Changeset 214800 in webkit


Ignore:
Timestamp:
Apr 3, 2017 9:22:16 AM (7 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r214375 - A null compound index value crashes the Databases process.
<rdar://problem/30499831> and ​https://bugs.webkit.org/show_bug.cgi?id=170000

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/indexeddb/modern/single-entry-index-invalid-key-crash.html

  • bindings/js/IDBBindingUtilities.cpp:

(WebCore::createKeyPathArray): Fix the bug by rejecting arrays with any invalid keys in them.

Add some logging:

  • Modules/indexeddb/IDBKeyPath.cpp:

(WebCore::loggingString):

  • Modules/indexeddb/IDBKeyPath.h:
  • Modules/indexeddb/IDBObjectStore.cpp:

(WebCore::IDBObjectStore::createIndex):

  • Modules/indexeddb/shared/IDBIndexInfo.cpp:

(WebCore::IDBIndexInfo::loggingString):

LayoutTests:

  • storage/indexeddb/modern/resources/single-entry-index-invalid-key-crash.js: Added.
  • storage/indexeddb/modern/single-entry-index-invalid-key-crash-expected.txt: Added.
  • storage/indexeddb/modern/single-entry-index-invalid-key-crash-private-expected.txt: Added.
  • storage/indexeddb/modern/single-entry-index-invalid-key-crash-private.html: Added.
  • storage/indexeddb/modern/single-entry-index-invalid-key-crash.html: Added.
Location:
releases/WebKitGTK/webkit-2.16
Files:
5 added
7 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog

    r214798 r214800  
     12017-03-24  Brady Eidson  <beidson@apple.com>
     2
     3        A null compound index value crashes the Databases process.
     4        <rdar://problem/30499831> and https://bugs.webkit.org/show_bug.cgi?id=170000
     5
     6        Reviewed by Alex Christensen.
     7
     8        * storage/indexeddb/modern/resources/single-entry-index-invalid-key-crash.js: Added.
     9        * storage/indexeddb/modern/single-entry-index-invalid-key-crash-expected.txt: Added.
     10        * storage/indexeddb/modern/single-entry-index-invalid-key-crash-private-expected.txt: Added.
     11        * storage/indexeddb/modern/single-entry-index-invalid-key-crash-private.html: Added.
     12        * storage/indexeddb/modern/single-entry-index-invalid-key-crash.html: Added.
     13
    1142017-03-24  Daniel Bates  <dabates@apple.com>
    215

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog

    r214798 r214800  
     12017-03-24  Brady Eidson  <beidson@apple.com>
     2
     3        A null compound index value crashes the Databases process.
     4        <rdar://problem/30499831> and https://bugs.webkit.org/show_bug.cgi?id=170000
     5
     6        Reviewed by Alex Christensen.
     7
     8        Test: storage/indexeddb/modern/single-entry-index-invalid-key-crash.html
     9
     10        * bindings/js/IDBBindingUtilities.cpp:
     11        (WebCore::createKeyPathArray): Fix the bug by rejecting arrays with any invalid keys in them.
     12       
     13        Add some logging:
     14        * Modules/indexeddb/IDBKeyPath.cpp:
     15        (WebCore::loggingString):
     16        * Modules/indexeddb/IDBKeyPath.h:
     17        * Modules/indexeddb/IDBObjectStore.cpp:
     18        (WebCore::IDBObjectStore::createIndex):
     19        * Modules/indexeddb/shared/IDBIndexInfo.cpp:
     20        (WebCore::IDBIndexInfo::loggingString):
     21
    1222017-03-24  Daniel Bates  <dabates@apple.com>
    223

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp

    r207931 r214800  
    11/*
    22 * Copyright (C) 2010 Google Inc. All rights reserved.
     3 * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    3132#include <wtf/ASCIICType.h>
    3233#include <wtf/dtoa.h>
     34#include <wtf/text/StringBuilder.h>
    3335
    3436namespace WebCore {
    … …  
    222224}
    223225
     226#ifndef NDEBUG
     227String loggingString(const IDBKeyPath& path)
     228{
     229    auto visitor = WTF::makeVisitor([](const String& string) {
     230        return makeString("< ", string, " >");
     231    }, [](const Vector<String>& strings) {
     232        if (strings.isEmpty())
     233            return String("< >");
     234
     235        StringBuilder builder;
     236        builder.append("< ");
     237        for (size_t i = 0; i < strings.size() - 1; ++i) {
     238            builder.append(strings[i]);
     239            builder.append(", ");
     240        }
     241        builder.append(strings.last());
     242        builder.append(" >");
     243
     244        return builder.toString();
     245    });
     246
     247    return WTF::visit(visitor, path);
     248}
     249#endif
     250
    224251} // namespace WebCore
    225252

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/IDBKeyPath.h

    r208985 r214800  
    11/*
    22 * Copyright (C) 2010 Google Inc. All rights reserved.
     3 * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    5354}
    5455
     56#ifndef NDEBUG
     57String loggingString(const IDBKeyPath&);
     58#endif
     59
    5560} // namespace WebCore
    5661

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp

    r210148 r214800  
    425425ExceptionOr<Ref<IDBIndex>> IDBObjectStore::createIndex(ExecState&, const String& name, IDBKeyPath&& keyPath, const IndexParameters& parameters)
    426426{
    427     LOG(IndexedDB, "IDBObjectStore::createIndex %s", name.utf8().data());
     427    LOG(IndexedDB, "IDBObjectStore::createIndex %s (keyPath: %s, unique: %i, multiEntry: %i)", name.utf8().data(), loggingString(keyPath).utf8().data(), parameters.unique, parameters.multiEntry);
    428428    ASSERT(currentThread() == m_transaction.database().originThreadID());
    429429

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/shared/IDBIndexInfo.cpp

    r209873 r214800  
    5757        indentString.append(" ");
    5858
    59     return makeString(indentString, "Index: ", m_name, String::format(" (%" PRIu64 ") \n", m_identifier));
     59    return makeString(indentString, "Index: ", m_name, String::format(" (%" PRIu64 ") keyPath: %s\n", m_identifier, WebCore::loggingString(m_keyPath).utf8().data()));
    6060}
    6161

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/bindings/js/IDBBindingUtilities.cpp

    r212207 r214800  
    394394        for (auto& entry : vector) {
    395395            auto key = internalCreateIDBKeyFromScriptValueAndKeyPath(exec, value, entry);
    396             if (!key)
     396            if (!key || !key->isValid())
    397397                return { };
    398398            keys.append(key.get());
Note: See TracChangeset for help on using the changeset viewer.