<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[183896] trunk/Source/WebKit2</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/183896">183896</a></dd>
<dt>Author</dt> <dd>beidson@apple.com</dd>
<dt>Date</dt> <dd>2015-05-06 16:05:38 -0700 (Wed, 06 May 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Crash executing null AsyncRequest in IDB code.
<rdar://problem/18854856> and https://bugs.webkit.org/show_bug.cgi?id=144715
Reviewed by Darin Adler.
When UniqueIDBDatabase fails to execute an operation on the database work queue it usually
dispatches an AsyncRequest ID back to the main thread with an error callback.
For two of its operations it would then also dispatch the success callback.
In those cases the main thread would first take the AsyncRequest for the error callback out
of a map and then execute it.
It would then try to take the same AsyncRequest out of the map again, fail to do so, then
execute a null AsyncRequest.
This patch fixes the two functions to not dispatch both an error and success callback.
* DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp:
(WebKit::UniqueIDBDatabase::countInBackingStore): Return after dispatching the error callback.
(WebKit::UniqueIDBDatabase::deleteRangeInBackingStore): Ditto.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2DatabaseProcessIndexedDBUniqueIDBDatabasecpp">trunk/Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (183895 => 183896)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog 2015-05-06 22:55:09 UTC (rev 183895)
+++ trunk/Source/WebKit2/ChangeLog 2015-05-06 23:05:38 UTC (rev 183896)
</span><span class="lines">@@ -1,3 +1,27 @@
</span><ins>+2015-05-06 Brady Eidson <beidson@apple.com>
+
+ Crash executing null AsyncRequest in IDB code.
+ <rdar://problem/18854856> and https://bugs.webkit.org/show_bug.cgi?id=144715
+
+ Reviewed by Darin Adler.
+
+ When UniqueIDBDatabase fails to execute an operation on the database work queue it usually
+ dispatches an AsyncRequest ID back to the main thread with an error callback.
+
+ For two of its operations it would then also dispatch the success callback.
+
+ In those cases the main thread would first take the AsyncRequest for the error callback out
+ of a map and then execute it.
+
+ It would then try to take the same AsyncRequest out of the map again, fail to do so, then
+ execute a null AsyncRequest.
+
+ This patch fixes the two functions to not dispatch both an error and success callback.
+
+ * DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp:
+ (WebKit::UniqueIDBDatabase::countInBackingStore): Return after dispatching the error callback.
+ (WebKit::UniqueIDBDatabase::deleteRangeInBackingStore): Ditto.
+
</ins><span class="cx"> 2015-05-06 Dean Jackson <dino@apple.com>
</span><span class="cx">
</span><span class="cx"> Handle backdrop views that have to tile
</span></span></pre></div>
<a id="trunkSourceWebKit2DatabaseProcessIndexedDBUniqueIDBDatabasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp (183895 => 183896)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp 2015-05-06 22:55:09 UTC (rev 183895)
+++ trunk/Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp 2015-05-06 23:05:38 UTC (rev 183896)
</span><span class="lines">@@ -1042,6 +1042,8 @@
</span><span class="cx"> if (!m_backingStore->count(transactionIdentifier, objectStoreID, indexID, keyRangeData, count)) {
</span><span class="cx"> LOG_ERROR("Failed to get count from backing store.");
</span><span class="cx"> postMainThreadTask(createAsyncTask(*this, &UniqueIDBDatabase::didCountInBackingStore, requestID, 0, IDBDatabaseException::UnknownError, ASCIILiteral("Failed to get count from backing store")));
</span><ins>+
+ return;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> postMainThreadTask(createAsyncTask(*this, &UniqueIDBDatabase::didCountInBackingStore, requestID, count, 0, String(StringImpl::empty())));
</span><span class="lines">@@ -1060,6 +1062,8 @@
</span><span class="cx"> if (!m_backingStore->deleteRange(transactionIdentifier, objectStoreID, keyRangeData)) {
</span><span class="cx"> LOG_ERROR("Failed to delete range from backing store.");
</span><span class="cx"> postMainThreadTask(createAsyncTask(*this, &UniqueIDBDatabase::didDeleteRangeInBackingStore, requestID, IDBDatabaseException::UnknownError, ASCIILiteral("Failed to get count from backing store")));
</span><ins>+
+ return;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_backingStore->notifyCursorsOfChanges(transactionIdentifier, objectStoreID);
</span></span></pre>
</div>
</div>
</body>
</html>