StandardDownloader.run's catch dereferences an entry that abort()/cleanup() already cleared #148

Severity: low

Where: chrome/player/network/StandardDownloader.mjs (run, the .catch((err) => {...}) after getRequest())

What happens

.catch((err) => {
  console.error('Failed to get request for entry:', err);
  this.entry.onFail(this.loader.stats, this.entry, null);
  this.cleanup();
});

abort()/cleanup() set this.entry = null while getRequest() (the preProcessor) is still pending.

Failure scenario

A DASH segment aborted by a seek while preProcessFragment is awaiting, and the preProcessor then rejects: TypeError in the catch, an unhandled rejection. Harmless otherwise, since cleanup already ran.

Suggested fix

Return early from the catch when the downloader no longer owns an entry (if (!this.entry) return;).

Confidence: high.

From a line-by-line code review of the tree at 41363fd (2026-10-02). Each claim above was checked against the source before filing; the reproduction steps and line references are as of that commit.

Generated by Claude Code