Changeset 248971 in webkit

Timestamp:

Aug 21, 2019 3:45:46 PM (5 years ago)

Author:

Chris Dumez

Message:

Crash under StringImpl::endsWith() in SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
​https://bugs.webkit.org/show_bug.cgi?id=200990
<rdar://problem/54566439>

Reviewed by Alex Christensen.

Make sure we call isolatedCopy() on SQLiteIDBBackingStore::m_databaseRootDirectory before using
it from background threads.

• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade):
(WebCore::IDBServer::SQLiteIDBBackingStore::databasesSizeForOrigin const):
(WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):

• Modules/indexeddb/server/SQLiteIDBBackingStore.h:

(WebCore::IDBServer::SQLiteIDBBackingStore::databaseRootDirectory const):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp (modified) (3 diffs)
• Modules/indexeddb/server/SQLiteIDBBackingStore.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-21  Chris Dumez  <cdumez@apple.com>
+
+        Crash under StringImpl::endsWith() in SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
+        https://bugs.webkit.org/show_bug.cgi?id=200990
+        <rdar://problem/54566439>
+
+        Reviewed by Alex Christensen.
+
+        Make sure we call isolatedCopy() on SQLiteIDBBackingStore::m_databaseRootDirectory before using
+        it from background threads.
+
+        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
+        (WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade):
+        (WebCore::IDBServer::SQLiteIDBBackingStore::databasesSizeForOrigin const):
+        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
+        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
+        (WebCore::IDBServer::SQLiteIDBBackingStore::databaseRootDirectory const):
+
 2019-08-21  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp

@@ -766 +766 @@
 String SQLiteIDBBackingStore::fullDatabaseDirectoryWithUpgrade()
 {
-    String oldOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v0");
+    auto databaseRootDirectory = this->databaseRootDirectory();
+    String oldOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v0");
     String oldDatabaseDirectory = FileSystem::pathByAppendingComponent(oldOriginDirectory, filenameForDatabaseName());
-    String newOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v1");
+    String newOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v1");
     String fileNameHash = SQLiteFileSystem::computeHashForFileName(m_identifier.databaseName());
     Vector<String> directoriesWithSameHash = FileSystem::listDirectory(newOriginDirectory, fileNameHash + "*");
@@ -857 +858 @@
 uint64_t SQLiteIDBBackingStore::databasesSizeForOrigin() const
 {
-    String oldVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v0");
-    String newVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory, "v1");
+    auto databaseRootDirectory = this->databaseRootDirectory();
+    String oldVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v0");
+    String newVersionOriginDirectory = m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory, "v1");
     return databasesSizeForFolder(oldVersionOriginDirectory) + databasesSizeForFolder(newVersionOriginDirectory);
 }
@@ -2561 +2563 @@
     SQLiteFileSystem::deleteDatabaseFile(dbFilename);
     SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_databaseDirectory);
-    SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_identifier.databaseDirectoryRelativeToRoot(m_databaseRootDirectory));
+    SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_identifier.databaseDirectoryRelativeToRoot(databaseRootDirectory()));
 }
 

trunk/Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.h

@@ -109 +109 @@
     String fullDatabasePath() const;
     String fullDatabaseDirectoryWithUpgrade();
+    
+    String databaseRootDirectory() const { return m_databaseRootDirectory.isolatedCopy(); }
 
     bool ensureValidRecordsTable();