Summary
CefRequest.setHeaderByName("", value, true) (an empty header name) crashes the ENABLE_COVERAGE Debug build with:
FATAL:.../libcef_dll/ctocpp/request_ctocpp.cc:293] Check failed: !name.empty().
This is a CHECK inside CEF's own bundled binary distribution (request_ctocpp.cc, not this fork's native/ code) -- native/CefRequest_N.cpp's N_SetHeaderByName just forwards the raw Java strings straight through with no validation:
return request->SetHeaderByName(GetJNIString(env, jname), GetJNIString(env, jvalue),
joverride != JNI_FALSE);
Confirmed the identical call does not crash in the Release build -- consistent with the broader pattern this session already found several instances of (issues #9, #16): some of CEF's own CHECK/DCHECK assertions in the bundled binary distribution behave differently between Debug and Release builds. Unlike most of those, this one is arguably CEF correctly enforcing a real precondition (an empty header name isn't meaningful) -- the actual gap is that JCEF has no Java-side validation and just lets an invalid value reach a native CHECK that happens to be silently absent in Release, rather than surfacing a clean Java-level error either way.
This also cost a full coverage-measurement run this session: the crash happened early enough in the process that CoverageTestHelper.flush() (called in TestSetupExtension.close() specifically to preserve coverage data before any known-crashing shutdown path) never got a chance to run -- 0 .gcda files were written for that entire run, wasting it.
Repro
Added to java/tests/junittests/MalformedInputEdgeCaseTest.java (currently @Disabled with a link to this issue -- remove @Disabled to re-run it, under the ENABLE_COVERAGE/Debug build specifically; it does not reproduce in Release):
CefRequest request = CefRequest.create();
request.setHeaderByName("", "some-value", true); // crashes in Debug only
Confirmed via an isolated --select-method run against the Debug/coverage build.
Fix sketch (not implemented here)
Either (a) validate in native/CefRequest_N.cpp's N_SetHeaderByName that jname is non-null/non-empty before calling into CEF, and no-op or throw a clear Java exception instead, or (b) confirm CEF's own Release build genuinely permits an empty header name silently (in which case Debug's CHECK is arguably a robustness bug in CEF itself worth reporting upstream to chromiumembedded/cef, not chromiumembedded/java-cef).
Found via
This fork's coverage-expansion effort (tracked in #5), during a "bad-path"/malformed-input test-writing round -- specifically while re-running Track B's ENABLE_COVERAGE Debug-build measurement with this session's newly-added tests included.
Summary
CefRequest.setHeaderByName("", value, true)(an empty header name) crashes theENABLE_COVERAGEDebug build with:This is a
CHECKinside CEF's own bundled binary distribution (request_ctocpp.cc, not this fork'snative/code) --native/CefRequest_N.cpp'sN_SetHeaderByNamejust forwards the raw Java strings straight through with no validation:Confirmed the identical call does not crash in the Release build -- consistent with the broader pattern this session already found several instances of (issues #9, #16): some of CEF's own
CHECK/DCHECKassertions in the bundled binary distribution behave differently between Debug and Release builds. Unlike most of those, this one is arguably CEF correctly enforcing a real precondition (an empty header name isn't meaningful) -- the actual gap is that JCEF has no Java-side validation and just lets an invalid value reach a nativeCHECKthat happens to be silently absent in Release, rather than surfacing a clean Java-level error either way.This also cost a full coverage-measurement run this session: the crash happened early enough in the process that
CoverageTestHelper.flush()(called inTestSetupExtension.close()specifically to preserve coverage data before any known-crashing shutdown path) never got a chance to run -- 0.gcdafiles were written for that entire run, wasting it.Repro
Added to
java/tests/junittests/MalformedInputEdgeCaseTest.java(currently@Disabledwith a link to this issue -- remove@Disabledto re-run it, under theENABLE_COVERAGE/Debug build specifically; it does not reproduce in Release):Confirmed via an isolated
--select-methodrun against the Debug/coverage build.Fix sketch (not implemented here)
Either (a) validate in
native/CefRequest_N.cpp'sN_SetHeaderByNamethatjnameis non-null/non-empty before calling into CEF, and no-op or throw a clear Java exception instead, or (b) confirm CEF's own Release build genuinely permits an empty header name silently (in which case Debug'sCHECKis arguably a robustness bug in CEF itself worth reporting upstream tochromiumembedded/cef, notchromiumembedded/java-cef).Found via
This fork's coverage-expansion effort (tracked in #5), during a "bad-path"/malformed-input test-writing round -- specifically while re-running Track B's
ENABLE_COVERAGEDebug-build measurement with this session's newly-added tests included.