Bug 106678 – IndexedDB: IDBTransaction should manage lifetime of IDBRequests

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Joshua Bell]

IndexedDB: IDBTransaction should manage lifetime of IDBRequests

[Joshua Bell]

Created attachment 182368 [details]
Patch

[Joshua Bell]

Speculative fix for possible source of crashes. 

In IDBObjectStore.cpp it is assumed that the request is kept alive by the owning transaction, but transactions didn't actually do that.

[Alec Flett]

Comment on attachment 182368 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=182368&action=review

> Source/WebCore/Modules/indexeddb/IDBRequest.cpp:82
> +    relaxAdoptionRequirement();

Is this because of the iterator, or removal from the m_requestList? Is there any way to call some of the helper methods like removeFirst or remove(iterator it) ?

[Joshua Bell]

(In reply to comment #3)
> (From update of attachment 182368 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=182368&action=review
> 
> > Source/WebCore/Modules/indexeddb/IDBRequest.cpp:82
> > +    relaxAdoptionRequirement();
> 
> Is this because of the iterator, or removal from the m_requestList? Is there any way to call some of the helper methods like removeFirst or remove(iterator it) ?

It on insertion into m_requestList c/o IDBTransaction::registerRequest(), which creates the first RefPtr<> to the request before the IDBRequest's constructor has completed.

[Alec Flett]

ah, I see it. LGTM (seems like the proper ownership anyway)

[Joshua Bell]

tony@ - can you take a look?

[Tony Chang]

Comment on attachment 182368 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=182368&action=review

>>> Source/WebCore/Modules/indexeddb/IDBRequest.cpp:82
>>> +    relaxAdoptionRequirement();
>> 
>> Is this because of the iterator, or removal from the m_requestList? Is there any way to call some of the helper methods like removeFirst or remove(iterator it) ?
> 
> It on insertion into m_requestList c/o IDBTransaction::registerRequest(), which creates the first RefPtr<> to the request before the IDBRequest's constructor has completed.

Rather than using relaxAdoptionRequirement, could we move the call to transaction->registerRequest() into the IDBRequest::create methods?

I think in the long term, we want to remove relaxAdoptionRequirement() from RefCounted.h and it looks like IDB is the only place that uses relaxAdoptionRequirement().

[Joshua Bell]

Created attachment 182423 [details]
Patch

[Joshua Bell]

(In reply to comment #7)
> Rather than using relaxAdoptionRequirement, could we move the call to transaction->registerRequest() into the IDBRequest::create methods?

Good suggestion - patch updated. (as you noticed...)
 
> I think in the long term, we want to remove relaxAdoptionRequirement() from RefCounted.h and it looks like IDB is the only place that uses relaxAdoptionRequirement().

Once alecflett@'s current refactor is done we can tackle removing the other uses.

[WebKit Review Bot]

Comment on attachment 182423 [details]
Patch

Clearing flags on attachment: 182423

Committed r139518: <http://trac.webkit.org/changeset/139518>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.