Skip to content

fix: dispatch error instead of load when XMLHttpRequest completes without a response - #58808

Open
LoraBaek wants to merge 1 commit into
react:mainfrom
LoraBaek:fix/xhr-complete-without-response
Open

LoraBaek wants to merge 1 commit into
react:mainfrom
LoraBaek:fix/xhr-complete-without-response

Conversation

@LoraBaek

@LoraBaek LoraBaek commented Oct 2, 2026

Copy link
Copy Markdown

Summary:

When the native networking layer emits didCompleteNetworkResponse with a falsy error but no didReceiveNetworkResponse was ever delivered for that request, XMLHttpRequest.__didCompleteResponse treats the request as successful and dispatches load while status is still 0.

whatwg-fetch (which backs the global fetch in React Native) then runs new Response(body, {status: 0}) inside a setTimeout in xhr.onload. The Response constructor throws RangeError: Failed to construct 'Response': The status provided (0) is outside the range [200, 599]. Because the throw happens outside the promise chain, the fetch() promise never settles, no catch can observe it, and in a release build the uncaught error terminates the app.

We hit this in production (Android 16, Hermes, RN 0.83.10) on a plain HTTPS GET. Sentry breadcrumbs show the XHR finishing with status_code: 0, immediately followed by the fatal RangeError (mechanism onerror, handled: no). The device reported itself online over Wi-Fi.

A completed request that never received a response is a failure, not a successful load. Browsers never fire load with status === 0. This change makes __didCompleteResponse treat !error && status === 0 as an error, so onerror fires and fetch() rejects with the usual TypeError: Network request failed, which callers already handle.

This also hardens the iOS path: RCTNetworking.mm sends RCTNullIfNil(error.localizedDescription), so an error without a description currently reaches JS as a "success" as well.

Status 0 is safe as the signal: HTTP has no status 0, Android NetworkingModule custom URI handlers report 200, and RCTNetworking.mm reports 200 for non-HTTP NSURLResponses.

Related: #38625 (same RangeError via file://, closed for missing repro). The file:// case was later special-cased in whatwg-fetch, but any other status-0 completion still crashes.

Changelog:

[GENERAL] [FIXED] - XMLHttpRequest dispatches error instead of load when a request completes without ever receiving a response (status 0), preventing an uncatchable RangeError in fetch()

Test Plan:

  • Added a unit test asserting that __didCompleteResponse(requestId, null) without a prior __didReceiveResponse dispatches error and loadend, not load.
  • Updated the existing "should call onload function when there is no error" test to deliver a 200 response before completion, which is the only way a real request reaches load.
  • Without the source change, the new test fails (load is dispatched with status === 0); with it, the suite passes.
  • yarn jest packages/react-native/Libraries/Network/__tests__/XMLHttpRequest-test.js
 PASS  packages/react-native/Libraries/Network/__tests__/XMLHttpRequest-test.js
  XMLHttpRequest
    ✓ should transition readyState correctly (10 ms)
    ✓ should expose responseType correctly (14 ms)
    ✓ should expose responseText correctly (2 ms)
    ✓ should call ontimeout function when the request times out (1 ms)
    ✓ should call onerror function when the request times out (1 ms)
    ✓ should call onload function when there is no error (1 ms)
    ✓ should call onerror function when the request completes without a response (1 ms)
    ✓ should call upload onprogress (1 ms)
    ✓ should combine response headers with CRLF
    ✓ should log to a custom performance logger if set (1 ms)
    ✓ should append values when setRequestHeader is called with the same header
    ✓ should append to a header previously set to an empty string (2 ms)
    ✓ should lowercase header names in setRequestHeader
    ✓ should throw when setRequestHeader is called before open (1 ms)
    ✓ should sort and lowercase response headers

Test Suites: 1 passed, 1 total
Tests:       15 passed, 15 total
Snapshots:   0 total
Time:        0.31 s, estimated 1 s
Ran all test suites matching /packages\/react-native\/Libraries\/Network\/__tests__\/XMLHttpRequest-test.js/i.
  • yarn flow: No errors. eslint --max-warnings 0 and prettier --check on both files pass.

@meta-cla

meta-cla Bot commented Oct 2, 2026

Copy link
Copy Markdown

Hi @LoraBaek!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

@meta-cla

meta-cla Bot commented Oct 2, 2026

Copy link
Copy Markdown

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Oct 2, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Oct 2, 2026
@meta-codesync

meta-codesync Bot commented Oct 2, 2026

Copy link
Copy Markdown

@fabriziocucci has imported this pull request. If you are a Meta employee, you can view this in D122990077.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant