awss1i

#55085: fix: crash when onSendHeaders observes a Blob upload

Merged
Created: Oct 17, 2026, 10:23:30 AM
Merged: Oct 21, 2026, 11:45:43 AM
6 comments
Target: main

Description of Change

Fixes #55075.

With an onSendHeaders listener and no blocking listener for the request, a page uploading Blob bodies could crash the main process with a null dereference. A request that only observers match is started on the IO thread, and ObservedURLLoader posted a copy of it to the UI thread while sending the original to the network. Both copies shared one body, so the UI thread cloned a Blob element's data pipe getter for uploadData while the IO thread cloned the same getter to serialize the request. Cloning takes the getter out of its element for the duration of the call, so when the two overlapped one thread called Clone through an empty remote.

Now only onBeforeRequest and onBeforeSendHeaders add the upload data to their details, as the docs describe, and the observed loader drops the body from the copy it posts to the UI thread. The other events no longer include it.

On Linux, a page sending 1000 Blob uploads with only onSendHeaders registered aborted the main process on the data pipe getter DCHECK in 10 of 10 runs without the fix and in none with it. The new specs upload a Blob with only observers registered, and with a listener on each stage the request goes through. They check that the server receives the body and that only the two blocking events get the upload data. Both failed in 3 of 3 runs without the fix and passed in 10 of 10 with it. The rest of the suite gives the same results with and without the change.

Reading a streaming upload body in onBeforeSendHeaders still crashes, already on 43.8.0, so I've left that for a separate PR.

Checklist

Release Notes

Notes: Fixed a main process crash when onSendHeaders observed Blob uploads.

Backports

44-x-y
Merged
PR Number
#55168
Merged At
Oct 21, 2026, 2:42:30 PM
Released In
Not yet
Release Date
Not yet
45-x-y
Merged
PR Number
#55169
Merged At
Oct 21, 2026, 2:41:59 PM
Released In
Not yet
Release Date
Not yet

Semver Impact

Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.

Semantic Versioning helps users understand the impact of updates:

  • Major (X.y.z): Breaking changes that may require code modifications
  • Minor (x.Y.z): New features that maintain backward compatibility
  • Patch (x.y.Z): Bug fixes that don't change the API
  • None: Changes that don't affect using facing parts of Electron