Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[Desktop] Crash in CanvasAsyncBlobCreator

See original GitHub issue

It appears to me that static cast to LocalDomWindow in overriden canvas_async_blob_creator.cc is not safe (Document* document = To<LocalDOMWindow>(context)->document();), because context is not necessarily a window, it could be a worker. We can actually see V8OffscreenCanvas in the callstack that is used in workers.

So I suggest to change To to DynamicTo and also check other potentially dangerous callsites in Farbling infrastructure

[ 00 ] brave::BraveSessionCache::From(blink::Document&)
[ 01 ] blink::CanvasAsyncBlobCreator::CanvasAsyncBlobCreator(scoped_refptr<blink::StaticBitmapImage>, blink::ImageEncodeOptions const*, blink::CanvasAsyncBlobCreator::ToBlobFunctionType, blink::V8BlobCallback*, base::TimeTicks, blink::ExecutionContext*, blink::ScriptPromiseResolver*)
[ 02 ] blink::CanvasAsyncBlobCreator::CanvasAsyncBlobCreator(scoped_refptr<blink::StaticBitmapImage>, blink::ImageEncodeOptions const*, blink::CanvasAsyncBlobCreator::ToBlobFunctionType, base::TimeTicks, blink::ExecutionContext*, blink::ScriptPromiseResolver*)
[ 03 ] blink::CanvasRenderingContextHost::convertToBlob(blink::ScriptState*, blink::ImageEncodeOptions const*, blink::ExceptionState&)
[ 04 ] blink::V8OffscreenCanvas::ConvertToBlobMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&)
[ 05 ] v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*)
[ 06 ] Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit

...

https://brave.sp.backtrace.io/p/brave/triage?aggregations=((guid%2Cunique)%2C(classifiers%2Chead))&fingerprint=0e19f930cd9b5a95610deadfcf5e934c7c08b3213d535412d5559179d3bad178

also https://brave.sp.backtrace.io/p/brave/debug?filters=(_deleted%3D0%2C(ver%2Cregex%2C"8[1|2|3|4].*")%2Cptype%3Drenderer%2C(callstack%2Ccontains%2CCanvasAsyncBlobCreator))&debug=(%224bbf3%22,0,0)