Bug 264099 – IndexedDB 17.2 regression: Cannot inject key into script value

• Status: RESOLVED
• Resolution: CONFIGURATION CHANGED
• Component: Website Storage

- https://github.com/firebase/firebase-js-sdk/issues/7742
- https://bugs.webkit.org/show_bug.cgi?id=229178

[Radar WebKit Bug Importer]

<rdar://problem/117861969>

[Winston]

We're encountering a similar error in livesite telemetry for Adobe Express https://new.express.adobe.com with users running Safari 17.2 Beta. Clearing the browser cache seems to resolve most of the issues in terms of functionality, but prior to that the web application is mostly broken.

[Sihui Liu]

We are aware of this issue in iOS 17.2 beta and working on a fix. There is an issue in reading out IndexedDB items created on an old build, especially items created with key generator (https://w3c.github.io/IndexedDB/#key-generator-construct). 
A potential workaround would be clearing those items when encountering this error.

[Willem]

(In reply to Sihui Liu from comment #3)
> We are aware of this issue in iOS 17.2 beta and working on a fix. There is
> an issue in reading out IndexedDB items created on an old build, especially
> items created with key generator
> (https://w3c.github.io/IndexedDB/#key-generator-construct). 
> A potential workaround would be clearing those items when encountering this
> error.

The problem is still present on iOS 16.7.3

[Alexey Proskuryakov]

Thank you for letting us know!

I will mark this as Configuration Changed, as the issue has only ever affected Apple's release branch, not open source WebKit. It is fixed in the final version of Safari 17.2.

I'm bringing it up internally that the regression has shipped in iOS 16.7.3, we'll see what can be done. It you would like to weigh in and to explain the severity of this for your user base, please feel encouraged to report this to Apple via https://feedbackassistant.apple.com, and/or to contact WebKit evangelists.

I'm seeing this error a fair bit in 16.7.3. Quite frustrating. :(

[Alexey Proskuryakov]

Please post your Feedback Assistant report numbers, so that we can relate those.

Please do provide specific customer facing impact (e.g. which websites misbehave, and in what ways), not just the technical details of the problem.

We have thousands of users running various versions of iOS. This issue has been escalating the last couple of days, probably related to an increased rollout of new iOS 16.7.3/16.7.4 versions.

In our particular situation we have been able workaround this by explicitly catching exceptions with the string "Cannot inject key into script value", then force our app to drop its entire IndexedDB database, stash authentication credentials in localStorage and force reload of the app and recreate the database from server data.

This bug basically breaks IndexedDB tables where key generators are used when upgrading to iOS 16.7.3 or 16.7.4.

Dexie.js bug report for the same problem: https://github.com/dexie/Dexie.js/issues/1878

I understand that this is technically not a bug in the webkit project right now but this bug is severe and most people using Webkit are Apple iOS users. Hopefully this information is helpful to others finding this issue.

I wish that you can bring this up internally at Apple and backport the fix for this problem to iOS 16.7.5.

[Alexey Proskuryakov]

Yes, a fix for this is intended to be shipped in an upcoming iOS 16.7.x release (assuming that nothing unexpected comes up).

Thanks a lot for the update Alexey!