Changeset 243622 in webkit

Timestamp:

Mar 28, 2019 2:26:38 PM (5 years ago)

Author:

jiewen_tan@apple.com

Message:

IDBRequest::dispatchEvent should check nullability of m_transaction before operations that rely on it to be non null
​https://bugs.webkit.org/show_bug.cgi?id=196319
<rdar://problem/49355279>

Reviewed by Alex Christensen.

The test that triggers this crash is on Bug 196276.

• Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::dispatchEvent):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/indexeddb/IDBRequest.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-27  Jiewen Tan  <jiewen_tan@apple.com>
+
+        IDBRequest::dispatchEvent should check nullability of m_transaction before operations that rely on it to be non null
+        https://bugs.webkit.org/show_bug.cgi?id=196319
+        <rdar://problem/49355279>
+
+        Reviewed by Alex Christensen.
+
+        The test that triggers this crash is on Bug 196276.
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+
 2019-03-28  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/Modules/indexeddb/IDBRequest.cpp

@@ -331 +331 @@
         m_hasPendingActivity = isOpenDBRequest() && (event.type() == eventNames().upgradeneededEvent || event.type() == eventNames().blockedEvent);
 
+    m_dispatchingEvent = false;
+    if (!m_transaction)
+        return;
+
     // The request should only remain in the transaction's request list if it represents a pending cursor operation, or this is an open request that was blocked.
-    if (m_transaction && !m_pendingCursor && event.type() != eventNames().blockedEvent)
+    if (!m_pendingCursor && event.type() != eventNames().blockedEvent)
         m_transaction->removeRequest(*this);
 
     if (m_hasUncaughtException)
         m_transaction->abortDueToFailedRequest(DOMException::create(AbortError, "IDBTransaction will abort due to uncaught exception in an event handler"_s));
-    else if (!event.defaultPrevented() && event.type() == eventNames().errorEvent && m_transaction && !m_transaction->isFinishedOrFinishing()) {
+    else if (!event.defaultPrevented() && event.type() == eventNames().errorEvent && !m_transaction->isFinishedOrFinishing()) {
         ASSERT(m_domError);
         m_transaction->abortDueToFailedRequest(*m_domError);
     }
 
-    if (m_transaction)
-        m_transaction->finishedDispatchEventForRequest(*this);
-
-    m_dispatchingEvent = false;
+    m_transaction->finishedDispatchEventForRequest(*this);
 }