[Webkit-unassigned] [Bug 94618] New: IndexedDB: IDBRequest can be destructed during abort

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=94618

           Summary: IndexedDB: IDBRequest can be destructed during abort
           Product: WebKit
           Version: 523.x (Safari 3)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jsbell at chromium.org
                CC: dgrogan at chromium.org, alecflett at chromium.org


If all script references to an IDBRequest have been dropped, it's possible the only thing keeping a request alive is an en-queued event. If that's the case, then if the request is abort()ed the destructor can run in the middle of the abort() method, and asserts.

Abbreviated stack trace:

ASSERTION FAILED: m_readyState == DONE || m_readyState == EarlyDeath || !scriptExecutionContext()
../../third_party/WebKit/Source/WebCore/Modules/indexeddb/IDBRequest.cpp(83) : virtual WebCore::IDBRequest::~IDBRequest()
1   WebCore::IDBRequest::~IDBRequest()
...
7   WebCore::EventTarget::deref()
...
13  WebCore::Event::~Event()
...
22  WTF::Vector<WTF::RefPtr<WebCore::Event>, 0ul>::clear()
23  WebCore::IDBRequest::abort()
24  WebCore::IDBTransaction::abort(int&)
25  WebCore::IDBTransaction::stop()
26  non-virtual thunk to WebCore::IDBTransaction::stop()
27  WebCore::ScriptExecutionContext::stopActiveDOMObjects()
28  WebCore::Document::detach()
29  WebCore::Document::prepareForDestruction()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.