Bug 222724 – nullopt in ReadableStreamSource::controller() via FileReaderLoader::failed

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Ryosuke Niwa]

Created attachment 422202 [details]
Test

e.g.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000011e1e3596 WTF::Optional<WebCore::ReadableStreamDefaultController>::value() & + 38 (Optional.h:550)
1   com.apple.WebCore             	0x000000011e1e356d WebCore::ReadableStreamSource::controller() + 13 (ReadableStreamSource.h:49)
2   com.apple.WebCore             	0x000000011fc1b031 WebCore::Blob::stream(WebCore::ScriptExecutionContext&)::BlobStreamSource::didFail(WebCore::ExceptionCode) + 193 (Blob.cpp:287)
3   com.apple.WebCore             	0x000000011fc3ca6f WebCore::FileReaderLoader::failed(WebCore::ExceptionCode) + 319 (FileReaderLoader.cpp:243)
4   com.apple.WebCore             	0x000000011fc3def3 WebCore::FileReaderLoader::didFail(WebCore::ResourceError const&) + 99 (FileReaderLoader.cpp:235)
5   com.apple.WebCore             	0x0000000120656c88 WebCore::DocumentThreadableLoader::logErrorAndFail(WebCore::ResourceError const&) + 264 (DocumentThreadableLoader.cpp:736)
6   com.apple.WebCore             	0x000000012065780e WebCore::DocumentThreadableLoader::loadRequest(WebCore::ResourceRequest&&, WebCore::SecurityCheckPolicy) + 2414 (DocumentThreadableLoader.cpp:578)
7   com.apple.WebCore             	0x000000012065636f WebCore::DocumentThreadableLoader::DocumentThreadableLoader(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::DocumentThreadableLoader::BlockingBehavior, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::RefPtr<WebCore::SecurityOrigin, WTF::RawPtrTraits<WebCore::SecurityOrigin>, WTF::DefaultRefDerefTraits<WebCore::SecurityOrigin> >&&, std::__1::unique_ptr<WebCore::ContentSecurityPolicy, std::__1::default_delete<WebCore::ContentSecurityPolicy> >&&, WTF::String&&, WebCore::DocumentThreadableLoader::ShouldLogError) + 2111 (DocumentThreadableLoader.cpp:174)
8   com.apple.WebCore             	0x0000000120655216 WebCore::DocumentThreadableLoader::DocumentThreadableLoader(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::DocumentThreadableLoader::BlockingBehavior, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::RefPtr<WebCore::SecurityOrigin, WTF::RawPtrTraits<WebCore::SecurityOrigin>, WTF::DefaultRefDerefTraits<WebCore::SecurityOrigin> >&&, std::__1::unique_ptr<WebCore::ContentSecurityPolicy, std::__1::default_delete<WebCore::ContentSecurityPolicy> >&&, WTF::String&&, WebCore::DocumentThreadableLoader::ShouldLogError) + 22 (DocumentThreadableLoader.cpp:129)
9   com.apple.WebCore             	0x00000001206554e6 WebCore::DocumentThreadableLoader::create(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::RefPtr<WebCore::SecurityOrigin, WTF::RawPtrTraits<WebCore::SecurityOrigin>, WTF::DefaultRefDerefTraits<WebCore::SecurityOrigin> >&&, std::__1::unique_ptr<WebCore::ContentSecurityPolicy, std::__1::default_delete<WebCore::ContentSecurityPolicy> >&&, WTF::String&&, WebCore::DocumentThreadableLoader::ShouldLogError) + 166 (DocumentThreadableLoader.cpp:88)
10  com.apple.WebCore             	0x0000000120655869 WebCore::DocumentThreadableLoader::create(WebCore::Document&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String&&) + 345 (DocumentThreadableLoader.cpp:96)
11  com.apple.WebCore             	0x00000001207611b8 WebCore::ThreadableLoader::create(WebCore::ScriptExecutionContext&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String&&, WTF::String&&) + 520 (ThreadableLoader.cpp:115)
12  com.apple.WebCore             	0x000000011fc3c6a7 WebCore::FileReaderLoader::start(WebCore::ScriptExecutionContext*, WebCore::Blob&) + 1079 (FileReaderLoader.cpp:99)
13  com.apple.WebCore             	0x000000011fc1aa97 WebCore::Blob::stream(WebCore::ScriptExecutionContext&)::BlobStreamSource::BlobStreamSource(WebCore::ScriptExecutionContext&, WebCore::Blob&) + 423 (Blob.cpp:251)
14  com.apple.WebCore             	0x000000011fc0e2f9 WebCore::Blob::stream(WebCore::ScriptExecutionContext&)::BlobStreamSource::BlobStreamSource(WebCore::ScriptExecutionContext&, WebCore::Blob&) + 9 (Blob.cpp:250)
15  com.apple.WebCore             	0x000000011fc0e0b7 WebCore::Blob::stream(WebCore::ScriptExecutionContext&) + 311 (Blob.cpp:297)
16  com.apple.WebCore             	0x000000011c56d8ba WebCore::jsBlobPrototypeFunction_streamBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSBlob*) + 330 (JSBlob.cpp:292)
17  com.apple.WebCore             	0x000000011c56d6c7 long long WebCore::IDLOperation<WebCore::JSBlob>::call<&(WebCore::jsBlobPrototypeFunction_streamBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSBlob*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) + 247 (JSDOMOperation.h:53)
18  com.apple.WebCore             	0x000000011c56cc09 WebCore::jsBlobPrototypeFunction_stream(JSC::JSGlobalObject*, JSC::CallFrame*) + 9 (JSBlob.cpp:297)
19  ???                           	0x0000573f0cc011d8 0 + 95928308470232

<rdar://problem/74638237>

[Ryosuke Niwa]

Reproduced with WebKitTestRunner and DumpRenderTree at r273811.

[youenn fablet]

The issue is that the failure is synchronous, so stream is not started when getting the failure. Will fix it.

[youenn fablet]

Created attachment 422216 [details]
Patch

[EWS]

Committed r273890: <https://commits.webkit.org/r273890>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 422216 [details].

[Ryosuke Niwa]

Is there any security implication or no?

[Alex Christensen]

I don't think so.  It was just hitting a release assert

[Ryosuke Niwa]

(In reply to Alex Christensen from comment #6)
> I don't think so.  It was just hitting a release assert

Thanks for the confirmation.