Attachment 155092 Details for Bug 92562 – Patch

[patch] Patch

bug-92562-20120727171616.patch (text/plain), 12.27 KB, created by Joshua Bell on 2012-07-27 17:16:28 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Joshua Bell

Created: 2012-07-27 17:16:28 PDT

Size: 12.27 KB

patch

obsolete

>Subversion Revision: 123763
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 2bebf64bfa8f75817c6a265f221ab35fdf02173c..a59059a9e462b6005e3e916e81c164fb7108add0 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,26 @@
>+2012-07-27  Joshua Bell  <jsbell@chromium.org>
>+
>+        IndexedDB: IDBCursor.continue(key) does not throw for out of range key
>+        https://bugs.webkit.org/show_bug.cgi?id=92562
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Per spec, IDBCursor.continue(key) should throw for forward cursors
>+        if key < current key, and for reverse cursors if key > current key.
>+        Code was present on the back end but the error code was ignored, possibly
>+        broken in a recent refactor, and there were no tests for this case.
>+
>+        Test: storage/indexeddb/cursor-continue-dir.html
>+
>+        * Modules/indexeddb/IDBCursor.cpp:
>+        (WebCore::IDBCursor::advance):
>+        (WebCore::IDBCursor::continueFunction):
>+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
>+        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl):
>+        (WebCore::IDBCursorBackendImpl::continueFunction):
>+        * Modules/indexeddb/IDBCursorBackendImpl.h:
>+        (IDBCursorBackendImpl):
>+
> 2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
> 
>         Web Inspector: Introduce generic LiveLocation, make Script.Location inherit it.
>diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
>index ef34cb8c7fb7636184122b3cb836d248d21eb930..8b68e23ceb885a250637b54bf5eabf197b596d3d 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
>+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
>@@ -189,6 +189,8 @@ void IDBCursor::advance(unsigned long count, ExceptionCode& ec)
>     m_request->setPendingCursor(this);
>     m_gotValue = false;
>     m_backend->advance(count, m_request, ec);
>+    if (ec)
>+        m_request->markEarlyDeath();
> }
> 
> void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
>@@ -209,11 +211,28 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
>         return;
>     }
> 
>+    if (key) {
>+        ASSERT(m_currentKey);
>+        if (m_direction == IDBCursor::NEXT || m_direction == IDBCursor::NEXT_NO_DUPLICATE) {
>+            if (!m_currentKey->isLessThan(key.get())) {
>+                ec = IDBDatabaseException::DATA_ERR;
>+                return;
>+            }
>+        } else {
>+            if (!key->isLessThan(m_currentKey.get())) {
>+                ec = IDBDatabaseException::DATA_ERR;
>+                return;
>+            }
>+        }
>+    }
>+
>     // FIXME: We're not using the context from when continue was called, which means the callback
>     //        will be on the original context openCursor was called on. Is this right?
>     m_request->setPendingCursor(this);
>     m_gotValue = false;
>     m_backend->continueFunction(key, m_request, ec);
>+    if (ec)
>+        m_request->markEarlyDeath();
> }
> 
> PassRefPtr<IDBRequest> IDBCursor::deleteFunction(ScriptExecutionContext* context, ExceptionCode& ec)
>diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
>index ae27af8a32c6bb69492bff0866e2d02852446603..12e23fa462a58a7ab83ba9e1d74a57c8ada304fc 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
>+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
>@@ -42,9 +42,8 @@
> 
> namespace WebCore {
> 
>-IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor> cursor, IDBCursor::Direction direction, CursorType cursorType, IDBTransactionBackendImpl* transaction, IDBObjectStoreBackendImpl* objectStore)
>+IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor> cursor, IDBCursor::Direction, CursorType cursorType, IDBTransactionBackendImpl* transaction, IDBObjectStoreBackendImpl* objectStore)
>     : m_cursor(cursor)
>-    , m_direction(direction)
>     , m_cursorType(cursorType)
>     , m_transaction(transaction)
>     , m_objectStore(objectStore)
