Title: [131669] branches/chromium/1271
Revision
131669
Author
[email protected]
Date
2012-10-17 16:54:20 -0700 (Wed, 17 Oct 2012)

Log Message

Merge 131658 - IndexedDB: Enforce unsigned long/unsigned long long ranges
https://bugs.webkit.org/show_bug.cgi?id=99637

Reviewed by Tony Chang.

Source/WebCore:

The IndexedDB spec has [EnforceRange] specified on unsigned long and unsigned long long
arguments, which requires the implementation to throw TypeError for negative values or
values that exceed 2^53-1 (maximum JS number that behaves like an integer) - and 0 is
specifically forbidden by the APIs as well.

A more correct fix in the binding layer is in webkit.org/b/96798 but we can temporarily
address this in the implementation.

Also refactor to prevent IDBFactory.open(name, -1) from triggering an internal code path.

Tests: storage/indexeddb/cursor-advance.html
       storage/indexeddb/intversion-bad-parameters.html
       storage/indexeddb/intversion-encoding.html

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::advance): Validate argument range.
* Modules/indexeddb/IDBCursor.h:
(IDBCursor):
* Modules/indexeddb/IDBCursor.idl: Drop "unsigned" qualifier as the binding code is
not yet doing the correct validation.
* Modules/indexeddb/IDBFactory.cpp: Refactor to prevent open(name, -1)
(WebCore):
(WebCore::IDBFactory::open): Validate the int version here, then pass to...
(WebCore::IDBFactory::openInternal): ... this method.
* Modules/indexeddb/IDBFactory.h:
(IDBFactory):
* Modules/indexeddb/IDBFactory.idl: Drop "unsigned" qualifier; meaningless to binding
code right now, can be re-added once webkit.org/b/96798 lands.

LayoutTests:

Additional edge case tests and updated expectations.

* storage/indexeddb/cursor-advance-expected.txt:
* storage/indexeddb/intversion-bad-parameters-expected.txt:
* storage/indexeddb/intversion-encoding-expected.txt:
* storage/indexeddb/resources/cursor-advance.js:
(testBadAdvance.advanceBadly):
(testBadAdvance):
* storage/indexeddb/resources/intversion-bad-parameters.js:
(deleteSuccess):
* storage/indexeddb/resources/intversion-encoding.js:


[email protected]
Review URL: https://codereview.chromium.org/11184033

Modified Paths

Added Paths

Diff

Modified: branches/chromium/1271/LayoutTests/storage/indexeddb/cursor-advance-expected.txt (131668 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/cursor-advance-expected.txt	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/cursor-advance-expected.txt	2012-10-17 23:54:20 UTC (rev 131669)
@@ -136,6 +136,12 @@
 Expecting TypeError exception from cursor.advance(0)
 PASS Exception was thrown.
 PASS cursor.advance(0) threw TypeError: Type error
+Expecting TypeError exception from cursor.advance(-1)
+PASS Exception was thrown.
+PASS cursor.advance(-1) threw TypeError: Type error
+Expecting TypeError exception from cursor.advance(0x20000000000000)
+PASS Exception was thrown.
+PASS cursor.advance(0x20000000000000) threw TypeError: Type error
 testDelete()
 trans = db.transaction(objectStoreName, 'readwrite')
 objectStore = trans.objectStore(objectStoreName)

Modified: branches/chromium/1271/LayoutTests/storage/indexeddb/intversion-bad-parameters-expected.txt (131668 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/intversion-bad-parameters-expected.txt	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/intversion-bad-parameters-expected.txt	2012-10-17 23:54:20 UTC (rev 131669)
@@ -18,11 +18,12 @@
 Expecting TypeError exception from indexedDB.open(dbname, -5)
 PASS Exception was thrown.
 PASS indexedDB.open(dbname, -5) threw TypeError: Type error
-
-FIXME: Using -1 doesn't throw TypeError but it should
-Expecting TypeError exception from request = indexedDB.open(dbname, -1)
-FAIL No exception thrown!
-FAIL Success function called unexpectedly.
+Expecting TypeError exception from indexedDB.open(dbname, -1)
+PASS Exception was thrown.
+PASS indexedDB.open(dbname, -1) threw TypeError: Type error
+Expecting TypeError exception from indexedDB.open(dbname, 0x20000000000000)
+PASS Exception was thrown.
+PASS indexedDB.open(dbname, 0x20000000000000) threw TypeError: Type error
 PASS successfullyParsed is true
 
 TEST COMPLETE

Modified: branches/chromium/1271/LayoutTests/storage/indexeddb/intversion-encoding-expected.txt (131668 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/intversion-encoding-expected.txt	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/intversion-encoding-expected.txt	2012-10-17 23:54:20 UTC (rev 131669)
@@ -81,7 +81,7 @@
 db.close()
 
 openFirstTime():
-version = 9007199254740992
+version = 9007199254740991
 upgradeNeededFired = false
 request = indexedDB.open(dbname, version)
 upgradeNeededFired = true

