Changeset 249054 in webkit

Timestamp:

Aug 23, 2019, 10:53:16 AM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r248971. rdar://problem/54643440

Crash under StringImpl::endsWith() in SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
​https://bugs.webkit.org/show_bug.cgi?id=200990
<rdar://problem/54566439>

Reviewed by Alex Christensen.

Make sure we call isolatedCopy() on SQLiteIDBBackingStore::m_databaseRootDirectory before using
it from background threads.

• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp: (WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade): (WebCore::IDBServer::SQLiteIDBBackingStore::databasesSizeForOrigin const): (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
• Modules/indexeddb/server/SQLiteIDBBackingStore.h: (WebCore::IDBServer::SQLiteIDBBackingStore::databaseRootDirectory const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@248971 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-608-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp (modified) (3 diffs)
• Modules/indexeddb/server/SQLiteIDBBackingStore.h (modified) (1 diff)

branches/safari-608-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-23  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r248971. rdar://problem/54643440
+
+    Crash under StringImpl::endsWith() in SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
+    https://bugs.webkit.org/show_bug.cgi?id=200990
+    <rdar://problem/54566439>
+    
+    Reviewed by Alex Christensen.
+    
+    Make sure we call isolatedCopy() on SQLiteIDBBackingStore::m_databaseRootDirectory before using
+    it from background threads.
+    
+    * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
+    (WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade):
+    (WebCore::IDBServer::SQLiteIDBBackingStore::databasesSizeForOrigin const):
+    (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
+    * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
+    (WebCore::IDBServer::SQLiteIDBBackingStore::databaseRootDirectory const):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248971 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-08-21  Chris Dumez  <cdumez@apple.com>
+
+            Crash under StringImpl::endsWith() in SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
+            https://bugs.webkit.org/show_bug.cgi?id=200990
+            <rdar://problem/54566439>
+
+            Reviewed by Alex Christensen.
+
+            Make sure we call isolatedCopy() on SQLiteIDBBackingStore::m_databaseRootDirectory before using
+            it from background threads.
+
+            * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
+            (WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade):
+            (WebCore::IDBServer::SQLiteIDBBackingStore::databasesSizeForOrigin const):
+            (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
+            * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
+            (WebCore::IDBServer::SQLiteIDBBackingStore::databaseRootDirectory const):
+
 2019-08-23  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-608-branch/Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp

@@ -794 +794 @@
 String SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
 {
-    String oldOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v0");
+    auto databaseRootDirectory = this->databaseRootDirectory();
+    String oldOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v0");
     String oldDatabaseDirectory = FileSystem::pathByAppendingComponent(oldOriginDirectory, filenameForDatabaseName());
-    String newOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v1");
+    String newOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v1");
     String fileNameHash = SQLiteFileSystem::computeHashForFileName(m_identifier.databaseName());
     Vector<String> directoriesWithSameHash = FileSystem::listDirectory(newOriginDirectory, fileNameHash + "*");
@@ -893 +894 @@
 uint64_t SQLiteIDBBackingStore::databasesSizeForOrigin() const
 {
-    String oldVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v0");
-    String newVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v1");
+    auto databaseRootDirectory = this->databaseRootDirectory();
+    String oldVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v0");
+    String newVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v1");
     return databasesSizeForFolder(oldVersionOriginDirectory) + databasesSizeForFolder(newVersionOriginDirectory);
 }
@@ -2644 +2646 @@
     SQLiteFileSystem::deleteDatabaseFile(dbFilename);
     SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_databaseDirectory);
-    SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory));
+    SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory()));
 }
 

branches/safari-608-branch/Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.h

@@ -106 +106 @@
     String fullDatabasePath() const;
     String fullDatabaseDirectoryWithUpgrade();
+    
+    String databaseRootDirectory() const { return m_databaseRootDirectory.isolatedCopy(); }
 
     uint64_t quotaForOrigin() const;