>@@ -99,21 +98,6 @@ void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPt
>     IDB_TRACE("IDBCursorBackendImpl::continue");
>     RefPtr<IDBKey> key = prpKey;
> 
>-    if (m_cursor && key) {
>-        ASSERT(m_cursor->key());
>-        if (m_direction == IDBCursor::NEXT || m_direction == IDBCursor::NEXT_NO_DUPLICATE) {
>-            if (!m_cursor->key()->isLessThan(key.get())) {
>-                ec = IDBDatabaseException::DATA_ERR;
>-                return;
>-            }
>-        } else {
>-            if (!key->isLessThan(m_cursor->key().get())) {
>-                ec = IDBDatabaseException::DATA_ERR;
>-                return;
>-            }
>-        }
>-    }
>-
>     if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::continueFunctionInternal, this, key, prpCallbacks)))
>         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
> }
>diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
>index 043c40352cdd3a3fd63f9972d16721f048e2b099..0fd4278f64197c137988a18a63bdbd03e576286d 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
>+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
>@@ -76,7 +76,6 @@ private:
> 
>     RefPtr<IDBBackingStore::Cursor> m_cursor;
>     RefPtr<IDBBackingStore::Cursor> m_savedCursor;
>-    IDBCursor::Direction m_direction;
>     CursorType m_cursorType;
>     RefPtr<IDBTransactionBackendImpl> m_transaction;
>     RefPtr<IDBObjectStoreBackendImpl> m_objectStore;
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index b4cb1c724b68b633a3f7218a821861def351e5b3..f4deb9c6b148c15441a7da7032d32dce38645eb1 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,24 @@
>+2012-07-27  Joshua Bell  <jsbell@chromium.org>
>+
>+        IndexedDB: IDBCursor.continue(key) does not throw for out of range key
>+        https://bugs.webkit.org/show_bug.cgi?id=92562
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Ensure cursor.continue(key) throws if key is "behind" the cursor.
>+
>+        * storage/indexeddb/cursor-continue-dir.html: Added.
>+        * storage/indexeddb/resources/cursor-continue-dir.js: Added.
>+        (test.request.onsuccess.request.onsuccess.request.onsuccess):
>+        (test.request.onsuccess.request.onsuccess):
>+        (test.request.onsuccess):
>+        (test):
>+        (testCursors):
>+        (testForwardCursor.request.onsuccess):
>+        (testForwardCursor):
>+        (testReverseCursor.request.onsuccess):
>+        (testReverseCursor):
>+
> 2012-07-26  ÃdÃ¡m Kallai  <kadam@inf.u-szeged.hu>
> 
>         [Qt] Unreviewed gardening. Fix after r123733.
>diff --git a/LayoutTests/storage/indexeddb/cursor-continue-dir-expected.txt b/LayoutTests/storage/indexeddb/cursor-continue-dir-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..3d909232ebdd5c2e6f1aa0e2fb21309d7430c3e3
>--- /dev/null
>+++ b/LayoutTests/storage/indexeddb/cursor-continue-dir-expected.txt
>@@ -0,0 +1,47 @@
>+Test that continue() calls against cursors are validated by direction.
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+indexedDB = self.indexedDB || self.webkitIndexedDB || self.mozIndexedDB || self.msIndexedDB || self.OIndexedDB;
>+
>+dbname = self.location.pathname
>+indexedDB.deleteDatabase(dbname)
>+request = indexedDB.open(dbname)
>+db = request.result
>+db.setVersion('1')
>+store = db.createObjectStore('store')
>+store.put(1,1)
>+store.put(2,2)
>+store.put(3,3)
>+store.put(4,4)
>+store.put(5,5)
>+store.put(6,6)
>+store.put(7,7)
>+store.put(8,8)
>+store.put(9,9)
>+store.put(10,10)
>+trans = db.transaction('store')
>+store = trans.objectStore('store')
>+request = store.openCursor(IDBKeyRange.bound(-Infinity, Infinity), 'next')
>+cursor = request.result
>+PASS cursor is non-null.
>+Expect DataError if: The parameter is less than or equal to this cursor's position and this cursor's direction is "next" or "nextunique".
>+PASS cursor.key is 1
>+Expecting exception from cursor.continue(-1)
>+PASS Exception was thrown.
>+PASS code is IDBDatabaseException.DATA_ERR
>+PASS ename is 'DataError'
>+request = store.openCursor(IDBKeyRange.bound(-Infinity, Infinity), 'prev')
>+cursor = request.result
>+PASS cursor is non-null.
>+Expect DataError if: The parameter is greater than or equal to this cursor's position and this cursor's direction is "prev" or "prevunique".
