Revoking a blob url twice causes an internal error and crashes node

[Jamesernator]

Version

v17.6.0

Platform

Linux the-mistery-machine 5.13.0-30-generic #33~20.04.1-Ubuntu SMP Mon Feb 7 14:25:10 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

The following code will cause Node to crash:

import { Blob } from "node:buffer";

const url = URL.createObjectURL(new Blob([]));

URL.revokeObjectURL(url);
URL.revokeObjectURL(url);

How often does it reproduce? Is there a required condition?

It happens consistently.

What is the expected behavior?

The second URL.revokeObjectURL should just be a no-op, this is consistent with web behaviour.

What do you see instead?

It produces the following crash:

node[1082797]: ../src/node_blob.cc:447:void node::BlobBindingData::revoke_data_object(const string&): Assertion `(data_objects_.find(uuid)) != (data_objects_.end())' failed.
 1: 0xb2e180 node::Abort() [node]
 2: 0xb2e1fe  [node]
 3: 0xb01e7a node::BlobBindingData::revoke_data_object(std::string const&) [node]
 4: 0xb02157 node::Blob::RevokeDataObject(v8::FunctionCallbackInfo<v8::Value> const&) [node]
 5: 0xd7c07e  [node]
 6: 0xd7d49f v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
 7: 0x1632979  [node]
zsh: abort (core dumped)  node --input-type=module < test.js

Additional information

No response

[Trott]

@nodejs/url @nodejs/buffer