1::unique_ptr<WebCore::ContentSecurityPolicy, std::__1::default_delete<WebCore::ContentSecurityPolicy> >&&, WTF::String&&, WebCore::DocumentThreadableLoader::ShouldLogError) + 166 (DocumentThreadableLoader.cpp:88) 10 com.apple.WebCore 0x0000000120655869 WebCore::DocumentThreadableLoader::create(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String&&) + 345 (DocumentThreadableLoader.cpp:96) 11 com.apple.WebCore 0x00000001207611b8 WebCore::ThreadableLoader::create(WebCore::ScriptExecutionContext&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String&&, WTF::String&&) + 520 (ThreadableLoader.cpp:115) 12 com.apple.WebCore 0x000000011fc3c6a7 WebCore::FileReaderLoader::start(WebCore::ScriptExecutionContext*, WebCore::Blob&) + 1079 (FileReaderLoader.cpp:99) 13 com.apple.WebCore 0x000000011fc1aa97 WebCore::Blob::stream(WebCore::ScriptExecutionContext&)::BlobStreamSource::BlobStreamSource(WebCore::ScriptExecutionContext&, WebCore::Blob&) + 423 (Blob.cpp:251) 14 com.apple.WebCore 0x000000011fc0e2f9 WebCore::Blob::stream(WebCore::ScriptExecutionContext&)::BlobStreamSource::BlobStreamSource(WebCore::ScriptExecutionContext&, WebCore::Blob&) + 9 (Blob.cpp:250) 15 com.apple.WebCore 0x000000011fc0e0b7 WebCore::Blob::stream(WebCore::ScriptExecutionContext&) + 311 (Blob.cpp:297) 16 com.apple.WebCore 0x000000011c56d8ba WebCore::jsBlobPrototypeFunction_streamBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSBlob*) + 330 (JSBlob.cpp:292) 17 com.apple.WebCore 0x000000011c56d6c7 long long WebCore::IDLOperation<WebCore::JSBlob>::call<&(WebCore::jsBlobPrototypeFunction_streamBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSBlob*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) + 247 (JSDOMOperation.h:53) 18 com.apple.WebCore 0x000000011c56cc09 WebCore::jsBlobPrototypeFunction_stream(JSC::JSGlobalObject*, JSC::CallFrame*) + 9 (JSBlob.cpp:297) 19 ??? 0x0000573f0cc011d8 0 + 95928308470232 <rdar://problem/74638237>

Attachments
Test (76 bytes, text/html) 2021-03-04 01:46 PST, Ryosuke Niwa	no flags	Details
Patch (4.41 KB, patch) 2021-03-04 05:39 PST, youenn fablet	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Ryosuke Niwa

Comment 1 2021-03-04 01:47:45 PST

Reproduced with WebKitTestRunner and DumpRenderTree at r273811.

youenn fablet

Comment 2 2021-03-04 04:54:44 PST

The issue is that the failure is synchronous, so stream is not started when getting the failure. Will fix it.

youenn fablet

Comment 3 2021-03-04 05:39:24 PST

Created attachment 422216 [details] Patch

EWS

Comment 4 2021-03-04 08:32:30 PST

Committed r273890: <https://commits.webkit.org/r273890> All reviewed patches have been landed. Closing bug and clearing flags on attachment 422216 [details].

Ryosuke Niwa

Comment 5 2021-03-04 22:03:22 PST

Is there any security implication or no?

Alex Christensen

Comment 6 2021-03-04 22:49:52 PST

I don't think so. It was just hitting a release assert

Ryosuke Niwa

Comment 7 2021-03-04 23:15:30 PST

(In reply to Alex Christensen from comment #6) > I don't think so. It was just hitting a release assert Thanks for the confirmation.

Note You need to log in before you can comment on or make changes to this bug.