Attachment #432214 for bug #226885

View Details Raw Unified Return to Bug 226885

| Differences between



2021-06-10  Venky Dass  <yaranamavenkataramana@apple.com>

        Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null. 
        https://bugs.webkit.org/show_bug.cgi?id=226885

        Reviewed by NOBODY (OOPS!).

        Added a test to create null openDBRequest so that it can crash.  

        Test: storage/indexeddb/request-with-null-open-db-request.html

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::dispatchEvent):

2021-06-07  Alex Christensen  <achristensen@webkit.org>

        Adopt SecTrustGetCertificateAtIndex replacement where available



    if (!scriptExecutionContext() || isContextStopped())
        return;

    m_abortOrCommitEvent = event.ptr();
    queueTaskToDispatchEvent(*this, TaskSource::DatabaseAccess, WTFMove(event));
}


    ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread()));
    ASSERT(scriptExecutionContext());
    ASSERT(!isContextStopped());
    

    auto protectedThis = makeRef(*this);

    EventDispatcher::dispatchEvent({ this, m_database.ptr() }, event);
    
    if (m_abortOrCommitEvent != &event)
        return;
    
    ASSERT(event.type() == eventNames().completeEvent || event.type() == eventNames().abortEvent);
    m_didDispatchAbortOrCommit = true;

    if (isVersionChange()) {
        ASSERT(m_openDBRequest);
        m_openDBRequest->versionChangeTransactionDidFinish();

        if (event.type() == eventNames().completeEvent) {

Lines 250-255 private: a/Source/WebCore/Modules/indexeddb/IDBTransaction.h_sec1
- a/Source/WebCore/Modules/indexeddb/IDBTransaction.h +1 lines
250	Deque<RefPtr<IDBClient::TransactionOperation>> m_pendingTransactionOperationQueue;	250	Deque<RefPtr<IDBClient::TransactionOperation>> m_pendingTransactionOperationQueue;
251	Deque<IDBClient::TransactionOperation*> m_transactionOperationsInProgressQueue;	251	Deque<IDBClient::TransactionOperation*> m_transactionOperationsInProgressQueue;
252	Deque<RefPtr<IDBClient::TransactionOperation>> m_abortQueue;	252	Deque<RefPtr<IDBClient::TransactionOperation>> m_abortQueue;
		253	Event* m_abortOrCommitEvent;
253	HashMap<RefPtr<IDBClient::TransactionOperation>, IDBResultData> m_transactionOperationResultMap;	254	HashMap<RefPtr<IDBClient::TransactionOperation>, IDBResultData> m_transactionOperationResultMap;
254		255
255	HashMap<IDBResourceIdentifier, RefPtr<IDBClient::TransactionOperation>> m_transactionOperationMap;	256	HashMap<IDBResourceIdentifier, RefPtr<IDBClient::TransactionOperation>> m_transactionOperationMap;



2021-06-10  Venky Dass  <yaranamavenkataramana@apple.com>

        Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null.
        https://bugs.webkit.org/show_bug.cgi?id=226885

        Reviewed by NOBODY (OOPS!).

        * storage/indexeddb/request-with-null-open-db-request-expected.txt: Added.
        * storage/indexeddb/request-with-null-open-db-request.html: Added.

2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy

Line 0 a/LayoutTests/storage/indexeddb/request-with-null-open-db-request-expected.txt_sec1
- a/LayoutTests/storage/indexeddb/request-with-null-open-db-request-expected.txt +1 lines
		1	WebKit should not crash.



<html>
<head>
<script>
  if (window.testRunner){
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
  }

  let request = indexedDB.open(Math.random());
  request.onupgradeneeded = () => {
    let db = request.result;
    let idbObjectStore = db.createObjectStore('b');
    let transaction = idbObjectStore.transaction;
    transaction.dispatchEvent(new Event(''));
    globalThis.testRunner?.notifyDone();
  };
</script>
</head>
<body>
WebKit should not crash.
<body>
</html>

