Diff
Modified: trunk/LayoutTests/ChangeLog (131657 => 131658)
--- trunk/LayoutTests/ChangeLog 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/ChangeLog 2012-10-17 22:48:44 UTC (rev 131658)
@@ -1,3 +1,22 @@
+2012-10-17 Joshua Bell <[email protected]>
+
+ IndexedDB: Enforce unsigned long/unsigned long long ranges
+ https://bugs.webkit.org/show_bug.cgi?id=99637
+
+ Reviewed by Tony Chang.
+
+ Additional edge case tests and updated expectations.
+
+ * storage/indexeddb/cursor-advance-expected.txt:
+ * storage/indexeddb/intversion-bad-parameters-expected.txt:
+ * storage/indexeddb/intversion-encoding-expected.txt:
+ * storage/indexeddb/resources/cursor-advance.js:
+ (testBadAdvance.advanceBadly):
+ (testBadAdvance):
+ * storage/indexeddb/resources/intversion-bad-parameters.js:
+ (deleteSuccess):
+ * storage/indexeddb/resources/intversion-encoding.js:
+
2012-10-17 Tony Chang <[email protected]>
fast/forms/range/input-appearance-range-rtl.html off by one pixel
Modified: trunk/LayoutTests/storage/indexeddb/cursor-advance-expected.txt (131657 => 131658)
--- trunk/LayoutTests/storage/indexeddb/cursor-advance-expected.txt 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/storage/indexeddb/cursor-advance-expected.txt 2012-10-17 22:48:44 UTC (rev 131658)
@@ -137,6 +137,12 @@
Expecting TypeError exception from cursor.advance(0)
PASS Exception was thrown.
PASS cursor.advance(0) threw TypeError: Type error
+Expecting TypeError exception from cursor.advance(-1)
+PASS Exception was thrown.
+PASS cursor.advance(-1) threw TypeError: Type error
+Expecting TypeError exception from cursor.advance(0x20000000000000)
+PASS Exception was thrown.
+PASS cursor.advance(0x20000000000000) threw TypeError: Type error
testDelete()
trans = db.transaction(objectStoreName, 'readwrite')
objectStore = trans.objectStore(objectStoreName)
Modified: trunk/LayoutTests/storage/indexeddb/intversion-bad-parameters-expected.txt (131657 => 131658)
--- trunk/LayoutTests/storage/indexeddb/intversion-bad-parameters-expected.txt 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/storage/indexeddb/intversion-bad-parameters-expected.txt 2012-10-17 22:48:44 UTC (rev 131658)
@@ -18,11 +18,12 @@
Expecting TypeError exception from indexedDB.open(dbname, -5)
PASS Exception was thrown.
PASS indexedDB.open(dbname, -5) threw TypeError: Type error
-
-FIXME: Using -1 doesn't throw TypeError but it should
-Expecting TypeError exception from request = indexedDB.open(dbname, -1)
-FAIL No exception thrown!
-FAIL onupgradeneeded called unexpectedly
+Expecting TypeError exception from indexedDB.open(dbname, -1)
+PASS Exception was thrown.
+PASS indexedDB.open(dbname, -1) threw TypeError: Type error
+Expecting TypeError exception from indexedDB.open(dbname, 0x20000000000000)
+PASS Exception was thrown.
