net/http: WASM Roundtripper crash when using "no-cors" mode

[markkurossi]

What version of Go are you using (go version)?

go version go1.11rc2 darwin/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/mrossi/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/mrossi/work/go"
GOPROXY=""
GORACE=""
GOROOT="/Users/mrossi/sdk/go1.11rc2"
GOTMPDIR=""
GOTOOLDIR="/Users/mrossi/sdk/go1.11rc2/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/4s/j3nd4p8n6_7fj854xjvj_6zh0000gn/T/go-build853916135=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Create and execute an HTTP request to a different domain. Set the req.Header.Add("js.fetch:mode", "no-cors") header for the request. The request fails because of Cross-Origin Read Blocking (CORB) on Chrome/Mac. In addition, the go/wasm runtime panics:

panic: syscall/js: call of Value.Call on null

goroutine 5 [running]:
syscall/js.Value.Call(0x7ff8000000000002, 0x78a18, 0x9, 0x0, 0x0, 0x0, 0xc028cc0)
/Users/mrossi/sdk/go1.11rc2/src/syscall/js/js.go:279 +0x72
net/http.(*Transport).RoundTrip.func1(0xc01e310, 0x1, 0x1)
/Users/mrossi/sdk/go1.11rc2/src/net/http/roundtrip_js.go:120 +0x25
syscall/js.callbackLoop()
/Users/mrossi/sdk/go1.11rc2/src/syscall/js/callback.go:116 +0x7

A minimal program that reproduces the issue is attached (program.txt).

program.txt

[johanbrandhorst]

@markkurossi brought this up in the #webassembly channel on Gophers slack, so I've had a chance to isolate the problem and test a fix. I will put up a CL soon with the fix.

I don't think this is a release blocker, because the circumstances are very narrow, but the fix is very small.

CC @neelance @bradfitz

[johanbrandhorst]

This only happens if the following is true:

1. The browser in question supports streaming response bodies.
2. The user has requested the fetch be performed with mode: no-cors
3. The website in question blocks CORS requests.

[gopherbot]

Change https://golang.org/cl/131236 mentions this issue: net/http: ensure null body in Fetch response is not read

[FiloSottile]

@gopherbot please file this to be considered for backport to 1.11.

@johanbrandhorst please make a cherry-pick CL once your change is merged in master.

[gopherbot]

Backport issue(s) opened: #27424 (for 1.11).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.