Bug 1170746 - Getting mutable files over a cursor crashes the browser; r=bent
☠☠ backed out by 7466fbbe72ac ☠ ☠
authorJan Varga <jan.varga@gmail.com>
Wed, 10 Jun 2015 22:48:06 +0200
changeset 248161 c4db01ea9e6c80e2b269549abeec1d4aea34eab7
parent 248160 8fba915650d99e6e851414ed02a94a70699611f8
child 248162 86293a07e4c3ed74bc2319bf7e9708b826f6e6b5
push id28893
push userkwierso@gmail.com
push dateFri, 12 Jun 2015 00:02:58 +0000
treeherderautoland@8cf9d3e497f9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbent
bugs1170746
milestone41.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1170746 - Getting mutable files over a cursor crashes the browser; r=bent
dom/indexedDB/ActorsChild.cpp
dom/indexedDB/test/mochitest.ini
dom/indexedDB/test/test_filehandle_iteration.html
--- a/dom/indexedDB/ActorsChild.cpp
+++ b/dom/indexedDB/ActorsChild.cpp
@@ -2513,16 +2513,17 @@ BackgroundCursorChild::HandleResponse(
   MOZ_ASSERT(mObjectStore);
   MOZ_ASSERT(!mStrongRequest);
   MOZ_ASSERT(!mStrongCursor);
 
   // XXX Fix this somehow...
   auto& response = const_cast<ObjectStoreCursorResponse&>(aResponse);
 
   StructuredCloneReadInfo cloneReadInfo(Move(response.cloneInfo()));
+  cloneReadInfo.mDatabase = mTransaction->Database();
 
   ConvertActorsToBlobs(mTransaction->Database(),
                        response.cloneInfo(),
                        cloneReadInfo.mFiles);
 
   nsRefPtr<IDBCursor> newCursor;
 
   if (mCursor) {
@@ -2574,16 +2575,17 @@ BackgroundCursorChild::HandleResponse(co
   MOZ_ASSERT(mIndex);
   MOZ_ASSERT(!mStrongRequest);
   MOZ_ASSERT(!mStrongCursor);
 
   // XXX Fix this somehow...
   auto& response = const_cast<IndexCursorResponse&>(aResponse);
 
   StructuredCloneReadInfo cloneReadInfo(Move(response.cloneInfo()));
+  cloneReadInfo.mDatabase = mTransaction->Database();
 
   ConvertActorsToBlobs(mTransaction->Database(),
                        aResponse.cloneInfo(),
                        cloneReadInfo.mFiles);
 
   nsRefPtr<IDBCursor> newCursor;
 
   if (mCursor) {
--- a/dom/indexedDB/test/mochitest.ini
+++ b/dom/indexedDB/test/mochitest.ini
@@ -190,16 +190,18 @@ skip-if = (buildapp == 'b2g' && toolkit 
 [test_filehandle_append_read_data.html]
 # FileHandle is not supported in child processes.
 skip-if = buildapp == 'b2g' || buildapp == 'mulet' || e10s
 [test_filehandle_compat.html]
 # FileHandle is not supported in child processes.
 skip-if = buildapp == 'b2g' || buildapp == 'mulet' || e10s
 [test_filehandle_getFile.html]
 # FileHandle is not supported in child processes.
+[test_filehandle_iteration.html]
+# FileHandle is not supported in child processes.
 skip-if = buildapp == 'b2g' || buildapp == 'mulet' || e10s
 [test_filehandle_lifetimes.html]
 # FileHandle is not supported in child processes.
 skip-if = buildapp == 'b2g' || buildapp == 'mulet' || e10s
 [test_filehandle_lifetimes_nested.html]
 # FileHandle is not supported in child processes.
 skip-if = buildapp == 'b2g' || buildapp == 'mulet' || e10s
 [test_filehandle_location.html]
new file mode 100644
--- /dev/null
+++ b/dom/indexedDB/test/test_filehandle_iteration.html
@@ -0,0 +1,77 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>Indexed Database Property Test</title>
+
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <script type="text/javascript;version=1.7">
+  function testSteps()
+  {
+    const dbName = window.location.pathname;
+    const dbVersion = 1;
+    const objectStoreName = "foo";
+    const entryCount = 10;
+
+    let request = indexedDB.open(dbName, dbVersion);
+    request.onerror = errorHandler;
+    request.onupgradeneeded = grabEventAndContinueHandler;
+    request.onsuccess = unexpectedSuccessHandler;
+    let event = yield undefined;
+
+    is(event.type, "upgradeneeded", "Got correct event type");
+
+    let db = event.target.result;
+    db.onerror = errorHandler;
+
+    db.createObjectStore(objectStoreName, { autoIncrement: true });
+
+    request.onupgradeneeded = unexpectedSuccessHandler;
+    request.onsuccess = grabEventAndContinueHandler;
+    event = yield undefined;
+
+    is(event.type, "success", "Got correct event type");
+
+    request = db.createMutableFile("bar");
+    request.onsuccess = grabEventAndContinueHandler;
+    event = yield undefined;
+
+    let mutableFile = event.target.result;
+
+    let trans = db.transaction(objectStoreName, "readwrite");
+    let objectStore = trans.objectStore(objectStoreName);
+
+    for (let i = 0; i < entryCount; i++) {
+      request = objectStore.add(mutableFile);
+    }
+
+    let seenEntryCount = 0;
+
+    request = objectStore.openCursor().onsuccess = event => {
+      let cursor = event.target.result;
+      if (cursor) {
+        seenEntryCount++;
+        cursor.continue();
+      } else {
+        continueToNextStep();
+      }
+    }
+    yield undefined;
+
+    is(seenEntryCount, entryCount, "Correct entry count");
+
+    finishTest();
+    yield undefined;
+  }
+  </script>
+  <script type="text/javascript;version=1.7" src="helpers.js"></script>
+
+</head>
+
+<body onload="runTest();"></body>
+
+</html>