Title: [202833] trunk/Source/WebCore
Revision
202833
Author
[email protected]
Date
2016-07-05 14:34:33 -0700 (Tue, 05 Jul 2016)

Log Message

IDBDatabase can null deref its ScriptExecutionContext inside connectionToServerLost.
<rdar://problem/27169924> and https://bugs.webkit.org/show_bug.cgi?id=159432

Reviewed by Alex Christensen.

No new tests (Targeted test not possible, covered peripherally by all IDB tests).

* Modules/indexeddb/IDBActiveDOMObject.h:
* Modules/indexeddb/IDBDatabase.cpp:
(WebCore::IDBDatabase::connectionToServerLost): Make sure there is still a script execution context.

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (202832 => 202833)


--- trunk/Source/WebCore/ChangeLog	2016-07-05 21:08:38 UTC (rev 202832)
+++ trunk/Source/WebCore/ChangeLog	2016-07-05 21:34:33 UTC (rev 202833)
@@ -1,3 +1,16 @@
+2016-07-05  Brady Eidson  <[email protected]>
+
+        IDBDatabase can null deref its ScriptExecutionContext inside connectionToServerLost.
+        <rdar://problem/27169924> and https://bugs.webkit.org/show_bug.cgi?id=159432
+
+        Reviewed by Alex Christensen.
+
+        No new tests (Targeted test not possible, covered peripherally by all IDB tests).
+
+        * Modules/indexeddb/IDBActiveDOMObject.h:
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::connectionToServerLost): Make sure there is still a script execution context.
+
 2016-07-01  Jer Noble  <[email protected]>
 
         REGRESSION (r202641): Netflix playback stalls after a few seconds

Modified: trunk/Source/WebCore/Modules/indexeddb/IDBActiveDOMObject.h (202832 => 202833)


--- trunk/Source/WebCore/Modules/indexeddb/IDBActiveDOMObject.h	2016-07-05 21:08:38 UTC (rev 202832)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBActiveDOMObject.h	2016-07-05 21:34:33 UTC (rev 202833)
@@ -40,6 +40,8 @@
     ThreadIdentifier originThreadID() const { return m_originThreadID; }
 
     void contextDestroyed() final {
+        ASSERT(currentThread() == m_originThreadID);
+
         Locker<Lock> lock(m_scriptExecutionContextLock);
         ActiveDOMObject::contextDestroyed();
     }

Modified: trunk/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp (202832 => 202833)


--- trunk/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp	2016-07-05 21:08:38 UTC (rev 202832)
+++ trunk/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp	2016-07-05 21:34:33 UTC (rev 202833)
@@ -276,7 +276,9 @@
 
     Ref<Event> event = Event::create(eventNames().errorEvent, true, false);
     event->setTarget(this);
-    scriptExecutionContext()->eventQueue().enqueueEvent(WTFMove(event));
+
+    if (auto* context = scriptExecutionContext())
+        context->eventQueue().enqueueEvent(WTFMove(event));
 }
 
 void IDBDatabase::maybeCloseInServer()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to