Bug 96566 – IndexedDB: Hidden indexing events are visible to script via bubbling/capture

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Joshua Bell]

Created attachment 163712 [details]
Repro case for bug

Population of indexes is done using iteration of a hidden IDBCursor. The cursor iteration fires events at a hidden IDBRequest that is not visible to script. The success and error events fired at request end up being erroneously visible via capture/bubbling.

This was found via W3C test submission: http://w3c-test.org/webapps/IndexedDB/tests/submissions/Microsoft/idbobjectstore_createIndex2.htm

Short version:

db.onerror = function() { alert("UNEXPECTED"); };
var store = db.createObjectStore('store');
store.put({prop: 1}, 1);
store.put({prop: 1}, 2);
store.createIndex("index", "prop", {unique: true});

This results in an error when the indexing terminates due to an abort. (Aborting causes an error to be fired at all unfinished requests.). However, the issue affects success events as well (as seen in the attached hidden-events.html)

[Joshua Bell]

Created attachment 169290 [details]
Patch

[Joshua Bell]

The patch is a partial fix:

It stops propagation of the events in the default/"bubbling" phase, but scripts could still see the events in the "capture" phase. A more intrusive fix would be necessary for the latter, setting a different propagation path in the guts of IDBRequest.

With this patch we pass:

http://w3c-test.org/webapps/IndexedDB/tests/submissions/Microsoft/idbobjectstore_createIndex2.htm
http://w3c-test.org/webapps/IndexedDB/tests/submissions/Opera/idbobjectstore_createIndex6-event_order.htm (mostly; the final event is incorrect in the test)
http://w3c-test.org/webapps/IndexedDB/tests/submissions/Opera/idbtransaction_abort.htm

[Joshua Bell]

Created attachment 169696 [details]
Patch

[Joshua Bell]

Latest patch handles both capturing and bubbling phases and tests both as well. I hate having to add more crap into IDBRequest but this seems like the best approach.

alecflett@ - can you take a look?

[Alec Flett]

Comment on attachment 169696 [details]
Patch

lgtm, thanks for fixing this

[WebKit Review Bot]

Comment on attachment 169696 [details]
Patch

Clearing flags on attachment: 169696

Committed r131967: <http://trac.webkit.org/changeset/131967>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.