Attachment 432173 Details for Bug 226885 – Patch

[patch] Patch

bug-226885-20210624092613.patch (text/plain), 5.13 KB, created by Venky Dass on 2021-06-24 09:26:13 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Venky Dass

Created: 2021-06-24 09:26:13 PDT

Size: 5.13 KB

patch

obsolete

>Subversion Revision: 278591
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 723064b345a6a1b4bc9b910492ed330f0531a305..c02cc3f54e575c3ef2913f728f9ff9d387ae39ea 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2021-06-10  Venky Dass  <yaranamavenkataramana@apple.com>
>+
>+        Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null. 
>+        https://bugs.webkit.org/show_bug.cgi?id=226885
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Added a test to create null openDBRequest so that it can crash.  
>+
>+        Test: storage/indexeddb/request_with_null_open_db_request.html
>+
>+        * Modules/indexeddb/IDBTransaction.cpp:
>+        (WebCore::IDBTransaction::dispatchEvent):
>+
> 2021-06-07  Alex Christensen  <achristensen@webkit.org>
> 
>         Adopt SecTrustGetCertificateAtIndex replacement where available
>diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
>index 026c61dc30ffd60abed82d94cbe71fbe091513cd..e6ca527d8deecabb4faf36496c9a4d0a8feeedae 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
>+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
>@@ -584,6 +584,7 @@ void IDBTransaction::enqueueEvent(Ref<Event>&& event)
>     if (!scriptExecutionContext() || isContextStopped())
>         return;
> 
>+    m_abortOrCommitEvent = event.ptr();
>     queueTaskToDispatchEvent(*this, TaskSource::DatabaseAccess, WTFMove(event));
> }
> 
>@@ -594,15 +595,19 @@ void IDBTransaction::dispatchEvent(Event& event)
>     ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread()));
>     ASSERT(scriptExecutionContext());
>     ASSERT(!isContextStopped());
>-    ASSERT(event.type() == eventNames().completeEvent || event.type() == eventNames().abortEvent);
>+    
> 
>     auto protectedThis = makeRef(*this);
> 
>     EventDispatcher::dispatchEvent({ this, m_database.ptr() }, event);
>+    
>+    if (m_abortOrCommitEvent != &event)
>+        return;
>+    
>+    ASSERT(event.type() == eventNames().completeEvent || event.type() == eventNames().abortEvent);
>     m_didDispatchAbortOrCommit = true;
> 
>     if (isVersionChange()) {
>-        ASSERT(m_openDBRequest);
>         m_openDBRequest->versionChangeTransactionDidFinish();
> 
>         if (event.type() == eventNames().completeEvent) {
>diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
>index 801142688f61999155cceabc335f21459ec39cf8..7fa3f7f0396be797a558c41ff70f66af56500d23 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.h
>+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
>@@ -250,6 +250,7 @@ private:
>     Deque<RefPtr<IDBClient::TransactionOperation>> m_pendingTransactionOperationQueue;
>     Deque<IDBClient::TransactionOperation*> m_transactionOperationsInProgressQueue;
>     Deque<RefPtr<IDBClient::TransactionOperation>> m_abortQueue;
>+    Event* m_abortOrCommitEvent;
>     HashMap<RefPtr<IDBClient::TransactionOperation>, IDBResultData> m_transactionOperationResultMap;
> 
>     HashMap<IDBResourceIdentifier, RefPtr<IDBClient::TransactionOperation>> m_transactionOperationMap;
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 3a6c197ac6c9eac735ad1f9d4437fa0f47b7122c..21ac3021108e6b5205215c050f6d23352ab7ce15 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2021-06-10  Venky Dass  <yaranamavenkataramana@apple.com>
>+
>+        Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null.
>+        https://bugs.webkit.org/show_bug.cgi?id=226885
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * storage/indexeddb/request_with_null_open_db_request-expected.txt: Added.
>+        * storage/indexeddb/request_with_null_open_db_request.html: Added.
>+
> 2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>
> 
>         Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy
>diff --git a/LayoutTests/storage/indexeddb/request_with_null_open_db_request-expected.txt b/LayoutTests/storage/indexeddb/request_with_null_open_db_request-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..2c328561d63cd04caa7e32802332975700b6356f
>--- /dev/null
>+++ b/LayoutTests/storage/indexeddb/request_with_null_open_db_request-expected.txt
>@@ -0,0 +1 @@
>+WebKit should not crash.
>diff --git a/LayoutTests/storage/indexeddb/request_with_null_open_db_request.html b/LayoutTests/storage/indexeddb/request_with_null_open_db_request.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..222b878f926c0556013623695d8e87733a3b89a5
>--- /dev/null
>+++ b/LayoutTests/storage/indexeddb/request_with_null_open_db_request.html
>@@ -0,0 +1,22 @@
>+<html>
>+<head>
>+<script>
>+  if (window.testRunner){
>+     testRunner.dumpAsText();
>+     testRunner.waitUntilDone();
>+  }
>+
>+  let request = indexedDB.open(Math.random());
>+  request.onupgradeneeded = () => {
>+    let db = request.result;
>+    let idbObjectStore = db.createObjectStore('b');
>+    let transaction = idbObjectStore.transaction;
>+    transaction.dispatchEvent(new Event(''));
>+    globalThis.testRunner?.notifyDone();
>+  };
>+</script>
>+</head>
>+<body>
>+WebKit should not crash.
>+<body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 226885: 431108 | 431518 | 431689 | 431713 | 431980 | 432173 | 432214