Repository navigation
Revoking a blob url twice causes an internal error and crashes node #42206
Description
Version
v17.6.0
Platform
Linux the-mistery-machine 5.13.0-30-generic #33~20.04.1-Ubuntu SMP Mon Feb 7 14:25:10 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Subsystem
No response
What steps will reproduce the bug?
The following code will cause Node to crash:
import { Blob } from "node:buffer";
const url = URL.createObjectURL(new Blob([]));
URL.revokeObjectURL(url);
URL.revokeObjectURL(url);How often does it reproduce? Is there a required condition?
It happens consistently.
What is the expected behavior?
The second URL.revokeObjectURL should just be a no-op, this is consistent with web behaviour.
What do you see instead?
It produces the following crash:
node[1082797]: ../src/node_blob.cc:447:void node::BlobBindingData::revoke_data_object(const string&): Assertion `(data_objects_.find(uuid)) != (data_objects_.end())' failed.
1: 0xb2e180 node::Abort() [node]
2: 0xb2e1fe [node]
3: 0xb01e7a node::BlobBindingData::revoke_data_object(std::string const&) [node]
4: 0xb02157 node::Blob::RevokeDataObject(v8::FunctionCallbackInfo<v8::Value> const&) [node]
5: 0xd7c07e [node]
6: 0xd7d49f v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
7: 0x1632979 [node]
zsh: abort (core dumped) node --input-type=module < test.js
Additional information
No response
Activity
Trott commentedon Mar 4, 2022
@nodejs/url @nodejs/buffer
src: skip revoke_data_object if uuid is not found
src: skip revoke_data_object if uuid is not found
src: skip revoke_data_object if uuid is not found
src: skip revoke_data_object if uuid is not found
src: skip revoke_data_object if uuid is not found