Changeset 282491 in webkit

Timestamp:

Sep 16, 2021, 12:34:18 AM (5 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r281384 - IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
​https://bugs.webkit.org/show_bug.cgi?id=229375

Source/WebCore:

Reviewed by Brady Eidson.

Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
created internally.

• Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::dispatchEvent):

Source/WTF:

Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.

Reviewed by Brady Eidson.

• wtf/CrossThreadTask.h:

Location:

releases/WebKitGTK/webkit-2.32/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/CrossThreadTask.h (modified) (2 diffs)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/Modules/indexeddb/IDBRequest.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.32/Source/WTF/ChangeLog

@@ +1 @@
+2021-08-21  Sihui Liu  <sihui_liu@apple.com>
+
+        IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+        https://bugs.webkit.org/show_bug.cgi?id=229375
+
+        Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
+
+        Reviewed by Brady Eidson.
+
+        * wtf/CrossThreadTask.h:
+
 2021-04-12  Youenn Fablet  <youenn@apple.com>
 

releases/WebKitGTK/webkit-2.32/Source/WTF/wtf/CrossThreadTask.h

@@ -86 +86 @@
 }
 
-template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
+template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
 CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
 {
@@ -94 +94 @@
 }
 
-template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
+template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
 CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
 {

releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog

@@ +1 @@
+2021-08-21  Sihui Liu  <sihui_liu@apple.com>
+
+        IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+        https://bugs.webkit.org/show_bug.cgi?id=229375
+
+        Reviewed by Brady Eidson.
+
+        Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
+        created internally.
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+
 2021-03-30  Ryosuke Niwa  <rniwa@webkit.org>
 

releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/indexeddb/IDBRequest.cpp

@@ -312 +312 @@
         targets = { this, m_transaction.get(), &m_transaction->database() };
 
-    m_hasPendingActivity = false;
+    if (event.isTrusted())
+        m_hasPendingActivity = false;
 
     {