Changeset 194625 in webkit


Ignore:
Timestamp:
Jan 5, 2016 6:08:23 PM (8 years ago)
Author:
beidson@apple.com
Message:

Modern IDB: storage/indexeddb/structured-clone.html crashes.
​https://bugs.webkit.org/show_bug.cgi?id=152763

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (At least one failing test now passes).

A lot of SerializedScriptValue code incorrectly assumed the global object is a JSDOMGlobalObject,
which doesn't have to be true for native Javascript types like typed arrays.

Fixing that fixes the test.

  • Modules/indexeddb/client/IDBObjectStoreImpl.cpp:

(WebCore::IDBClient::IDBObjectStore::putOrAdd): If serializing the script value caused an exception,

clear that exception and return a better IDB specific exception.

  • bindings/js/JSDOMBinding.h:

(WebCore::toJS): Add a ArrayBufferView specialization for toJS that skips the need for a JSDOMGlobalObject.

  • bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::readArrayBufferView): Call toJS directly instead of getJSValue, which

incorrectly assumes the existence of a JSDOMGlobalObject (vs a JSGlobalObject)

(WebCore::CloneDeserializer::readTerminal): Instead of getJSValue, call JSArrayBuffer::create directly.

LayoutTests:

  • platform/mac-wk1/TestExpectations:
  • storage/indexeddb/clone-exception-expected.txt:
  • storage/indexeddb/exceptions-expected.txt:
  • storage/indexeddb/objectstore-basics-expected.txt:
  • storage/indexeddb/structured-clone-expected.txt:
Location:
trunk
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r194617 r194625  
     12016-01-05  Brady Eidson  <beidson@apple.com>
     2
     3        Modern IDB: storage/indexeddb/structured-clone.html crashes.
     4        https://bugs.webkit.org/show_bug.cgi?id=152763
     5
     6        Reviewed by Alex Christensen.
     7
     8        * platform/mac-wk1/TestExpectations:
     9        * storage/indexeddb/clone-exception-expected.txt:
     10        * storage/indexeddb/exceptions-expected.txt:
     11        * storage/indexeddb/objectstore-basics-expected.txt:
     12        * storage/indexeddb/structured-clone-expected.txt:
     13
    1142016-01-05  Pranjal Jumde  <pjumde@apple.com>
    215

  • trunk/LayoutTests/platform/mac-wk1/TestExpectations

    r194605 r194625  
    7272storage/indexeddb/key-generator.html [ Skip ]
    7373storage/indexeddb/lazy-index-population.html [ Skip ]
    74 
    75 # IDB tests that crash/assert in CloneDeserializer
    76 storage/indexeddb/structured-clone.html [ Skip ]
    7774
    7875# IDB tests that crash with GuardMalloc or ASan

  • trunk/LayoutTests/storage/indexeddb/clone-exception-expected.txt

    r164000 r194625  
    1414PASS code is 25
    1515PASS ename is 'DataCloneError'
    16 Exception message: DataCloneError: DOM Exception 25
     16Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    1717
    1818doSecondOpen():
    … …  
    2424PASS code is 25
    2525PASS ename is 'DataCloneError'
    26 Exception message: DataCloneError: DOM Exception 25
     26Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    2727
    2828doThirdOpen():
    … …  
    3434PASS code is 25
    3535PASS ename is 'DataCloneError'
    36 Exception message: DataCloneError: DOM Exception 25
     36Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    3737PASS successfullyParsed is true
    3838

  • trunk/LayoutTests/storage/indexeddb/exceptions-expected.txt

    r193632 r194625  
    161161PASS Exception was thrown.
    162162PASS code is DOMException.DATA_CLONE_ERR
    163 Exception message: DataCloneError: DOM Exception 25
     163Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    164164
    165165IDBObjectStore.clear()
    … …  
    274274PASS Exception was thrown.
    275275PASS code is DOMException.DATA_CLONE_ERR
    276 Exception message: DataCloneError: DOM Exception 25
     276Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    277277db.close()
    278278ro_transaction.oncomplete = transactionComplete
    … …  
    506506PASS Exception was thrown.
    507507PASS code is DOMException.DATA_CLONE_ERR
    508 Exception message: DataCloneError: DOM Exception 25
     508Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    509509The transaction this IDBCursor belongs to is not active.
    510510Expecting exception from cursorFromInactiveTransaction.update({})

