Source/WebCore/ChangeLog

 12021-06-10 Venky Dass <yaranamavenkataramana@apple.com>
 2
 3 Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null.
 4 https://bugs.webkit.org/show_bug.cgi?id=226885
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Added a test to create null openDBRequest so that it can crash.
 9
 10 Test: storage/indexeddb/request_with_null_open_db_request.html
 11
 12 * Modules/indexeddb/IDBTransaction.cpp:
 13 (WebCore::IDBTransaction::dispatchEvent):
 14
1152021-06-07 Alex Christensen <achristensen@webkit.org>
216
317 Adopt SecTrustGetCertificateAtIndex replacement where available

Source/WebCore/Modules/indexeddb/IDBTransaction.cpp

@@void IDBTransaction::abortOnServerAndCancelRequests(IDBClient::TransactionOperat
313313
314314 m_abortQueue.clear();
315315 m_openRequests.clear();
 316 m_queuedEvents.clear();
316317 // Since we're aborting, it should be impossible to have queued any further operations.
317318 ASSERT(m_pendingTransactionOperationQueue.isEmpty());
318319}

@@void IDBTransaction::enqueueEvent(Ref<Event>&& event)
584585 if (!scriptExecutionContext() || isContextStopped())
585586 return;
586587
 588 m_queuedEvents.append(event.copyRef());
587589 queueTaskToDispatchEvent(*this, TaskSource::DatabaseAccess, WTFMove(event));
588590}
589591

@@void IDBTransaction::dispatchEvent(Event& event)
594596 ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread()));
595597 ASSERT(scriptExecutionContext());
596598 ASSERT(!isContextStopped());
597  ASSERT(event.type() == eventNames().completeEvent || event.type() == eventNames().abortEvent);
 599
598600
599601 auto protectedThis = makeRef(*this);
600602
601603 EventDispatcher::dispatchEvent({ this, m_database.ptr() }, event);
602  m_didDispatchAbortOrCommit = true;
 604
603605
604  if (isVersionChange()) {
605  ASSERT(m_openDBRequest);
 606 if (isVersionChange() && (event.type() == eventNames().completeEvent || event.type() == eventNames().abortEvent) && (&event == m_queuedEvents.takeFirst())) {
 607 m_didDispatchAbortOrCommit = true;
606608 m_openDBRequest->versionChangeTransactionDidFinish();
607609
608610 if (event.type() == eventNames().completeEvent) {

@@void IDBTransaction::dispatchEvent(Event& event)
614616
615617 m_openDBRequest = nullptr;
616618 }
 619
617620}
618621
619622Ref<IDBObjectStore> IDBTransaction::createObjectStore(const IDBObjectStoreInfo& info)

Source/WebCore/Modules/indexeddb/IDBTransaction.h

@@private:
250250 Deque<RefPtr<IDBClient::TransactionOperation>> m_pendingTransactionOperationQueue;
251251 Deque<IDBClient::TransactionOperation*> m_transactionOperationsInProgressQueue;
252252 Deque<RefPtr<IDBClient::TransactionOperation>> m_abortQueue;
 253 Deque<RefPtr<Event>> m_queuedEvents;
253254 HashMap<RefPtr<IDBClient::TransactionOperation>, IDBResultData> m_transactionOperationResultMap;
254255
255256 HashMap<IDBResourceIdentifier, RefPtr<IDBClient::TransactionOperation>> m_transactionOperationMap;

LayoutTests/ChangeLog

 12021-06-10 Venky Dass <yaranamavenkataramana@apple.com>
 2
 3 Crash in IDBTransaction::dispatchEvent when m_openDBRequest is null.
 4 https://bugs.webkit.org/show_bug.cgi?id=226885
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 * storage/indexeddb/request_with_null_open_db_request-expected.txt: Added.
 9 * storage/indexeddb/request_with_null_open_db_request.html: Added.
 10
1112021-06-07 Alexey Shvayka <shvaikalesh@gmail.com>
212
313 Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy

LayoutTests/storage/indexeddb/request_with_null_open_db_request-expected.txt

 1WebKit should not crash.

LayoutTests/storage/indexeddb/request_with_null_open_db_request.html

 1<html>
 2<head>
 3<script>
 4 globalThis.testRunner?.waitUntilDone();
 5 let request = indexedDB.open(Math.random());
 6 request.onupgradeneeded = () => {
 7 let db = request.result;
 8 let idbObjectStore = db.createObjectStore('b');
 9 let transaction = idbObjectStore.transaction;
 10 transaction.dispatchEvent(new Event(''));
 11 globalThis.testRunner?.notifyDone();
 12 };
 13</script>
 14</head>
 15WebKit should not crash.
 16</html>