Browser crashes when importing linked IPFS content

[stephendonner]

Description

Browser crashes when importing linked IPFS content

Steps to Reproduce

(I should note I'm also on the 0.10.0-rc1 go-ipfs binary, rather than stable 0.9.1)

1. new profile
2. launch Brave
3. load ipns://en.wikipedia-on-ipfs.org
4. click Use a local node
5. load https://samplelib.com/sample-mp3.html
6. context-click the bottom Download button and choose Import to IPFS > Linked content

Actual result:

Crashes

On release and nightly channels:

[ 00 ] void ipfs::IpfsImportWorkerBase::OnImportFilesMoved(class std::__1::unique_ptr<std::__1::string,std::__1::default_delete<std::__1::string> >)
[ 01 ] _tailMerge_esent.dll
[ 02 ] _tailMerge_esent.dll
[ 03 ] _tailMerge_esent.dll
[ 04 ] _tailMerge_esent.dll
[ 05 ] _tailMerge_esent.dll
[ 06 ] _tailMerge_esent.dll
[ 07 ] _tailMerge_esent.dll
[ 08 ] static void base::internal::PartitionFree(const struct base::allocator::AllocatorDispatch *, void *, void *)
[ 09 ] static void base::internal::PartitionFree(const struct base::allocator::AllocatorDispatch *, void *, void *)
[ 10 ] mojo::MessageDispatcher::~MessageDispatcher()
[ 11 ] static void base::internal::Invoker<base::internal::BindState<void ((anonymous namespace)::SimpleURLLoaderOwner::*)(std::__1::unique_ptr<std::__1::string,std::__1::default_delete<std::__1::string> >),base::internal::UnretainedWrapper<(anonymous namespace)::SimpleURLLoaderOwner> >,void (std::__1::unique_ptr<std::__1::string,std::__1::default_delete<std::__1::string> >)>::RunOnce(class base::internal::BindStateBase *, class std::__1::unique_ptr<std::__1::string,std::__1::default_delete<std::__1::string> > *)
[ 12 ] [thunk]:mojo::internal::MultiplexRouter::`vector deleting destructor'`adjustor{8}' (unsigned int)
[ 13 ] void base::OnceCallback<void (std::__1::unique_ptr<EndpointResponse,std::__1::default_delete<EndpointResponse> >)>::Run(class std::__1::unique_ptr<EndpointResponse,std::__1::default_delete<EndpointResponse> >)
[ 14 ] void mojo::InterfacePtr<network::mojom::URLLoaderFactory>::reset()
[ 15 ] network::`anonymous namespace'::SaveToStringBodyHandler::NotifyConsumerOfCompletion(bool)
[ 16 ] void network::`anonymous namespace'::SimpleURLLoaderImpl::FinishWithResult(int)
[ 17 ] static bool network::mojom::URLResponseHeadDataView::ReadWebBundleUrl<GURL>(class GURL *)
[ 18 ] network::`anonymous namespace'::SimpleURLLoaderImpl::OnReceiveResponse(mojo::StructPtr<network::mojom::URLResponseHead>)
[ 19 ] mojo::internal::ContainerValidateParams::~ContainerValidateParams()
[ 20 ] network::mojom::URLLoaderClientStubDispatch::Accept(network::mojom::URLLoaderClient *,mojo::Message *)
[ 21 ] apps::mojom::internal::Publisher_OpenNativeSettings_Params_Data::Validate(void const *,mojo::internal::ValidationContext *)
[ 22 ] _tailMerge_esent.dll
[ 23 ] operator new(unsigned __int64)
[ 24 ] base::TaskAnnotator::ScopedSetIpcHash::~ScopedSetIpcHash()
[ 25 ] network::mojom::internal::URLResponseHead_Data::Validate(void const *,mojo::internal::ValidationContext *)
[ 26 ] network::mojom::URLLoaderClientStubDispatch::Accept(network::mojom::URLLoaderClient *,mojo::Message *)
[ 27 ] _tailMerge_esent.dll
[ 28 ] _tailMerge_esent.dll
[ 29 ] mojo::internal::ValidateStruct<network::mojom::internal::URLResponseHead_Data>(mojo::internal::Pointer<network::mojom::internal::URLResponseHead_Data> const &,mojo::internal::ValidationContext *)
[ 30 ] _tailMerge_esent.dll
[ 31 ] class base::WeakPtr<(anonymous namespace)::ExtensionUninstallDialogViews> base::WeakPtrFactory<(anonymous namespace)::ExtensionUninstallDialogViews>::GetWeakPtr()
[ 32 ] mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message *)
[ 33 ] mojo::MessageDispatcher::Accept(mojo::Message *)
[ 34 ] _tailMerge_esent.dll
[ 35 ] mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message *)
[ 36 ] base::ThreadLocalStorage::Slot::Set(void *)
[ 37 ] base::ThreadLocalStorage::Slot::Get()
[ 38 ] mojo::core::RequestContext::~RequestContext()
[ 39 ] mojo::Message::DeserializeAssociatedEndpointHandles(mojo::AssociatedGroupController *)
[ 40 ] mojo::core::UserMessageImpl::ExtractSerializedHandles(mojo::core::UserMessageImpl::ExtractBadHandlePolicy,unsigned int *)
[ 41 ] mojo::Message::Message(mojo::Message &&)
[ 42 ] class mojo::Message mojo::internal::MultiplexRouter::MessageWrapper::DeserializeEndpointHandlesAndTake()
[ 43 ] bool mojo::internal::MultiplexRouter::ProcessIncomingMessage(class mojo::internal::MultiplexRouter::MessageWrapper *, mojo::internal::MultiplexRouter::ClientCallBehavior, class base::SequencedTaskRunner *)
[ 44 ] mojo::core::RequestContext::~RequestContext()
[ 45 ] mojo::internal::MultiplexRouter::Accept(mojo::Message *)
[ 46 ] static void base::internal::PartitionFree(const struct base::allocator::AllocatorDispatch *, void *, void *)
[ 47 ] static void * base::internal::PartitionMalloc(const struct base::allocator::AllocatorDispatch *, unsigned __int64, void *)

Expected result:

No crash; audio file is imported

Reproduces how often:

100%

Brave version (brave://version info)

Brave	1.31.27 Chromium: 93.0.4577.63 (Official Build) nightly (64-bit)
Revision	ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@{#1135}
OS	Windows 10 OS Version 2009 (Build 22000.176)

/cc @spylogsster

[spylogsster]

cannot reproduce on both 0.9.1 and 0.10-rc1, @stephendonner can you please record video?

[stephendonner]

This looks good to me now using

Brave	1.33.40 Chromium: 95.0.4638.54 (Official Build) nightly (64-bit)
Revision	d31a821ec901f68d0d34ccdbaea45b4c86ce543e-refs/branch-heads/4638@{#871}
OS	Windows 10 Version 20H2 (Build 19042.1288)