Copied: branches/chromium/1271/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt (from rev 131658, trunk/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt) (0 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt	                        (rev 0)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/open-bad-versions-expected.txt	2012-10-17 23:54:20 UTC (rev 131669)
@@ -0,0 +1,12 @@
+No crashes when opening and reloading with bad version numbers
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+indexedDB = self.indexedDB || self.webkitIndexedDB || self.mozIndexedDB || self.msIndexedDB || self.OIndexedDB;
+
+dbname = String(window.location)
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Copied: branches/chromium/1271/LayoutTests/storage/indexeddb/open-bad-versions.html (from rev 131658, trunk/LayoutTests/storage/indexeddb/open-bad-versions.html) (0 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/open-bad-versions.html	                        (rev 0)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/open-bad-versions.html	2012-10-17 23:54:20 UTC (rev 131669)
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script src=""
+<script src=""
+</head>
+<body>
+<script>
+
+description("No crashes when opening and reloading with bad version numbers");
+
+function test()
+{
+  removeVendorPrefixes();
+  evalAndLog("dbname = String(window.location)");
+
+  try { indexedDB.open(dbname, -1); } catch (e) { }
+  indexedDB.open(dbname, 2);
+  try { indexedDB.open(dbname, -1); } catch (e) { }
+
+  setTimeout(function() {
+    if (!window.location.search) {
+      window.location = window.location + "?2";
+    } else {
+      finishJSTest();
+    }
+  }, 500);
+}
+
+test();
+
+</script>
+<script src=""
+</body>
+</html>

Modified: branches/chromium/1271/LayoutTests/storage/indexeddb/resources/cursor-advance.js (131668 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/resources/cursor-advance.js	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/resources/cursor-advance.js	2012-10-17 23:54:20 UTC (rev 131669)
@@ -330,6 +330,8 @@
         cursor = event.target.result;
 
         evalAndExpectExceptionClass("cursor.advance(0)", "TypeError");
+        evalAndExpectExceptionClass("cursor.advance(-1)", "TypeError");
+        evalAndExpectExceptionClass("cursor.advance(0x20000000000000)", "TypeError");
         testDelete();
     }
     request._onsuccess_ = advanceBadly;

Modified: branches/chromium/1271/LayoutTests/storage/indexeddb/resources/intversion-bad-parameters.js (131668 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/resources/intversion-bad-parameters.js	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/resources/intversion-bad-parameters.js	2012-10-17 23:54:20 UTC (rev 131669)
@@ -20,13 +20,9 @@
     evalAndExpectExceptionClass("indexedDB.open(dbname, 'stringversion')", "TypeError");
     evalAndExpectExceptionClass("indexedDB.open(dbname, 0)", "TypeError");
     evalAndExpectExceptionClass("indexedDB.open(dbname, -5)", "TypeError");
-    debug("");
-    debug("FIXME: Using -1 doesn't throw TypeError but it should");
-    evalAndExpectExceptionClass("request = indexedDB.open(dbname, -1)", "TypeError");
-    request._onsuccess_ = unexpectedSuccessCallback;
-    request._onerror_ = unexpectedErrorCallback;
-    request._onblocked_ = unexpectedBlockedCallback;
-    request._onupgradeneeded_ = unexpectedUpgradeNeededCallback;
+    evalAndExpectExceptionClass("indexedDB.open(dbname, -1)", "TypeError");
+    evalAndExpectExceptionClass("indexedDB.open(dbname, 0x20000000000000)", "TypeError");
+    finishJSTest();
 }
 
 test();

Modified: branches/chromium/1271/LayoutTests/storage/indexeddb/resources/intversion-encoding.js (131668 => 131669)


--- branches/chromium/1271/LayoutTests/storage/indexeddb/resources/intversion-encoding.js	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/LayoutTests/storage/indexeddb/resources/intversion-encoding.js	2012-10-17 23:54:20 UTC (rev 131669)
@@ -9,7 +9,7 @@
             0x7f,
             0x80,
             0x80000000,
-            9007199254740992]; // 2^53, maximum _javascript_ integer.
+            9007199254740991]; // 2^53-1, maximum _javascript_ integer.
 
 function test()
 {

Modified: branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.cpp (131668 => 131669)


--- branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.cpp	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.cpp	2012-10-17 23:54:20 UTC (rev 131669)
@@ -155,7 +155,7 @@
     return objectStore->put(IDBObjectStoreBackendInterface::CursorUpdate, IDBAny::create(this), context, value, m_currentPrimaryKey, ec);
 }
 
-void IDBCursor::advance(unsigned long count, ExceptionCode& ec)
+void IDBCursor::advance(long count, ExceptionCode& ec)
 {
     IDB_TRACE("IDBCursor::advance");
     if (!m_gotValue) {
@@ -168,7 +168,9 @@
         return;
     }
 