  • trunk/LayoutTests/storage/indexeddb/objectstore-basics-expected.txt

    r193892 r194625  
    9696PASS Exception was thrown.
    9797PASS code is DOMException.DATA_CLONE_ERR
    98 Exception message: DataCloneError: DOM Exception 25
     98Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    9999Try to insert data where key path yields a Date key:
    100100store.add({x: testDateB, y: 'value'}, 'key')

  • trunk/LayoutTests/storage/indexeddb/structured-clone-expected.txt

    r163963 r194625  
    784784PASS Exception was thrown.
    785785PASS code is DOMException.DATA_CLONE_ERR
    786 Exception message: Failed to execute 'put' on 'IDBObjectStore': An object could not be cloned.
     786Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    787787Expecting exception from store.put(new Function, 'key')
    788788PASS Exception was thrown.
    789789PASS code is DOMException.DATA_CLONE_ERR
    790 Exception message: Failed to execute 'put' on 'IDBObjectStore': An object could not be cloned.
     790Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    791791
    792792Other host object types:
    … …  
    794794PASS Exception was thrown.
    795795PASS code is DOMException.DATA_CLONE_ERR
    796 Exception message: Failed to execute 'put' on 'IDBObjectStore': An object could not be cloned.
     796Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    797797Expecting exception from store.put(document, 'key')
    798798PASS Exception was thrown.
    799799PASS code is DOMException.DATA_CLONE_ERR
    800 Exception message: Failed to execute 'put' on 'IDBObjectStore': An object could not be cloned.
     800Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    801801Expecting exception from store.put(document.body, 'key')
    802802PASS Exception was thrown.
    803803PASS code is DOMException.DATA_CLONE_ERR
    804 Exception message: Failed to execute 'put' on 'IDBObjectStore': An object could not be cloned.
     804Exception message: Failed to store record in an IDBObjectStore: An object could not be cloned.
    805805PASS successfullyParsed is true
    806806

  • trunk/Source/WebCore/ChangeLog

    r194617 r194625  
     12016-01-05  Brady Eidson  <beidson@apple.com>
     2
     3        Modern IDB: storage/indexeddb/structured-clone.html crashes.
     4        https://bugs.webkit.org/show_bug.cgi?id=152763
     5
     6        Reviewed by Alex Christensen.
     7
     8        No new tests (At least one failing test now passes).
     9       
     10        A lot of SerializedScriptValue code incorrectly assumed the global object is a JSDOMGlobalObject,
     11        which doesn't have to be true for native Javascript types like typed arrays.
     12       
     13        Fixing that fixes the test.
     14
     15        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
     16        (WebCore::IDBClient::IDBObjectStore::putOrAdd): If serializing the script value caused an exception,
     17          clear that exception and return a better IDB specific exception.
     18
     19        * bindings/js/JSDOMBinding.h:
     20        (WebCore::toJS): Add a ArrayBufferView specialization for toJS that skips the need for a JSDOMGlobalObject.
     21       
     22        * bindings/js/SerializedScriptValue.cpp:
     23        (WebCore::CloneDeserializer::readArrayBufferView): Call toJS directly instead of getJSValue, which
     24          incorrectly assumes the existence of a JSDOMGlobalObject (vs a JSGlobalObject)
     25        (WebCore::CloneDeserializer::readTerminal): Instead of getJSValue, call JSArrayBuffer::create directly.
     26
    1272016-01-05  Pranjal Jumde  <pjumde@apple.com>
    228

  • trunk/Source/WebCore/Modules/indexeddb/client/IDBObjectStoreImpl.cpp

    r194595 r194625  
    266266    RefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(&state, value, nullptr, nullptr);
    267267    if (state.hadException()) {
     268        // Clear the DOM exception from the serializer so we can give a more targeted exception.
     269        state.clearException();
     270
    268271        ec.code = IDBDatabaseException::DataCloneError;
    269272        ec.message = ASCIILiteral("Failed to store record in an IDBObjectStore: An object could not be cloned.");

