Changeset 240090 in webkit

Timestamp:

Jan 16, 2019, 3:52:36 PM (8 years ago)

Author:

sihui_liu@apple.com

Message:

IndexedDB: UniqueIDBDatabase should not be freed if the database task queue is not empty.
​https://bugs.webkit.org/show_bug.cgi?id=193093

Reviewed by Brady Eidson.

performUnconditionalDeleteBackingStore killed the database task queue immediately, but performPrefetchCursor
task may be scheduled behind performUnconditionalDeleteBackingStore on database thread.

• Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::shutdownForClose):
(WebCore::IDBServer::UniqueIDBDatabase::performPrefetchCursor):
(WebCore::IDBServer::UniqueIDBDatabase::isDoneWithHardClose):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/indexeddb/server/UniqueIDBDatabase.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-01-16  Sihui Liu  <sihui_liu@apple.com>
+
+        IndexedDB: UniqueIDBDatabase should not be freed if the database task queue is not empty.
+        https://bugs.webkit.org/show_bug.cgi?id=193093
+
+        Reviewed by Brady Eidson.
+
+        performUnconditionalDeleteBackingStore killed the database task queue immediately, but performPrefetchCursor
+        task may be scheduled behind performUnconditionalDeleteBackingStore on database thread.
+
+        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabase::shutdownForClose):
+        (WebCore::IDBServer::UniqueIDBDatabase::performPrefetchCursor):
+        (WebCore::IDBServer::UniqueIDBDatabase::isDoneWithHardClose):
+
 2019-01-16  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp

@@ -293 +293 @@
     m_backingStoreIsEphemeral = false;
 
-    ASSERT(m_databaseQueue.isEmpty());
+    if (!m_databaseQueue.isEmpty()) {
+        postDatabaseTask(createCrossThreadTask(*this, &UniqueIDBDatabase::shutdownForClose));
+        return;
+    }
     m_databaseQueue.kill();
 
@@ -1272 +1275 @@
     LOG(IndexedDB, "(db) UniqueIDBDatabase::performPrefetchCursor");
 
-    if (m_backingStore->prefetchCursor(transactionIdentifier, cursorIdentifier))
+    if (m_hardClosedForUserDelete || !m_backingStore->prefetchCursor(transactionIdentifier, cursorIdentifier))
+        m_cursorPrefetches.remove(cursorIdentifier);
+    else
         postDatabaseTask(createCrossThreadTask(*this, &UniqueIDBDatabase::performPrefetchCursor, transactionIdentifier, cursorIdentifier));
-    else
-        m_cursorPrefetches.remove(cursorIdentifier);
 }
 
@@ -1785 +1788 @@
 bool UniqueIDBDatabase::isDoneWithHardClose()
 {
-    return m_databaseQueue.isKilled() && m_clientClosePendingDatabaseConnections.isEmpty() && m_serverClosePendingDatabaseConnections.isEmpty();
+    return m_databaseReplyQueue.isKilled() && m_clientClosePendingDatabaseConnections.isEmpty() && m_serverClosePendingDatabaseConnections.isEmpty();
 }