-    if (!count) {
+    // FIXME: This should only need to check for 0 once webkit.org/b/96798 lands.
+    const int64_t maxECMAScriptInteger = 0x20000000000000LL - 1;
+    if (count < 1 || count > maxECMAScriptInteger) {
         ec = NATIVE_TYPE_ERR;
         return;
     }

Modified: branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.h (131668 => 131669)


--- branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.h	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.h	2012-10-17 23:54:20 UTC (rev 131669)
@@ -75,7 +75,7 @@
     IDBAny* source() const;
 
     PassRefPtr<IDBRequest> update(ScriptExecutionContext*, ScriptValue&, ExceptionCode&);
-    void advance(unsigned long, ExceptionCode&);
+    void advance(long, ExceptionCode&);
     void continueFunction(PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, ExceptionCode&);
 

Modified: branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.idl (131668 => 131669)


--- branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.idl	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBCursor.idl	2012-10-17 23:54:20 UTC (rev 131669)
@@ -41,7 +41,7 @@
 
         [CallWith=ScriptExecutionContext] IDBRequest update(in any value)
             raises (IDBDatabaseException);
-        void advance(in unsigned long count)
+        void advance(in long count)
             raises (IDBDatabaseException);
         [ImplementedAs=continueFunction] void continue(in [Optional] IDBKey key)
             raises (IDBDatabaseException);

Modified: branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.cpp (131668 => 131669)


--- branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.cpp	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.cpp	2012-10-17 23:54:20 UTC (rev 131669)
@@ -108,13 +108,19 @@
 
 PassRefPtr<IDBOpenDBRequest> IDBFactory::open(ScriptExecutionContext* context, const String& name, int64_t version, ExceptionCode& ec)
 {
-    if (name.isNull()) {
+    // FIXME: This should only need to check for 0 once webkit.org/b/96798 lands.
+    const int64_t maxECMAScriptInteger = 0x20000000000000LL - 1;
+    if (version < 1 || version > maxECMAScriptInteger) {
         ec = NATIVE_TYPE_ERR;
         return 0;
     }
-    // FIXME: We need to throw an error if script passes -1. Somehow refactor
-    // this to avoid wanting to throw an error with the sentinel.
-    if (!version || version < IDBDatabaseMetadata::NoIntVersion) {
+    return openInternal(context, name, version, ec);
+}
+
+PassRefPtr<IDBOpenDBRequest> IDBFactory::openInternal(ScriptExecutionContext* context, const String& name, int64_t version, ExceptionCode& ec)
+{
+    ASSERT(version >= 1 || version == IDBDatabaseMetadata::NoIntVersion);
+    if (name.isNull()) {
         ec = NATIVE_TYPE_ERR;
         return 0;
     }
@@ -129,7 +135,7 @@
 
 PassRefPtr<IDBOpenDBRequest> IDBFactory::open(ScriptExecutionContext* context, const String& name, ExceptionCode& ec)
 {
-    return open(context, name, IDBDatabaseMetadata::NoIntVersion, ec);
+    return openInternal(context, name, IDBDatabaseMetadata::NoIntVersion, ec);
 }
 
 PassRefPtr<IDBVersionChangeRequest> IDBFactory::deleteDatabase(ScriptExecutionContext* context, const String& name, ExceptionCode& ec)

Modified: branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.h (131668 => 131669)


--- branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.h	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.h	2012-10-17 23:54:20 UTC (rev 131669)
@@ -67,6 +67,8 @@
 private:
     IDBFactory(IDBFactoryBackendInterface*);
 
+    PassRefPtr<IDBOpenDBRequest> openInternal(ScriptExecutionContext*, const String& name, int64_t version, ExceptionCode&);
+
     RefPtr<IDBFactoryBackendInterface> m_backend;
 };
 

Modified: branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.idl (131668 => 131669)


--- branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.idl	2012-10-17 23:51:03 UTC (rev 131668)
+++ branches/chromium/1271/Source/WebCore/Modules/indexeddb/IDBFactory.idl	2012-10-17 23:54:20 UTC (rev 131669)
@@ -29,8 +29,8 @@
         Conditional=INDEXED_DATABASE
     ] IDBFactory {
         [CallWith=ScriptExecutionContext, ImplementedAs=getDatabaseNames] IDBRequest webkitGetDatabaseNames();
-
-        [CallWith=ScriptExecutionContext] IDBOpenDBRequest open(in DOMString name, in [Optional] unsigned long long version)
+        // FIXME: Make this [EnforceRange] unsigned long long once webkit.org/b/96798 lands.
+        [CallWith=ScriptExecutionContext] IDBOpenDBRequest open(in DOMString name, in [Optional] long long version)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBVersionChangeRequest deleteDatabase(in DOMString name)
             raises (IDBDatabaseException);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to