Attachment 362699 Details for Bug 194843 – Patch

[patch] Patch

bug-194843-20190221234429.patch (text/plain), 5.78 KB, created by Sihui Liu on 2019-02-21 23:44:30 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Sihui Liu

Created: 2019-02-21 23:44:30 PST

Size: 5.78 KB

patch

obsolete

>Subversion Revision: 241761
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index a6da53fe8e04ad79dd06c117c410a040b2b97e76..262177e05f4be8c3ac6f71e2f56b2a24cd447223 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,26 @@
>+2019-02-21  Sihui Liu  <sihui_liu@apple.com>
>+
>+        Crash under IDBServer::IDBConnectionToClient::identifier() const
>+        https://bugs.webkit.org/show_bug.cgi?id=194843
>+        <rdar://problem/48203102>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        UniqueIDBDatabase should ignore requests from connections that are already closed.
>+
>+        Tests are hard to create without some tricks on UniqueIDBDatabase so this fix is verified manually. 
>+        One test is created by adding delay to UniqueIDBDatabase::openBackingStore on the background thread to make sure
>+        disconnection of web process happens before UniqueIDBDatabase::didOpenBackingStore, because didOpenBackingStore
>+        may start a version change transaction and ask for identifier from the connection that is already gone.
>+
>+        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
>+        (WebCore::IDBServer::IDBConnectionToClient::connectionToClientClosed):
>+        * Modules/indexeddb/server/IDBConnectionToClient.h:
>+        (WebCore::IDBServer::IDBConnectionToClient::isConenctionClosed):
>+        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
>+        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
>+        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
>+
> 2019-02-19  Commit Queue  <commit-queue@webkit.org>
> 
>         Unreviewed, rolling out r241722.
>diff --git a/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.cpp b/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.cpp
>index 8c8b72052243769cc9e83e34908ad63c4631a3bb..6be3430bfe94e60861c7615e308192791412423c 100644
>--- a/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.cpp
>+++ b/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.cpp
>@@ -207,6 +207,7 @@ void IDBConnectionToClient::connectionToClientClosed()
>             connection->connectionClosedFromClient();
>     }
> 
>+    m_isClosed = true;
>     m_databaseConnections.clear();
> }
> 
>diff --git a/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.h b/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.h
>index 160abfeec96003cbb1df335297f7b099d0f6800f..ed23b4bc652b4970741b1a60a2bd62535b7f633b 100644
>--- a/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.h
>+++ b/Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.h
>@@ -79,12 +79,13 @@ public:
>     void registerDatabaseConnection(UniqueIDBDatabaseConnection&);
>     void unregisterDatabaseConnection(UniqueIDBDatabaseConnection&);
>     void connectionToClientClosed();
>-
>+    bool isConenctionClosed() { return m_isClosed; }
> private:
>     IDBConnectionToClient(IDBConnectionToClientDelegate&);
>     
>     WeakPtr<IDBConnectionToClientDelegate> m_delegate;
>     HashSet<UniqueIDBDatabaseConnection*> m_databaseConnections;
>+    bool m_isClosed { false };
> };
> 
> } // namespace IDBServer
>diff --git a/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp b/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp
>index 722e7e94682d3456ad71bf5ec622b1e0c4356d63..4fe4dc7f6b83f49a21f39f254c7b1920de0e65cb 100644
>--- a/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp
>+++ b/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp
>@@ -353,20 +353,28 @@ void UniqueIDBDatabase::handleDatabaseOperations()
>     if (m_deleteBackingStoreInProgress)
>         return;
> 
>-    if (m_versionChangeDatabaseConnection || m_versionChangeTransaction || m_currentOpenDBRequest) {
>+    if (m_versionChangeDatabaseConnection || m_versionChangeTransaction || (m_currentOpenDBRequest && !m_currentOpenDBRequest->connection().isConenctionClosed())) {
>         // We can't start any new open-database operations right now, but we might be able to start handling a delete operation.
>-        if (!m_currentOpenDBRequest && !m_pendingOpenDBRequests.isEmpty() && m_pendingOpenDBRequests.first()->isDeleteRequest())
>-            m_currentOpenDBRequest = m_pendingOpenDBRequests.takeFirst();
>+        if (!m_currentOpenDBRequest) {
>+            while (!m_pendingOpenDBRequests.isEmpty() && m_pendingOpenDBRequests.first()->connection().isConenctionClosed())
>+                m_pendingOpenDBRequests.removeFirst();
>+            if (!m_pendingOpenDBRequests.isEmpty() && m_pendingOpenDBRequests.first()->isDeleteRequest())
>+                m_currentOpenDBRequest = m_pendingOpenDBRequests.takeFirst();
>+        }
> 
>         // Some operations (such as the first open operation after a delete) require multiple passes to completely handle
>         if (m_currentOpenDBRequest)
>             handleCurrentOperation();
>-
>         return;
>     }
> 
>-    if (m_pendingOpenDBRequests.isEmpty())
>+    // Skip requests with closed connection.
>+    while (!m_pendingOpenDBRequests.isEmpty() && m_pendingOpenDBRequests.first()->connection().isConenctionClosed())
>+        m_pendingOpenDBRequests.removeFirst();
>+    if (m_pendingOpenDBRequests.isEmpty()) {
>+        m_currentOpenDBRequest = nullptr;
>         return;
>+    }
> 
>     m_currentOpenDBRequest = m_pendingOpenDBRequests.takeFirst();
>     LOG(IndexedDB, "UniqueIDBDatabase::handleDatabaseOperations - Popped an operation, now there are %u pending", m_pendingOpenDBRequests.size());
>@@ -1573,7 +1581,7 @@ void UniqueIDBDatabase::operationAndTransactionTimerFired()
> 
>     // The current operation might require multiple attempts to handle, so try to
>     // make further progress on it now.
>-    if (m_currentOpenDBRequest)
>+    if (m_currentOpenDBRequest && !m_currentOpenDBRequest->connection().isConenctionClosed())
>         handleCurrentOperation();
> 
>     if (!m_currentOpenDBRequest)

Actions: View | Formatted Diff | Diff

Attachments on bug 194843: 362455 | 362678 | 362699 | 362747 | 362765