Title: [281457] branches/safari-612-branch/Source
Revision
281457
Author
repst...@apple.com
Date
2021-08-23 11:00:49 -0700 (Mon, 23 Aug 2021)

Log Message

Cherry-pick r281384. rdar://problem/82218757

    IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
    https://bugs.webkit.org/show_bug.cgi?id=229375

    Source/WebCore:

    Reviewed by Brady Eidson.

    Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
    created internally.

    * Modules/indexeddb/IDBRequest.cpp:
    (WebCore::IDBRequest::dispatchEvent):

    Source/WTF:

    Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.

    Reviewed by Brady Eidson.

    * wtf/CrossThreadTask.h:

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281384 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Modified Paths

Diff

Modified: branches/safari-612-branch/Source/WTF/ChangeLog (281456 => 281457)


--- branches/safari-612-branch/Source/WTF/ChangeLog	2021-08-23 17:58:38 UTC (rev 281456)
+++ branches/safari-612-branch/Source/WTF/ChangeLog	2021-08-23 18:00:49 UTC (rev 281457)
@@ -1,3 +1,42 @@
+2021-08-23  Russell Epstein  <repst...@apple.com>
+
+        Cherry-pick r281384. rdar://problem/82218757
+
+    IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+    https://bugs.webkit.org/show_bug.cgi?id=229375
+    
+    Source/WebCore:
+    
+    Reviewed by Brady Eidson.
+    
+    Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
+    created internally.
+    
+    * Modules/indexeddb/IDBRequest.cpp:
+    (WebCore::IDBRequest::dispatchEvent):
+    
+    Source/WTF:
+    
+    Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
+    
+    Reviewed by Brady Eidson.
+    
+    * wtf/CrossThreadTask.h:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281384 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-08-21  Sihui Liu  <sihui_...@apple.com>
+
+            IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+            https://bugs.webkit.org/show_bug.cgi?id=229375
+
+            Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
+
+            Reviewed by Brady Eidson.
+
+            * wtf/CrossThreadTask.h:
+
 2021-08-18  Ryosuke Niwa  <rn...@webkit.org>
 
         [ iOS Debug ] 12 TestWebKitAPI.WebKitLegacy. tests are crashing

Modified: branches/safari-612-branch/Source/WTF/wtf/CrossThreadTask.h (281456 => 281457)


--- branches/safari-612-branch/Source/WTF/wtf/CrossThreadTask.h	2021-08-23 17:58:38 UTC (rev 281456)
+++ branches/safari-612-branch/Source/WTF/wtf/CrossThreadTask.h	2021-08-23 18:00:49 UTC (rev 281457)
@@ -87,7 +87,7 @@
     callMemberFunctionForCrossThreadTaskImpl(object, function, std::forward<ArgsTuple>(args), ArgsIndicies());
 }
 
-template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
+template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
 CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
 {
     return CrossThreadTask([callee = makeRefPtr(&callee), method, arguments = std::make_tuple(crossThreadCopy(arguments)...)]() mutable {
@@ -95,7 +95,7 @@
     });
 }
 
-template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
+template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
 CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
 {
     return CrossThreadTask([callee = &callee, method, arguments = std::make_tuple(crossThreadCopy(arguments)...)]() mutable {

Modified: branches/safari-612-branch/Source/WebCore/ChangeLog (281456 => 281457)


--- branches/safari-612-branch/Source/WebCore/ChangeLog	2021-08-23 17:58:38 UTC (rev 281456)
+++ branches/safari-612-branch/Source/WebCore/ChangeLog	2021-08-23 18:00:49 UTC (rev 281457)
@@ -1,3 +1,44 @@
+2021-08-23  Russell Epstein  <repst...@apple.com>
+
+        Cherry-pick r281384. rdar://problem/82218757
+
+    IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+    https://bugs.webkit.org/show_bug.cgi?id=229375
+    
+    Source/WebCore:
+    
+    Reviewed by Brady Eidson.
+    
+    Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
+    created internally.
+    
+    * Modules/indexeddb/IDBRequest.cpp:
+    (WebCore::IDBRequest::dispatchEvent):
+    
+    Source/WTF:
+    
+    Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
+    
+    Reviewed by Brady Eidson.
+    
+    * wtf/CrossThreadTask.h:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281384 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-08-21  Sihui Liu  <sihui_...@apple.com>
+
+            IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+            https://bugs.webkit.org/show_bug.cgi?id=229375
+
+            Reviewed by Brady Eidson.
+
+            Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
+            created internally.
+
+            * Modules/indexeddb/IDBRequest.cpp:
+            (WebCore::IDBRequest::dispatchEvent):
+
 2021-08-19  Carlos Garcia Campos  <cgar...@igalia.com>
 
         document.hasFocus() returns true for unfocused pages

Modified: branches/safari-612-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp (281456 => 281457)


--- branches/safari-612-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp	2021-08-23 17:58:38 UTC (rev 281456)
+++ branches/safari-612-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp	2021-08-23 18:00:49 UTC (rev 281457)
@@ -308,7 +308,8 @@
     else if (m_transaction && !m_transaction->didDispatchAbortOrCommit())
         targets = { this, m_transaction.get(), &m_transaction->database() };
 
-    m_hasPendingActivity = false;
+    if (event.isTrusted())
+        m_hasPendingActivity = false;
 
     {
         TransactionActivator activator(m_transaction.get());
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to