Return to Bug 226885

Lines 584-589 void IDBTransaction::enqueueEvent(Ref<Event>&& event) a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp_sec1
- a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp -2 / +7 lines
584	if (!scriptExecutionContext() \|\| isContextStopped())	584	if (!scriptExecutionContext() \|\| isContextStopped())
585	return;	585	return;
586		586
		587	m_abortOrCommitEvent = event.ptr();
587	queueTaskToDispatchEvent(*this, TaskSource::DatabaseAccess, WTFMove(event));	588	queueTaskToDispatchEvent(*this, TaskSource::DatabaseAccess, WTFMove(event));
588	}	589	}
589		590
Lines 594-608 void IDBTransaction::dispatchEvent(Event& event) a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp_sec2
594	ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread()));	595	ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread()));
595	ASSERT(scriptExecutionContext());	596	ASSERT(scriptExecutionContext());
596	ASSERT(!isContextStopped());	597	ASSERT(!isContextStopped());
597	ASSERT(event.type() == eventNames().completeEvent \|\| event.type() == eventNames().abortEvent);	598
598		599
599	auto protectedThis = makeRef(*this);	600	auto protectedThis = makeRef(*this);
600		601
601	EventDispatcher::dispatchEvent({ this, m_database.ptr() }, event);	602	EventDispatcher::dispatchEvent({ this, m_database.ptr() }, event);
		603
		604	if (m_abortOrCommitEvent != &event)
		605	return;
		606
		607	ASSERT(event.type() == eventNames().completeEvent \|\| event.type() == eventNames().abortEvent);
602	m_didDispatchAbortOrCommit = true;	608	m_didDispatchAbortOrCommit = true;
603		609
604	if (isVersionChange()) {	610	if (isVersionChange()) {
605	ASSERT(m_openDBRequest);
606	m_openDBRequest->versionChangeTransactionDidFinish();	611	m_openDBRequest->versionChangeTransactionDidFinish();
607		612
608	if (event.type() == eventNames().completeEvent) {	613	if (event.type() == eventNames().completeEvent) {

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +14 lines
		1	2021-06-10 Venky Dass <yaranamavenkataramana@apple.com>
		2
		3	Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null.
		4	https://bugs.webkit.org/show_bug.cgi?id=226885
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Added a test to create null openDBRequest so that it can crash.
		9
		10	Test: storage/indexeddb/request-with-null-open-db-request.html
		11
		12	* Modules/indexeddb/IDBTransaction.cpp:
		13	(WebCore::IDBTransaction::dispatchEvent):
		14
1	2021-06-07 Alex Christensen <achristensen@webkit.org>	15	2021-06-07 Alex Christensen <achristensen@webkit.org>
2		16
3	Adopt SecTrustGetCertificateAtIndex replacement where available	17	Adopt SecTrustGetCertificateAtIndex replacement where available

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +10 lines
		1	2021-06-10 Venky Dass <yaranamavenkataramana@apple.com>
		2
		3	Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null.
		4	https://bugs.webkit.org/show_bug.cgi?id=226885
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* storage/indexeddb/request-with-null-open-db-request-expected.txt: Added.
		9	* storage/indexeddb/request-with-null-open-db-request.html: Added.
		10
1	2021-06-07 Alexey Shvayka <shvaikalesh@gmail.com>	11	2021-06-07 Alexey Shvayka <shvaikalesh@gmail.com>
2		12
3	Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy	13	Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy

Line 0 a/LayoutTests/storage/indexeddb/request-with-null-open-db-request.html_sec1
- a/LayoutTests/storage/indexeddb/request-with-null-open-db-request.html +22 lines
	1	<html>
	2	<head>
	3	<script>
	4	if (window.testRunner){
	5	testRunner.dumpAsText();
	6	testRunner.waitUntilDone();
	7	}
	8
	9	let request = indexedDB.open(Math.random());
	10	request.onupgradeneeded = () => {
	11	let db = request.result;
	12	let idbObjectStore = db.createObjectStore('b');
	13	let transaction = idbObjectStore.transaction;
	14	transaction.dispatchEvent(new Event(''));
	15	globalThis.testRunner?.notifyDone();
	16	};
	17	</script>
	18	</head>
	19	<body>
	20	WebKit should not crash.
	21	<body>
	22	</html>