Repository navigation
fix(engine): t8s4 CORS Range safelist + MSE 音频双面设计——bilibili DASH 段拉取修复 - #140
Merged
Merged
Conversation
bilibili 起播断链三角化终证（beacon 探针 + curl 双证）：_zwPreNamesOf 把 Range 头当自定义头 → 跨域 GET 误发 CORS OPTIONS preflight → bilivideo CDN 对 OPTIONS 拒答（带 Origin 的 GET 回条件 ACAO；无 Origin/OPTIONS 无）→ 预检失败 → 全 CDN 候选 TypeError: Failed to fetch → init 永不 append → watchdog detach/retry 死循环。fetch spec 2022+ 已将 Range 纳入 CORS-safelisted（单一 simple range），Chrome/FF 拉媒体段从不预检。 - part01.js _zwPreNamesOf：Range 值为单一 simple range（bytes=start-end / start- / -suffix）免 preflight；多段/畸形仍触发。红绿钉测三臂（simple 零 OPTIONS / 多段预检 / 普通自定义头守卫；红态变异=恢复旧行为后第一臂 精准变红，/tmp md5 恢复）。 - part06.js：isTypeSupported 音频真值收窄 mp4a.40.2+aac（symphonia-codec-aac 源码定谳只解 AAC-LC，sbr_present 显式拒——HE-AAC 40.5 宣称 true 为虚报， 真站实测命中）；addSourceBuffer 与解码面解耦为 ingest 面（40.x 家族受理 ——实测 bilibili 未登录默认音轨 30216=HE-AAC，解码面硬拒使 nano sourceopen handler 中断、双轨 append 全死；ingest 受理后双 SB 创建成功）。 桥存在门保留（t8n 契约零回归）。 - part09.rs：双面钉（isTypeSupported(40.5)=false 解码面诚实 + addSourceBuffer(40.5)=created:audio ingest 面受理）。 真站读数（decode-h264 构建，beacon 探针）：修复前段拉取全线 Failed to fetch；修复后 playurl fnval=4048 dash:1 → sourceopen 派发 → 双 SB 创建 （ASB_OK×2）→ 段拉取 FR 206。公开面两阶段推进（CORS 拉取面 + SB 创建面）； appendBuffer 管道仍有 nano 内部断链（另切片），起播未达成——诚实口径。 测试：engine 2987P（+2 钉；skip 1 基线既有栈溢出项）。门禁：fmt CLEAN、 clippy workspace+quickjs 双腿 -D warnings、make test exit 0。
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 08406b27-c6a2-488e-906f-f3d9fed28d71) |
两首轮均 PASS（①测试有效性 0 阻断 4 非阻断；②缺陷 0 阻断 5 非阻断）， 统一收口： - D1：Range safelist 正则收紧 /bytes=\d+-\d*/（精确对齐 fetch spec parse-a-single-range：无空白、start 必填、大小写敏感；suffix bytes=-500 spec 明言不 safelist）+ 分支注释 spec 转述修正 + 函数头「恒入列」矛盾 修正（D4）。 - D2：appendBuffer 轨路由注释对齐实际行为（无门面构建 SB 创建成功而 append 恒败，error 事件面——非不可达）。 - D3：ingest codecs 提取补单引号形态（codecs='…' 角语法对齐 base）。 - D5：part10 调试残留删除。 - 新增 suffix range 拒绝臂（bytes=-500 → OPTIONS 先行；收紧正则的红态 回归守卫——宽松正则变异下该臂精准变红）。 门禁：fmt CLEAN、clippy 双腿 -D warnings、engine 2996P（+suffix 臂）、 make test 复验待跑（本轮 make test 后改动面仅注释+正则+钉测）。
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 1cef9048-4068-4492-8679-7bd709927b5d) |
leizongmin
added a commit
that referenced
this pull request
Oct 12, 2026
…hub（imported-tests.txt 双保留） 同步 main（#140–#144：R5073–R5079 layout/css 修复、webmessaging M2/M3、CORS range safelist、shape_fallback 中文字体 fallback chain）。冲突仅 tests/wpt-runner/ imported-tests.txt：双方新增条目均保留（main 4 条 + 本分支 css-fonts/system-ui-bold-zw-001 1 条），无产品代码手工改动。 Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变化
bilibili 起播断链三角化终证（beacon 页面侧探针 + curl 双证）：shim
_zwPreNamesOf把Range头当自定义头（源码注释原文点名）→ 跨域 GET 误发 CORS OPTIONS preflight → bilivideo CDN 对 OPTIONS 拒答（curl 实证：带 Origin 的 GET 回条件 ACAO；无 Origin/OPTIONS 无 ACAO）→ 预检失败 → 全部 CDN 候选TypeError: Failed to fetch→ DASH init 永不 appendBuffer → watchdog detach/retry 死循环 → 起播失败。fetch spec 2022+ 已将Range纳入 CORS-safelisted request-header（单一 simple range），Chrome/FF 拉媒体段从不预检。_zwPreNamesOf：Range值为单一 simple range（bytes=start-end/start-/-suffix）→ 免 preflight；多段/畸形仍触发。这是通用 CORS 修复——任何按 Origin 条件回 ACAO 的媒体 CDN 的 Range 拉取面都受益。isTypeSupported音频真值收窄mp4a.40.2+aac（symphonia-codec-aac 0.6.1 源码定谳只解 AAC-LC——sbr_present显式拒；t8s-3 的mp4a.40.*前缀使 HE-AAC(40.5) 虚报 true，真站探针实测命中）；addSourceBuffer与解码面解耦为 ingest 面（40.x 家族受理）——实测 bilibili 未登录默认音轨 30216=HE-AAC，解码面硬拒使 nano sourceopen handler 中断、双轨 append 全死；ingest 受理后双 SourceBuffer 创建成功。桥存在门保留（t8n 契约零回归）。isTypeSupported(40.5)=false解码面诚实 +addSourceBuffer(40.5)=created:audioingest 受理）。验证
Failed to fetch；修复后 playurlfnval=4048+dash:1→ sourceopen 派发（listeners=2）→ 双 SB 创建（ASB_OK×2） → 段拉取 FR 206（init 双轨）→ docker 全程 true（watchdog 死循环消除）。test_fetch_range_safelisted_preflight_t8s4三臂（simple range 零 OPTIONS / 多段 range OPTIONS 先行 / 普通自定义头守卫）；红态变异=恢复旧行为后第一臂精准变红（left["OPTIONS","GET"]vs right["GET"]），/tmp md5 恢复。已知边界（诚实披露）
返修（双审查统一收口，93db1b295）
双首轮均 PASS（①测试有效性 0 阻断 4 非阻断——两处红绿变异闭环；②实现缺陷 0 阻断 5 非阻断——D1 regex fail-open 超集+注释失实等）。统一收口（非作者复核 APPROVE，suffix 臂红态判别实测）：
/bytes=\d+-\d*/（精确对齐 spec parse-a-single-range：无空白、start 必填、大小写敏感；suffixbytes=-500spec 明言不 safelist）+ 分支/函数头注释 spec 转述修正（D4）。bytes=-500→ OPTIONS 先行；宽松正则变异下精准变红的回归守卫）。返修后门禁：engine 2996P（+suffix 臂）/ fmt CLEAN / clippy 双腿 / make test exit 0（复核者独立复跑 20,524P 实证）。
审查状态（head 93db1b2）
截图
无适用画面（网络/CORS 层切片，无视觉差异；探针决策日志证据在审查档案）。
Note
Medium Risk
Touches cross-origin fetch preflight logic and MSE capability/ingest gates used for media playback; incorrect Range or codec rules could break CDN segment fetches or site codec probes.
Overview
Fixes bilibili-style DASH playback breakage by aligning fetch CORS and MSE audio behavior with spec and real decoder limits.
CORS / Range:
_zwPreNamesOfno longer always treatsRangeas a preflight trigger. A single simple range matchingbytes=\d+-\d*is CORS-safelisted (GET only); suffix, multi-range, and malformed values still force OPTIONS. New integration testtest_fetch_range_safelisted_preflight_t8s4locks simple vs multi-range vs custom-header behavior.MSE audio (dual face):
MediaSource.isTypeSupportednow reports false for HE-AAC (mp4a.40.5) and only claims AAC-LC (mp4a.40.2/aac) when the audio append bridge is present—matching symphonia’s LC-only decode.addSourceBufferis decoupled: it accepts the broadermp4a.40.x/aacfamily on the ingest path (like Chrome) so sourceopen handlers can create audio SBs; decode failures degrade to mute rather than blocking video. Tests inpart09.rsassertisTypeSupported(40.5)=falsewhileaddSourceBuffer(40.5)still creates an audio track.Reviewed by Cursor Bugbot for commit 93db1b2. Bugbot is set up for automated code reviews on this repo. Configure here.