  • trunk/Source/WebCore/bindings/js/JSDOMBinding.h

    r194369 r194625  
    412412}
    413413
     414inline JSC::JSValue toJS(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject, JSC::ArrayBufferView* view)
     415{
     416    if (!view)
     417        return JSC::jsNull();
     418    return view->wrap(exec, globalObject);
     419}
     420
    414421template<typename T> inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, RefPtr<T> ptr)
    415422{

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r194496 r194625  
    18161816            return true;
    18171817        case Int8ArrayTag:
    1818             arrayBufferView = getJSValue(Int8Array::create(arrayBuffer, byteOffset, length).get());
     1818            arrayBufferView = toJS(m_exec, m_globalObject, Int8Array::create(arrayBuffer, byteOffset, length).get());
    18191819            return true;
    18201820        case Uint8ArrayTag:
    1821             arrayBufferView = getJSValue(Uint8Array::create(arrayBuffer, byteOffset, length).get());
     1821            arrayBufferView = toJS(m_exec, m_globalObject, Uint8Array::create(arrayBuffer, byteOffset, length).get());
    18221822            return true;
    18231823        case Uint8ClampedArrayTag:
    1824             arrayBufferView = getJSValue(Uint8ClampedArray::create(arrayBuffer, byteOffset, length).get());
     1824            arrayBufferView = toJS(m_exec, m_globalObject, Uint8ClampedArray::create(arrayBuffer, byteOffset, length).get());
    18251825            return true;
    18261826        case Int16ArrayTag:
    1827             arrayBufferView = getJSValue(Int16Array::create(arrayBuffer, byteOffset, length).get());
     1827            arrayBufferView = toJS(m_exec, m_globalObject, Int16Array::create(arrayBuffer, byteOffset, length).get());
    18281828            return true;
    18291829        case Uint16ArrayTag:
    1830             arrayBufferView = getJSValue(Uint16Array::create(arrayBuffer, byteOffset, length).get());
     1830            arrayBufferView = toJS(m_exec, m_globalObject, Uint16Array::create(arrayBuffer, byteOffset, length).get());
    18311831            return true;
    18321832        case Int32ArrayTag:
    1833             arrayBufferView = getJSValue(Int32Array::create(arrayBuffer, byteOffset, length).get());
     1833            arrayBufferView = toJS(m_exec, m_globalObject, Int32Array::create(arrayBuffer, byteOffset, length).get());
    18341834            return true;
    18351835        case Uint32ArrayTag:
    1836             arrayBufferView = getJSValue(Uint32Array::create(arrayBuffer, byteOffset, length).get());
     1836            arrayBufferView = toJS(m_exec, m_globalObject, Uint32Array::create(arrayBuffer, byteOffset, length).get());
    18371837            return true;
    18381838        case Float32ArrayTag:
    1839             arrayBufferView = getJSValue(Float32Array::create(arrayBuffer, byteOffset, length).get());
     1839            arrayBufferView = toJS(m_exec, m_globalObject, Float32Array::create(arrayBuffer, byteOffset, length).get());
    18401840            return true;
    18411841        case Float64ArrayTag:
    1842             arrayBufferView = getJSValue(Float64Array::create(arrayBuffer, byteOffset, length).get());
     1842            arrayBufferView = toJS(m_exec, m_globalObject, Float64Array::create(arrayBuffer, byteOffset, length).get());
    18431843            return true;
    18441844        default:
    … …  
    23312331                return JSValue();
    23322332            }
    2333             JSValue result = getJSValue(arrayBuffer.get());
     2333            JSValue result = JSArrayBuffer::create(m_exec->vm(), m_globalObject->arrayBufferStructure(), arrayBuffer.release());
    23342334            m_gcBuffer.append(result);
    23352335            return result;
Note: See TracChangeset for help on using the changeset viewer.