+PASS indexedDB.open(dbname, 0x20000000000000) threw TypeError: Type error
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/storage/indexeddb/intversion-encoding-expected.txt (131657 => 131658)
--- trunk/LayoutTests/storage/indexeddb/intversion-encoding-expected.txt 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/storage/indexeddb/intversion-encoding-expected.txt 2012-10-17 22:48:44 UTC (rev 131658)
@@ -81,7 +81,7 @@
db.close()
openFirstTime():
-version = 9007199254740992
+version = 9007199254740991
upgradeNeededFired = false
request = indexedDB.open(dbname, version)
upgradeNeededFired = true
Added: trunk/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt (0 => 131658)
--- trunk/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt (rev 0)
+++ trunk/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt 2012-10-17 22:48:44 UTC (rev 131658)
@@ -0,0 +1,12 @@
+No crashes when opening and reloading with bad version numbers
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+indexedDB = self.indexedDB || self.webkitIndexedDB || self.mozIndexedDB || self.msIndexedDB || self.OIndexedDB;
+
+dbname = String(window.location)
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/storage/indexeddb/open-bad-versions.html (0 => 131658)
--- trunk/LayoutTests/storage/indexeddb/open-bad-versions.html (rev 0)
+++ trunk/LayoutTests/storage/indexeddb/open-bad-versions.html 2012-10-17 22:48:44 UTC (rev 131658)
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script src=""
+<script src=""
+</head>
+<body>
+<script>
+
+description("No crashes when opening and reloading with bad version numbers");
+
+function test()
+{
+ removeVendorPrefixes();
+ evalAndLog("dbname = String(window.location)");
+
+ try { indexedDB.open(dbname, -1); } catch (e) { }
+ indexedDB.open(dbname, 2);
+ try { indexedDB.open(dbname, -1); } catch (e) { }
+
+ setTimeout(function() {
+ if (!window.location.search) {
+ window.location = window.location + "?2";
+ } else {
+ finishJSTest();
+ }
+ }, 500);
+}
+
+test();
+
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/storage/indexeddb/resources/cursor-advance.js (131657 => 131658)
--- trunk/LayoutTests/storage/indexeddb/resources/cursor-advance.js 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/storage/indexeddb/resources/cursor-advance.js 2012-10-17 22:48:44 UTC (rev 131658)
@@ -330,6 +330,8 @@
cursor = event.target.result;
evalAndExpectExceptionClass("cursor.advance(0)", "TypeError");
+ evalAndExpectExceptionClass("cursor.advance(-1)", "TypeError");
+ evalAndExpectExceptionClass("cursor.advance(0x20000000000000)", "TypeError");
testDelete();
}
request._onsuccess_ = advanceBadly;
Modified: trunk/LayoutTests/storage/indexeddb/resources/intversion-bad-parameters.js (131657 => 131658)
--- trunk/LayoutTests/storage/indexeddb/resources/intversion-bad-parameters.js 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/storage/indexeddb/resources/intversion-bad-parameters.js 2012-10-17 22:48:44 UTC (rev 131658)
@@ -20,13 +20,9 @@
evalAndExpectExceptionClass("indexedDB.open(dbname, 'stringversion')", "TypeError");
evalAndExpectExceptionClass("indexedDB.open(dbname, 0)", "TypeError");
evalAndExpectExceptionClass("indexedDB.open(dbname, -5)", "TypeError");
- debug("");
- debug("FIXME: Using -1 doesn't throw TypeError but it should");
- evalAndExpectExceptionClass("request = indexedDB.open(dbname, -1)", "TypeError");
- request._onsuccess_ = unexpectedSuccessCallback;
- request._onerror_ = unexpectedErrorCallback;
- request._onblocked_ = unexpectedBlockedCallback;
- request._onupgradeneeded_ = unexpectedUpgradeNeededCallback;
+ evalAndExpectExceptionClass("indexedDB.open(dbname, -1)", "TypeError");
+ evalAndExpectExceptionClass("indexedDB.open(dbname, 0x20000000000000)", "TypeError");
+ finishJSTest();
}
test();
Modified: trunk/LayoutTests/storage/indexeddb/resources/intversion-encoding.js (131657 => 131658)
--- trunk/LayoutTests/storage/indexeddb/resources/intversion-encoding.js 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/LayoutTests/storage/indexeddb/resources/intversion-encoding.js 2012-10-17 22:48:44 UTC (rev 131658)
@@ -9,7 +9,7 @@
0x7f,
0x80,
0x80000000,
- 9007199254740992]; // 2^53, maximum _javascript_ integer.
+ 9007199254740991]; // 2^53-1, maximum _javascript_ integer.
function test()
{
Modified: trunk/Source/WebCore/ChangeLog (131657 => 131658)
--- trunk/Source/WebCore/ChangeLog 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/ChangeLog 2012-10-17 22:48:44 UTC (rev 131658)
@@ -1,3 +1,39 @@
+2012-10-17 Joshua Bell <[email protected]>
+
+ IndexedDB: Enforce unsigned long/unsigned long long ranges
+ https://bugs.webkit.org/show_bug.cgi?id=99637
+
+ Reviewed by Tony Chang.
