Merge r228560 - IndexedDB: Several test crash in when destroying a ID…

…BKeyData https://bugs.webkit.org/show_bug.cgi?id=167576 Patch by Fujii Hironori <Hironori.Fujii@sony.com> on 2018-02-16 Reviewed by Michael Catanzaro. Source/WebCore: IDBKeyDataHashTraits::constructDeletedValue is using operator= to assign deletedValue. But, the value is destructed just before calling constructDeletedValue. You can't use operator= for a destructed value. No new tests (Covered by existing tests). * Modules/indexeddb/IDBKeyData.h: (WebCore::IDBKeyDataHashTraits::constructDeletedValue): Construct null value before assigning deletedValue. LayoutTests: * platform/gtk/TestExpectations: Unmarked imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html, imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html and storage/indexeddb/modern/index-3-private.html. * platform/wpe/TestExpectations: Unmarked imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html and imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html.
WebKit · Feb 20, 2018 · 7e4ffd4 · 7e4ffd4
1 parent 89032b9
commit 7e4ffd4
Show file tree

Hide file tree

Showing 5 changed files with 34 additions and 8 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2018-02-16  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        IndexedDB: Several test crash in when destroying a IDBKeyData
+        https://bugs.webkit.org/show_bug.cgi?id=167576
+
+        Reviewed by Michael Catanzaro.
+
+        * platform/gtk/TestExpectations: Unmarked
+        imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html,
+        imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html
+        and storage/indexeddb/modern/index-3-private.html.
+        * platform/wpe/TestExpectations: Unmarked
+        imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html and
+        imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html.
+
 2018-02-14  Antti Koivisto  <antti@apple.com>
 
         Do sibling invalidation on mutation

diff --git a/LayoutTests/platform/gtk/TestExpectations b/LayoutTests/platform/gtk/TestExpectations
@@ -1278,10 +1278,6 @@ webkit.org/b/131546 media/track/track-in-band.html [ Crash Timeout Failure ]
 
 webkit.org/b/163782 media/video-played-ranges-1.html [ Crash Pass ]
 
-webkit.org/b/167576 imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html [ Crash Timeout ]
-webkit.org/b/167576 imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html [ Crash Timeout ]
-webkit.org/b/167576 storage/indexeddb/modern/index-3-private.html [ Crash ]
-
 webkit.org/b/169811 fast/mediastream/captureStream/canvas2d.html [ Crash Timeout ]
 webkit.org/b/169811 fast/mediastream/captureStream/canvas3d.html [ Crash Timeout ]
 

diff --git a/LayoutTests/platform/wpe/TestExpectations b/LayoutTests/platform/wpe/TestExpectations
@@ -422,10 +422,6 @@ webkit.org/b/175586 imported/w3c/web-platform-tests/XMLHttpRequest/send-network-
 # Flaky
 webkit.org/b/177530 imported/w3c/web-platform-tests/XMLHttpRequest/setrequestheader-header-allowed.htm [ Pass Failure ]
 
-
-webkit.org/b/167576 imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html [ Crash ]
-webkit.org/b/167576 imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html [ Crash ]
-
 webkit.org/b/174354 imported/w3c/IndexedDB-private-browsing/idbfactory_open.html [ Crash Pass ]
 webkit.org/b/174354 imported/w3c/IndexedDB-private-browsing/idbfactory_open12.html [ Crash Pass ]
 

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,21 @@
+2018-02-16  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        IndexedDB: Several test crash in when destroying a IDBKeyData
+        https://bugs.webkit.org/show_bug.cgi?id=167576
+
+        Reviewed by Michael Catanzaro.
+
+        IDBKeyDataHashTraits::constructDeletedValue is using operator= to
+        assign deletedValue. But, the value is destructed just before
+        calling constructDeletedValue. You can't use operator= for a
+        destructed value.
+
+        No new tests (Covered by existing tests).
+
+        * Modules/indexeddb/IDBKeyData.h:
+        (WebCore::IDBKeyDataHashTraits::constructDeletedValue):
+        Construct null value before assigning deletedValue.
+
 2018-02-16  Zalan Bujtas  <zalan@apple.com>
 
         [RenderTreeBuilder] Move RenderBlock/RenderBlockFlow::addChild() to RenderTreeBuilder

diff --git a/Source/WebCore/Modules/indexeddb/IDBKeyData.h b/Source/WebCore/Modules/indexeddb/IDBKeyData.h
@@ -208,6 +208,7 @@ struct IDBKeyDataHashTraits : public WTF::CustomHashTraits<IDBKeyData> {
 
     static void constructDeletedValue(IDBKeyData& key)
     {
+        new (&key) IDBKeyData;
         key = IDBKeyData::deletedValue();
     }