Crash on fallback to network after clients.claim |
||||
Issue descriptionFrom mek's comments on bug 604084 : https://codereview.chromium.org/1894183003 is the test case that I came up with to cause this code to crash with regular fetch: - start preflight request from uncontrolled client - install worker - clients.claim - (tell server to) respond to preflight - cors request is send to service worker - service worker doesn't handle request - fallback to network code crashes
,
May 10 2016
,
May 10 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/01fb3c2cf2bf84391c488f3a3dd5ef8c59cc0a51 commit 01fb3c2cf2bf84391c488f3a3dd5ef8c59cc0a51 Author: horo <horo@chromium.org> Date: Tue May 10 15:19:57 2016 Set SkipServiceWorker flag in DocumentThreadableLoader::loadActualRequest(). Before a SW controls the page, when the DTL sends a CORS preflight request, the SkipServiceWorker flag is set by RenderFrameImpl::willSendRequest(). But a new SW may be controlling the page when the DTL sends the actual request by calling clients.claim(). In such case, the request goes to the SW and causes several problems. To avoid this problem, this cl set the flag in DTL::loadActualRequest(). BUG= 604583 , 610400 Review-Url: https://codereview.chromium.org/1964823002 Cr-Commit-Position: refs/heads/master@{#392609} [modify] https://crrev.com/01fb3c2cf2bf84391c488f3a3dd5ef8c59cc0a51/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
,
May 10 2016
,
May 12 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b083560ed010859fb4cdd23626ddef597d40b1f4 commit b083560ed010859fb4cdd23626ddef597d40b1f4 Author: Tsuyoshi Horo <horo@chromium.org> Date: Thu May 12 02:17:09 2016 Set SkipServiceWorker flag in DocumentThreadableLoader::loadActualRequest(). Before a SW controls the page, when the DTL sends a CORS preflight request, the SkipServiceWorker flag is set by RenderFrameImpl::willSendRequest(). But a new SW may be controlling the page when the DTL sends the actual request by calling clients.claim(). In such case, the request goes to the SW and causes several problems. To avoid this problem, this cl set the flag in DTL::loadActualRequest(). BUG= 604583 , 610400 Review-Url: https://codereview.chromium.org/1964823002 Cr-Commit-Position: refs/heads/master@{#392609} (cherry picked from commit 01fb3c2cf2bf84391c488f3a3dd5ef8c59cc0a51) Review URL: https://codereview.chromium.org/1975673002 . Cr-Commit-Position: refs/branch-heads/2704@{#516} Cr-Branched-From: 6e53600def8f60d8c632fadc70d7c1939ccea347-refs/heads/master@{#386251} [modify] https://crrev.com/b083560ed010859fb4cdd23626ddef597d40b1f4/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp |
||||
►
Sign in to add a comment |
||||
Comment 1 by horo@chromium.org
, Apr 19 2016Components: Blink>Network>FetchAPI
This is crashing at DocumentThreadableLoader::handleResponse() if (response.wasFetchedViaServiceWorker()) { if (response.wasFallbackRequiredByServiceWorker()) { ASSERT(!m_fallbackRequestForServiceWorker.isNull()); <== here I think we have to set skipServiceWorker() in the renderer when isControlledByServiceWorker() is false before sending the request to the browser process.