+
+ The IndexedDB spec has [EnforceRange] specified on unsigned long and unsigned long long
+ arguments, which requires the implementation to throw TypeError for negative values or
+ values that exceed 2^53-1 (maximum JS number that behaves like an integer) - and 0 is
+ specifically forbidden by the APIs as well.
+
+ A more correct fix in the binding layer is in webkit.org/b/96798 but we can temporarily
+ address this in the implementation.
+
+ Also refactor to prevent IDBFactory.open(name, -1) from triggering an internal code path.
+
+ Tests: storage/indexeddb/cursor-advance.html
+ storage/indexeddb/intversion-bad-parameters.html
+ storage/indexeddb/intversion-encoding.html
+
+ * Modules/indexeddb/IDBCursor.cpp:
+ (WebCore::IDBCursor::advance): Validate argument range.
+ * Modules/indexeddb/IDBCursor.h:
+ (IDBCursor):
+ * Modules/indexeddb/IDBCursor.idl: Drop "unsigned" qualifier as the binding code is
+ not yet doing the correct validation.
+ * Modules/indexeddb/IDBFactory.cpp: Refactor to prevent open(name, -1)
+ (WebCore):
+ (WebCore::IDBFactory::open): Validate the int version here, then pass to...
+ (WebCore::IDBFactory::openInternal): ... this method.
+ * Modules/indexeddb/IDBFactory.h:
+ (IDBFactory):
+ * Modules/indexeddb/IDBFactory.idl: Drop "unsigned" qualifier; meaningless to binding
+ code right now, can be re-added once webkit.org/b/96798 lands.
+
2012-10-17 Tony Chang <[email protected]>
fast/forms/range/input-appearance-range-rtl.html off by one pixel
Modified: trunk/Source/WebCore/Modules/indexeddb/IDBCursor.cpp (131657 => 131658)
--- trunk/Source/WebCore/Modules/indexeddb/IDBCursor.cpp 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBCursor.cpp 2012-10-17 22:48:44 UTC (rev 131658)
@@ -156,7 +156,7 @@
return objectStore->put(IDBObjectStoreBackendInterface::CursorUpdate, IDBAny::create(this), context, value, m_currentPrimaryKey, ec);
}
-void IDBCursor::advance(unsigned long count, ExceptionCode& ec)
+void IDBCursor::advance(long count, ExceptionCode& ec)
{
IDB_TRACE("IDBCursor::advance");
if (!m_gotValue) {
@@ -169,7 +169,9 @@
return;
}
- if (!count) {
+ // FIXME: This should only need to check for 0 once webkit.org/b/96798 lands.
+ const int64_t maxECMAScriptInteger = 0x20000000000000LL - 1;
+ if (count < 1 || count > maxECMAScriptInteger) {
ec = NATIVE_TYPE_ERR;
return;
}
Modified: trunk/Source/WebCore/Modules/indexeddb/IDBCursor.h (131657 => 131658)
--- trunk/Source/WebCore/Modules/indexeddb/IDBCursor.h 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBCursor.h 2012-10-17 22:48:44 UTC (rev 131658)
@@ -75,7 +75,7 @@
IDBAny* source() const;
PassRefPtr<IDBRequest> update(ScriptExecutionContext*, ScriptValue&, ExceptionCode&);
- void advance(unsigned long, ExceptionCode&);
+ void advance(long, ExceptionCode&);
void continueFunction(PassRefPtr<IDBKey>, ExceptionCode&);
PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, ExceptionCode&);
Modified: trunk/Source/WebCore/Modules/indexeddb/IDBCursor.idl (131657 => 131658)
--- trunk/Source/WebCore/Modules/indexeddb/IDBCursor.idl 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBCursor.idl 2012-10-17 22:48:44 UTC (rev 131658)
@@ -39,7 +39,8 @@
[CallWith=ScriptExecutionContext] IDBRequest update(in any value)
raises (IDBDatabaseException);
- void advance(in unsigned long count)
+ // FIXME: Make this [EnforceRange] unsigned long once webkit.org/b/96798 lands.