>+PASS cursor.key is 10
>+Expecting exception from cursor.continue(11)
>+PASS Exception was thrown.
>+PASS code is IDBDatabaseException.DATA_ERR
>+PASS ename is 'DataError'
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/storage/indexeddb/cursor-continue-dir.html b/LayoutTests/storage/indexeddb/cursor-continue-dir.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..af185d37433aa1d76d9434951c5be369cb14af4c
>--- /dev/null
>+++ b/LayoutTests/storage/indexeddb/cursor-continue-dir.html
>@@ -0,0 +1,10 @@
>+<html>
>+<head>
>+<script src="../../fast/js/resources/js-test-pre.js"></script>
>+<script src="resources/shared.js"></script>
>+</head>
>+<body>
>+<script src="resources/cursor-continue-dir.js"></script>
>+<script src="../../fast/js/resources/js-test-post.js"></script>
>+</body>
>+</html>
>diff --git a/LayoutTests/storage/indexeddb/resources/cursor-continue-dir.js b/LayoutTests/storage/indexeddb/resources/cursor-continue-dir.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..d5708595142eabf1cb4b080427967ab75e174633
>--- /dev/null
>+++ b/LayoutTests/storage/indexeddb/resources/cursor-continue-dir.js
>@@ -0,0 +1,76 @@
>+if (this.importScripts) {
>+    importScripts('../../../fast/js/resources/js-test-pre.js');
>+    importScripts('shared.js');
>+}
>+
>+description("Test that continue() calls against cursors are validated by direction.");
>+
>+function test()
>+{
>+    removeVendorPrefixes();
>+    evalAndLog("dbname = self.location.pathname");
>+    request = evalAndLog("indexedDB.deleteDatabase(dbname)");
>+    request.onerror = unexpectedErrorCallback;
>+    request.onblocked = unexpectedBlockedCallback;
>+    request.onsuccess = function() {
>+        evalAndLog("request = indexedDB.open(dbname)");
>+        request.onerror = unexpectedErrorCallback;
>+        request.onsuccess = function() {
>+            evalAndLog("db = request.result");
>+            request = evalAndLog("db.setVersion('1')");
>+            request.onerror = unexpectedErrorCallback;
>+            request.onblocked = unexpectedBlockedCallback;
>+            request.onsuccess = function() {
>+                trans = request.result;
>+                trans.onabort = unexpectedAbortCallback;
>+
>+                evalAndLog("store = db.createObjectStore('store')");
>+                for (i = 1; i <= 10; ++i) {
>+                    evalAndLog("store.put(" + i + "," + i + ")");
>+                }
>+
>+                trans.oncomplete = testCursors;
>+            };
>+        };
>+    };
>+}
>+
>+function testCursors()
>+{
>+    evalAndLog("trans = db.transaction('store')");
>+    evalAndLog("store = trans.objectStore('store')");
>+    testForwardCursor();
>+}
>+
>+function testForwardCursor()
>+{
>+    evalAndLog("request = store.openCursor(IDBKeyRange.bound(-Infinity, Infinity), 'next')");
>+    request.onerror = unexpectedErrorCallback;
>+    request.onsuccess = function() {
>+        evalAndLog("cursor = request.result");
>+        shouldBeNonNull("cursor");
>+        debug("Expect DataError if: The parameter is less than or equal to this cursor's position and this cursor's direction is \"next\" or \"nextunique\".");
>+        shouldBe("cursor.key", "1");
>+        evalAndExpectException("cursor.continue(-1)", "IDBDatabaseException.DATA_ERR", "'DataError'");
>+        request.onsuccess = null;
>+        testReverseCursor();
>+    };
>+}
>+
>+function testReverseCursor()
>+{
>+    evalAndLog("request = store.openCursor(IDBKeyRange.bound(-Infinity, Infinity), 'prev')");
>+    request.onerror = unexpectedErrorCallback;
>+    request.onsuccess = function() {
>+        evalAndLog("cursor = request.result");
>+        shouldBeNonNull("cursor");
>+        debug("Expect DataError if: The parameter is greater than or equal to this cursor's position and this cursor's direction is \"prev\" or \"prevunique\".");
>+        shouldBe("cursor.key", "10");
>+        evalAndExpectException("cursor.continue(11)", "IDBDatabaseException.DATA_ERR", "'DataError'");
>+        request.onsuccess = null;
>+
>+        finishJSTest();
>+    };
>+}
>+
>+test();

Actions: View | Formatted Diff | Diff

Attachments on bug 92562: 155090 | 155092 | 155832