Changeset 247337 in webkit

Timestamp:

Jul 10, 2019 5:43:07 PM (5 years ago)

Author:

sihui_liu@apple.com

Message:

Crash at WebCore::IDBServer::MemoryObjectStoreCursor::incrementReverseIterator
​https://bugs.webkit.org/show_bug.cgi?id=199677
<rdar://problem/52334665>

Reviewed by Alex Christensen.

Add an early return in incrementReverseIterator when setFirstInRemainingRange fails to set m_iterator. This is
in line with what we did in incrementForwardIterator.

• Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:

(WebCore::IDBServer::MemoryObjectStoreCursor::incrementReverseIterator):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/indexeddb/server/MemoryObjectStoreCursor.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-07-10  Sihui Liu  <sihui_liu@apple.com>
+
+        Crash at WebCore::IDBServer::MemoryObjectStoreCursor::incrementReverseIterator
+        https://bugs.webkit.org/show_bug.cgi?id=199677
+        <rdar://problem/52334665>
+
+        Reviewed by Alex Christensen.
+
+        Add an early return in incrementReverseIterator when setFirstInRemainingRange fails to set m_iterator. This is 
+        in line with what we did in incrementForwardIterator.
+
+        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
+        (WebCore::IDBServer::MemoryObjectStoreCursor::incrementReverseIterator):
+
 2019-07-10  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/Modules/indexeddb/server/MemoryObjectStoreCursor.cpp

@@ -271 +271 @@
     }
 
-    if (*m_iterator == set.end())
+    if (!m_iterator || *m_iterator == set.end())
         return;