+ void advance(in long count)
raises (IDBDatabaseException);
[ImplementedAs=continueFunction] void continue(in [Optional] IDBKey key)
raises (IDBDatabaseException);
Modified: trunk/Source/WebCore/Modules/indexeddb/IDBFactory.cpp (131657 => 131658)
--- trunk/Source/WebCore/Modules/indexeddb/IDBFactory.cpp 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBFactory.cpp 2012-10-17 22:48:44 UTC (rev 131658)
@@ -108,13 +108,19 @@
PassRefPtr<IDBOpenDBRequest> IDBFactory::open(ScriptExecutionContext* context, const String& name, int64_t version, ExceptionCode& ec)
{
- if (name.isNull()) {
+ // FIXME: This should only need to check for 0 once webkit.org/b/96798 lands.
+ const int64_t maxECMAScriptInteger = 0x20000000000000LL - 1;
+ if (version < 1 || version > maxECMAScriptInteger) {
ec = NATIVE_TYPE_ERR;
return 0;
}
- // FIXME: We need to throw an error if script passes -1. Somehow refactor
- // this to avoid wanting to throw an error with the sentinel.
- if (!version || version < IDBDatabaseMetadata::NoIntVersion) {
+ return openInternal(context, name, version, ec);
+}
+
+PassRefPtr<IDBOpenDBRequest> IDBFactory::openInternal(ScriptExecutionContext* context, const String& name, int64_t version, ExceptionCode& ec)
+{
+ ASSERT(version >= 1 || version == IDBDatabaseMetadata::NoIntVersion);
+ if (name.isNull()) {
ec = NATIVE_TYPE_ERR;
return 0;
}
@@ -129,7 +135,7 @@
PassRefPtr<IDBOpenDBRequest> IDBFactory::open(ScriptExecutionContext* context, const String& name, ExceptionCode& ec)
{
- return open(context, name, IDBDatabaseMetadata::NoIntVersion, ec);
+ return openInternal(context, name, IDBDatabaseMetadata::NoIntVersion, ec);
}
PassRefPtr<IDBVersionChangeRequest> IDBFactory::deleteDatabase(ScriptExecutionContext* context, const String& name, ExceptionCode& ec)
Modified: trunk/Source/WebCore/Modules/indexeddb/IDBFactory.h (131657 => 131658)
--- trunk/Source/WebCore/Modules/indexeddb/IDBFactory.h 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBFactory.h 2012-10-17 22:48:44 UTC (rev 131658)
@@ -67,6 +67,8 @@
private:
IDBFactory(IDBFactoryBackendInterface*);
+ PassRefPtr<IDBOpenDBRequest> openInternal(ScriptExecutionContext*, const String& name, int64_t version, ExceptionCode&);
+
RefPtr<IDBFactoryBackendInterface> m_backend;
};
Modified: trunk/Source/WebCore/Modules/indexeddb/IDBFactory.idl (131657 => 131658)
--- trunk/Source/WebCore/Modules/indexeddb/IDBFactory.idl 2012-10-17 22:33:29 UTC (rev 131657)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBFactory.idl 2012-10-17 22:48:44 UTC (rev 131658)
@@ -28,7 +28,8 @@
] interface IDBFactory {
[CallWith=ScriptExecutionContext, ImplementedAs=getDatabaseNames] IDBRequest webkitGetDatabaseNames();
- [CallWith=ScriptExecutionContext] IDBOpenDBRequest open(in DOMString name, in [Optional] unsigned long long version)
+ // FIXME: Make this [EnforceRange] unsigned long long once webkit.org/b/96798 lands.
+ [CallWith=ScriptExecutionContext] IDBOpenDBRequest open(in DOMString name, in [Optional] long long version)
raises (IDBDatabaseException);
[CallWith=ScriptExecutionContext] IDBVersionChangeRequest deleteDatabase(in DOMString name)
raises (IDBDatabaseException);
