Skip to content

CefRequest.setHeaderByName() with an empty name crashes the Debug/coverage build (CEF's own CHECK) #20

Description

@Thrameos

Summary

CefRequest.setHeaderByName("", value, true) (an empty header name) crashes the ENABLE_COVERAGE Debug build with:

FATAL:.../libcef_dll/ctocpp/request_ctocpp.cc:293] Check failed: !name.empty().

This is a CHECK inside CEF's own bundled binary distribution (request_ctocpp.cc, not this fork's native/ code) -- native/CefRequest_N.cpp's N_SetHeaderByName just forwards the raw Java strings straight through with no validation:

return request->SetHeaderByName(GetJNIString(env, jname), GetJNIString(env, jvalue),
                                joverride != JNI_FALSE);

Confirmed the identical call does not crash in the Release build -- consistent with the broader pattern this session already found several instances of (issues #9, #16): some of CEF's own CHECK/DCHECK assertions in the bundled binary distribution behave differently between Debug and Release builds. Unlike most of those, this one is arguably CEF correctly enforcing a real precondition (an empty header name isn't meaningful) -- the actual gap is that JCEF has no Java-side validation and just lets an invalid value reach a native CHECK that happens to be silently absent in Release, rather than surfacing a clean Java-level error either way.

This also cost a full coverage-measurement run this session: the crash happened early enough in the process that CoverageTestHelper.flush() (called in TestSetupExtension.close() specifically to preserve coverage data before any known-crashing shutdown path) never got a chance to run -- 0 .gcda files were written for that entire run, wasting it.

Repro

Added to java/tests/junittests/MalformedInputEdgeCaseTest.java (currently @Disabled with a link to this issue -- remove @Disabled to re-run it, under the ENABLE_COVERAGE/Debug build specifically; it does not reproduce in Release):

CefRequest request = CefRequest.create();
request.setHeaderByName("", "some-value", true);  // crashes in Debug only

Confirmed via an isolated --select-method run against the Debug/coverage build.

Fix sketch (not implemented here)

Either (a) validate in native/CefRequest_N.cpp's N_SetHeaderByName that jname is non-null/non-empty before calling into CEF, and no-op or throw a clear Java exception instead, or (b) confirm CEF's own Release build genuinely permits an empty header name silently (in which case Debug's CHECK is arguably a robustness bug in CEF itself worth reporting upstream to chromiumembedded/cef, not chromiumembedded/java-cef).

Found via

This fork's coverage-expansion effort (tracked in #5), during a "bad-path"/malformed-input test-writing round -- specifically while re-running Track B's ENABLE_COVERAGE Debug-build measurement with this session's newly-added tests included.

Activity

  1. Thrameos commented on Aug 30, 2026

    @Thrameos
    OwnerAuthor

    Fifth reproduction across this null/empty-string CHECK family (see also #21): CefRequest.setHeaderByName(null, "value", true) also hits CHECK(!name.empty()), same as the explicit empty-string case this issue already covers, just via null instead. Disabled as NullParameterEdgeCaseTest.requestSetHeaderByNameWithNullNameDoesNotThrow().

  2. Thrameos commented on Aug 31, 2026

    @Thrameos
    OwnerAuthor

    Fixed. native/CefRequest_N.cpp's N_SetHeaderByName forwarded the raw Java header name straight through to CEF with no validation, hitting CEF's own CHECK(!name.empty()) in request_ctocpp.cc (Debug/coverage-build-only; silently permitted in Release).

    Fix: reject an empty header name in the JNI shim before calling into CEF (no-op instead of crashing), matching the fix sketch in this issue.

    Un-disabled requestSetHeaderByNameWithEmptyNameDoesNotThrow in MalformedInputEdgeCaseTest.java. Verified passing in a full-suite run (156/156 tests, 0 failures).

  3. added 5 commits that reference this issue on Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions