Crash under UniqueIDBDatabaseTransaction::commit

https://bugs.webkit.org/show_bug.cgi?id=271300
rdar://114552467

Reviewed by Per Arne Vollan and Chris Dumez.

From crash reports, we know UniqueIDBDatabaseTransaction tries to take item from m_requestResults while it is empty,
which means pendingRequestCount is bigger than the size of m_requestResults. In current implementation, the parameter
pendingRequestCount indicates the number of request that client has not received result when submitting transaction
commit. UniqueIDBDatabaseTransaction will search whether there is an error in the last pendingRequestCount results
before submitting the commit operation to database. If there is no error, it asks database to commit transaction; if
there is an error, it asks database to abort the transaction as the error is not handled by client.

Chris pointed out an issue that m_requestResults is updated after async quota check in UniqueIDBDatabase, while
searching error in m_requestResults happens before the async quota check, which can be a direct cause to this issue.
To fix that, this patch moves the check (UniqueIDBDatabaseTransaction::shouldAbortDueToUnhandledRequestError) to inside
UniqueIDBDatabase::commitTransaction and after quota check. This guarantees the search happens after all requests
complete.

There are two other problems. One is that client is using the number of unfinished requests as pendingRequestCount and
server is recording all request results in m_requestResults, but one request may generate multiple results (e.g. a
cursor request could generate one result for each advancing operation). The patch fixes this by making client track
count of handled request results (IDBTransaction::m_handledRequestResultsCount) and pass thatto server. Another is that
certain operations (like createObjectStore) are not associated with request, so their result should not be put in
m_requestResults. This patch fixes that by removing the calls in UniqueIDBDatabaseTransaction.

* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:
(WebCore::IDBTransaction::finishedDispatchEventForRequest):
(WebCore::IDBTransaction::commitInternal):
(WebCore::IDBTransaction::commitOnServer):
* Source/WebCore/Modules/indexeddb/IDBTransaction.h:
* Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp:
(WebCore::IDBClient::IDBConnectionProxy::commitTransaction):
* Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.h:
* Source/WebCore/Modules/indexeddb/client/IDBConnectionToServer.cpp:
(WebCore::IDBClient::IDBConnectionToServer::commitTransaction):
* Source/WebCore/Modules/indexeddb/client/IDBConnectionToServer.h:
* Source/WebCore/Modules/indexeddb/client/IDBConnectionToServerDelegate.h:
* Source/WebCore/Modules/indexeddb/server/IDBServer.cpp:
(WebCore::IDBServer::IDBServer::commitTransaction):
* Source/WebCore/Modules/indexeddb/server/IDBServer.h:
* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h:
* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::shouldAbortDueToUnhandledRequestError const):
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::commit):
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::createObjectStore):
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::renameObjectStore):
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::createIndex):
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::deleteIndex):
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::renameIndex):
* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::commitTransaction):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.messages.in:
* Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:
(WebKit::WebIDBConnectionToServer::commitTransaction):
* Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:

Canonical link: https://commits.webkit.org/276489@main

Source/WebCore/Modules/indexeddb/IDBTransaction.cpp

@@ -458,6 +458,7 @@ void IDBTransaction::finishedDispatchEventForRequest(IDBRequest& request)
 
     ASSERT_UNUSED(request, !m_currentlyCompletingRequest || m_currentlyCompletingRequest == &request);
 
+    ++m_handledRequestResultsCount;
     m_currentlyCompletingRequest = nullptr;
     handleOperationsCompletedOnServer();
 }
@@ -489,21 +490,17 @@ void IDBTransaction::commitInternal()
 
     LOG(IndexedDBOperations, "IDB commit operation: Transaction %s", info().identifier().loggingString().utf8().data());
 
-    auto pendingRequestCount = std::count_if(m_openRequests.begin(), m_openRequests.end(), [](auto& request) {
-        return !request->isDone();
-    });
-
-    scheduleOperation(IDBClient::TransactionOperationImpl::create(*this, nullptr, [protectedThis = Ref { *this }, pendingRequestCount] (auto& operation) {
-        protectedThis->commitOnServer(operation, pendingRequestCount);
+    scheduleOperation(IDBClient::TransactionOperationImpl::create(*this, nullptr, [protectedThis = Ref { *this }] (auto& operation) {
+        protectedThis->commitOnServer(operation, protectedThis->m_handledRequestResultsCount);
     }));
 }
 
-void IDBTransaction::commitOnServer(IDBClient::TransactionOperation& operation, uint64_t pendingRequestCount)
+void IDBTransaction::commitOnServer(IDBClient::TransactionOperation& operation, uint64_t handledRequestResultsCount)
 {
     LOG(IndexedDB, "IDBTransaction::commitOnServer");
     ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread()));
 
-    m_database->connectionProxy().commitTransaction(*this, pendingRequestCount);
+    m_database->connectionProxy().commitTransaction(*this, handledRequestResultsCount);
 
     ASSERT(!m_transactionOperationsInProgressQueue.isEmpty());
     ASSERT(m_transactionOperationsInProgressQueue.last() == &operation);

Source/WebCore/Modules/indexeddb/IDBTransaction.h

@@ -182,7 +182,7 @@ class IDBTransaction final : public ThreadSafeRefCounted<IDBTransaction>, public
 
     Ref<IDBRequest> requestIndexRecord(IDBIndex&, IndexedDB::IndexRecordType, const IDBKeyRangeData&);
 
-    void commitOnServer(IDBClient::TransactionOperation&, uint64_t pendingRequestCount);
+    void commitOnServer(IDBClient::TransactionOperation&, uint64_t handledRequestResultsCount);
     void abortOnServerAndCancelRequests(IDBClient::TransactionOperation&);
 
     void createObjectStoreOnServer(IDBClient::TransactionOperation&, const IDBObjectStoreInfo&);
@@ -269,6 +269,7 @@ class IDBTransaction final : public ThreadSafeRefCounted<IDBTransaction>, public
     uint64_t m_lastWriteOperationID { 0 };
     std::optional<IDBResourceIdentifier> m_lastTransactionOperationBeforeCommit;
     std::optional<IDBError> m_commitResult;
+    uint64_t m_handledRequestResultsCount { 0 };
 };
 
 class TransactionActivator {

Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp

@@ -346,15 +346,15 @@ void IDBConnectionProxy::didStartTransaction(const IDBResourceIdentifier& transa
     transaction->performCallbackOnOriginThread(*transaction, &IDBTransaction::didStart, error);
 }
 
-void IDBConnectionProxy::commitTransaction(IDBTransaction& transaction, uint64_t pendingRequestCount)
+void IDBConnectionProxy::commitTransaction(IDBTransaction& transaction, uint64_t handledRequestResultsCount)
 {
     {
         Locker locker { m_transactionMapLock };
         ASSERT(!m_committingTransactions.contains(transaction.info().identifier()));
         m_committingTransactions.set(transaction.info().identifier(), &transaction);
     }
 
-    callConnectionOnMainThread(&IDBConnectionToServer::commitTransaction, transaction.info().identifier(), pendingRequestCount);
+    callConnectionOnMainThread(&IDBConnectionToServer::commitTransaction, transaction.info().identifier(), handledRequestResultsCount);
 }
 
 void IDBConnectionProxy::didCommitTransaction(const IDBResourceIdentifier& transactionIdentifier, const IDBError& error)

Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.h

@@ -92,7 +92,7 @@ class WEBCORE_EXPORT IDBConnectionProxy final {
     void openDBRequestCancelled(const IDBOpenRequestData&);
 
     void establishTransaction(IDBTransaction&);
-    void commitTransaction(IDBTransaction&, uint64_t pendingRequestCount);
+    void commitTransaction(IDBTransaction&, uint64_t handledRequestResultsCount);
     void abortTransaction(IDBTransaction&);
 
     void didStartTransaction(const IDBResourceIdentifier& transactionIdentifier, const IDBError&);

Source/WebCore/Modules/indexeddb/client/IDBConnectionToServer.cpp

@@ -357,13 +357,13 @@ void IDBConnectionToServer::establishTransaction(IDBDatabaseConnectionIdentifier
         m_delegate->establishTransaction(databaseConnectionIdentifier, info);
 }
 
-void IDBConnectionToServer::commitTransaction(const IDBResourceIdentifier& transactionIdentifier, uint64_t pendingRequestCount)
+void IDBConnectionToServer::commitTransaction(const IDBResourceIdentifier& transactionIdentifier, uint64_t handledRequestResultsCount)
 {
     LOG(IndexedDB, "IDBConnectionToServer::commitTransaction");
     ASSERT(isMainThread());
 
     if (m_serverConnectionIsValid)
-        m_delegate->commitTransaction(transactionIdentifier, pendingRequestCount);
+        m_delegate->commitTransaction(transactionIdentifier, handledRequestResultsCount);
     else {
         callOnMainThread([this, protectedThis = Ref { *this }, transactionIdentifier] {
             didCommitTransaction(transactionIdentifier, IDBError::serverConnectionLostError());

Source/WebCore/Modules/indexeddb/client/IDBConnectionToServer.h

@@ -110,7 +110,7 @@ class IDBConnectionToServer : public ThreadSafeRefCounted<IDBConnectionToServer>
     void iterateCursor(const IDBRequestData&, const IDBIterateCursorData&);
     WEBCORE_EXPORT void didIterateCursor(const IDBResultData&);
 
-    void commitTransaction(const IDBResourceIdentifier& transactionIdentifier, uint64_t pendingRequestCount);
+    void commitTransaction(const IDBResourceIdentifier& transactionIdentifier, uint64_t handledRequestResultsCount);
     WEBCORE_EXPORT void didCommitTransaction(const IDBResourceIdentifier& transactionIdentifier, const IDBError&);
 
     void didFinishHandlingVersionChangeTransaction(IDBDatabaseConnectionIdentifier, const IDBResourceIdentifier&);

Source/WebCore/Modules/indexeddb/client/IDBConnectionToServerDelegate.h

@@ -64,7 +64,7 @@ class IDBConnectionToServerDelegate : public CanMakeWeakPtr<IDBConnectionToServe
     virtual void deleteDatabase(const IDBOpenRequestData&) = 0;
     virtual void openDatabase(const IDBOpenRequestData&) = 0;
     virtual void abortTransaction(const IDBResourceIdentifier&) = 0;
-    virtual void commitTransaction(const IDBResourceIdentifier&, uint64_t pendingRequestCount) = 0;
+    virtual void commitTransaction(const IDBResourceIdentifier&, uint64_t handledRequestResultsCount) = 0;
     virtual void didFinishHandlingVersionChangeTransaction(IDBDatabaseConnectionIdentifier, const IDBResourceIdentifier&) = 0;
     virtual void createObjectStore(const IDBRequestData&, const IDBObjectStoreInfo&) = 0;
     virtual void deleteObjectStore(const IDBRequestData&, const String& objectStoreName) = 0;

Source/WebCore/Modules/indexeddb/server/IDBServer.cpp

@@ -396,7 +396,7 @@ void IDBServer::establishTransaction(IDBDatabaseConnectionIdentifier databaseCon
         m_uniqueIDBDatabaseMap.remove(database->identifier());
 }
 
-void IDBServer::commitTransaction(const IDBResourceIdentifier& transactionIdentifier, uint64_t pendingRequestCount)
+void IDBServer::commitTransaction(const IDBResourceIdentifier& transactionIdentifier, uint64_t handledRequestResultsCount)
 {
     LOG(IndexedDB, "IDBServer::commitTransaction");
     ASSERT(!isMainThread());
@@ -409,7 +409,7 @@ void IDBServer::commitTransaction(const IDBResourceIdentifier& transactionIdenti
         return;
     }
 
-    transaction->commit(pendingRequestCount);
+    transaction->commit(handledRequestResultsCount);
 }
 
 void IDBServer::didFinishHandlingVersionChangeTransaction(IDBDatabaseConnectionIdentifier databaseConnectionIdentifier, const IDBResourceIdentifier& transactionIdentifier)

Source/WebCore/Modules/indexeddb/server/IDBServer.h

@@ -60,7 +60,7 @@ class IDBServer : public UniqueIDBDatabaseManager {
     WEBCORE_EXPORT void openDatabase(const IDBOpenRequestData&);
     WEBCORE_EXPORT void deleteDatabase(const IDBOpenRequestData&);
     WEBCORE_EXPORT void abortTransaction(const IDBResourceIdentifier&);
-    WEBCORE_EXPORT void commitTransaction(const IDBResourceIdentifier&, uint64_t pendingRequestCount);
+    WEBCORE_EXPORT void commitTransaction(const IDBResourceIdentifier&, uint64_t handledRequestResultsCount);
     WEBCORE_EXPORT void didFinishHandlingVersionChangeTransaction(IDBDatabaseConnectionIdentifier, const IDBResourceIdentifier&);
     WEBCORE_EXPORT void createObjectStore(const IDBRequestData&, const IDBObjectStoreInfo&);
     WEBCORE_EXPORT void renameObjectStore(const IDBRequestData&, uint64_t objectStoreIdentifier, const String& newName);

Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp

@@ -1118,7 +1118,7 @@ void UniqueIDBDatabase::iterateCursor(const IDBRequestData& requestData, const I
     callback(error, result);
 }
 
-void UniqueIDBDatabase::commitTransaction(UniqueIDBDatabaseTransaction& transaction, ErrorCallback callback, SpaceCheckResult spaceCheckResult)
+void UniqueIDBDatabase::commitTransaction(UniqueIDBDatabaseTransaction& transaction, uint64_t handledRequestResultsCount, ErrorCallback callback, SpaceCheckResult spaceCheckResult)
 {
     ASSERT(!isMainThread());
     LOG(IndexedDB, "UniqueIDBDatabase::commitTransaction - %s", transaction.info().identifier().loggingString().utf8().data());
@@ -1127,18 +1127,28 @@ void UniqueIDBDatabase::commitTransaction(UniqueIDBDatabaseTransaction& transact
         if (!m_manager)
             return callback(IDBError { ExceptionCode::InvalidStateError });
 
-        m_manager->requestSpace(m_identifier.origin(), 0, [this, weakThis = WeakPtr { *this }, weakTransaction = WeakPtr { transaction }, callback = WTFMove(callback)](bool granted) mutable {
+        m_manager->requestSpace(m_identifier.origin(), 0, [this, handledRequestResultsCount, weakThis = WeakPtr { *this }, weakTransaction = WeakPtr { transaction }, callback = WTFMove(callback)](bool granted) mutable {
             if (!weakThis || !weakTransaction)
                 return callback(IDBError { ExceptionCode::InvalidStateError, "Database or transaction is closed"_s });
 
-            commitTransaction(*weakTransaction, WTFMove(callback), granted ? SpaceCheckResult::Pass : SpaceCheckResult::Fail);
+            commitTransaction(*weakTransaction, handledRequestResultsCount, WTFMove(callback), granted ? SpaceCheckResult::Pass : SpaceCheckResult::Fail);
         });
         return;
     }
 
     ASSERT(spaceCheckResult == SpaceCheckResult::Pass);
     ASSERT(transaction.database() == this);
 
+    if (transaction.shouldAbortDueToUnhandledRequestError(handledRequestResultsCount)) {
+        abortTransaction(transaction, [callback = WTFMove(callback)](auto error) {
+            if (!error.isNull())
+                return callback(error);
+
+            callback(IDBError { ExceptionCode::UnknownError, "Transaction is aborted due to unhandled failed request"_s });
+        }, spaceCheckResult);
+        return;
+    }
+
     if (!m_backingStore)
         return callback(IDBError { ExceptionCode::InvalidStateError, "Backing store is closed"_s });
 

Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h

@@ -98,7 +98,7 @@ class UniqueIDBDatabase : public CanMakeWeakPtr<UniqueIDBDatabase> {
     void deleteRecord(const IDBRequestData&, const IDBKeyRangeData&, ErrorCallback, SpaceCheckResult = SpaceCheckResult::Unknown);
     void openCursor(const IDBRequestData&, const IDBCursorInfo&, GetResultCallback, SpaceCheckResult = SpaceCheckResult::Unknown);
     void iterateCursor(const IDBRequestData&, const IDBIterateCursorData&, GetResultCallback, SpaceCheckResult = SpaceCheckResult::Unknown);
-    void commitTransaction(UniqueIDBDatabaseTransaction&, ErrorCallback, SpaceCheckResult = SpaceCheckResult::Unknown);
+    void commitTransaction(UniqueIDBDatabaseTransaction&, uint64_t handledRequestResultsCount, ErrorCallback, SpaceCheckResult = SpaceCheckResult::Unknown);
     void abortTransaction(UniqueIDBDatabaseTransaction&, ErrorCallback, SpaceCheckResult = SpaceCheckResult::Unknown);
 
     void didFinishHandlingVersionChange(UniqueIDBDatabaseConnection&, const IDBResourceIdentifier& transactionIdentifier);

Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp

@@ -117,34 +117,28 @@ bool UniqueIDBDatabaseTransaction::isReadOnly() const
     return m_transactionInfo.mode() == IDBTransactionMode::Readonly;
 }   
 
-void UniqueIDBDatabaseTransaction::commit(uint64_t pendingRequestCount)
+bool UniqueIDBDatabaseTransaction::shouldAbortDueToUnhandledRequestError(uint64_t handledRequestResultsCount) const
+{
+    if (handledRequestResultsCount > m_requestResults.size()) {
+        RELEASE_LOG_ERROR(IndexedDB, "%p - UniqueIDBDatabaseTransaction::shouldAbortDueToUnhandledRequestError: finished request count (%" PRIu64 ") is bigger than total request count %zu", this, handledRequestResultsCount, m_requestResults.size());
+        return false;
+    }
+
+    auto pendingRequestResults = m_requestResults.subspan(handledRequestResultsCount);
+    return WTF::anyOf(pendingRequestResults, [&] (auto& error) {
+        return !error.isNull();
+    });
+}
+
+void UniqueIDBDatabaseTransaction::commit(uint64_t handledRequestResultsCount)
 {
     LOG(IndexedDB, "UniqueIDBDatabaseTransaction::commit");
 
     auto* database = this->database();
     if (!database)
         return;
 
-    std::optional<IDBError> errorInPendingRequests;
-    while (pendingRequestCount--) {
-        auto error = m_requestResults.takeLast();
-        if (!error.isNull()) {
-            errorInPendingRequests = error;
-            break;
-        }
-    }
-
-    if (errorInPendingRequests) {
-        database->abortTransaction(*this, [this, weakThis = WeakPtr { *this }, &errorInPendingRequests](auto&) {
-            LOG(IndexedDB, "UniqueIDBDatabaseTransaction::commit with error (callback)");
-
-            if (weakThis && m_databaseConnection)
-                m_databaseConnection->didCommitTransaction(*this, *errorInPendingRequests);
-        });
-        return;
-    }
-
-    database->commitTransaction(*this, [this, weakThis = WeakPtr { *this }](auto& error) {
+    database->commitTransaction(*this, handledRequestResultsCount, [this, weakThis = WeakPtr { *this }](auto& error) {
         LOG(IndexedDB, "UniqueIDBDatabaseTransaction::commit (callback)");
 
         if (weakThis && m_databaseConnection)
@@ -169,8 +163,6 @@ void UniqueIDBDatabaseTransaction::createObjectStore(const IDBRequestData& reque
         if (!weakThis || !m_databaseConnection)
             return;
 
-        m_requestResults.append(error);
-
         if (error.isNull())
             m_databaseConnection->didCreateObjectStore(IDBResultData::createObjectStoreSuccess(requestData.requestIdentifier()));
         else
@@ -221,8 +213,6 @@ void UniqueIDBDatabaseTransaction::renameObjectStore(const IDBRequestData& reque
         if (!weakThis || !m_databaseConnection)
             return;
 
-        m_requestResults.append(error);
-
         if (error.isNull())
             m_databaseConnection->didRenameObjectStore(IDBResultData::renameObjectStoreSuccess(requestData.requestIdentifier()));
         else
@@ -272,8 +262,6 @@ void UniqueIDBDatabaseTransaction::createIndex(const IDBRequestData& requestData
         if (!weakThis || !m_databaseConnection)
             return;
 
-        m_requestResults.append(error);
-
         if (error.isNull())
             m_databaseConnection->didCreateIndex(IDBResultData::createIndexSuccess(requestData.requestIdentifier()));
         else
@@ -298,8 +286,6 @@ void UniqueIDBDatabaseTransaction::deleteIndex(const IDBRequestData& requestData
         if (!weakThis || !m_databaseConnection)
             return;
 
-        m_requestResults.append(error);
-
         if (error.isNull())
             m_databaseConnection->didDeleteIndex(IDBResultData::deleteIndexSuccess(requestData.requestIdentifier()));
         else
@@ -324,8 +310,6 @@ void UniqueIDBDatabaseTransaction::renameIndex(const IDBRequestData& requestData
         if (!weakThis || !m_databaseConnection)
             return;
 
-        m_requestResults.append(error);
-
         if (error.isNull())
             m_databaseConnection->didRenameIndex(IDBResultData::renameIndexSuccess(requestData.requestIdentifier()));
         else

Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h

@@ -68,7 +68,8 @@ class UniqueIDBDatabaseTransaction : public CanMakeWeakPtr<UniqueIDBDatabaseTran
 
     WEBCORE_EXPORT void abort();
     WEBCORE_EXPORT void abortWithoutCallback();
-    WEBCORE_EXPORT void commit(uint64_t pendingRequestCount);
+    bool shouldAbortDueToUnhandledRequestError(uint64_t handledRequestResultsCount) const;
+    WEBCORE_EXPORT void commit(uint64_t handledRequestResultsCount);
 
     WEBCORE_EXPORT void createObjectStore(const IDBRequestData&, const IDBObjectStoreInfo&);
     WEBCORE_EXPORT void deleteObjectStore(const IDBRequestData&, const String& objectStoreName);
@@ -103,7 +104,7 @@ class UniqueIDBDatabaseTransaction : public CanMakeWeakPtr<UniqueIDBDatabaseTran
     Vector<uint64_t> m_objectStoreIdentifiers;
 
     std::optional<IDBError> m_suspensionAbortResult;
-    Deque<IDBError> m_requestResults;
+    Vector<IDBError> m_requestResults;
 };
 
 } // namespace IDBServer

Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp

@@ -1485,10 +1485,10 @@ void NetworkStorageManager::abortTransaction(const WebCore::IDBResourceIdentifie
         transaction->abort();
 }
 
-void NetworkStorageManager::commitTransaction(const WebCore::IDBResourceIdentifier& transactionIdentifier, uint64_t pendingRequestCount)
+void NetworkStorageManager::commitTransaction(const WebCore::IDBResourceIdentifier& transactionIdentifier, uint64_t handledRequestResultsCount)
 {
     if (auto transaction = m_idbStorageRegistry->transaction(transactionIdentifier))
-        transaction->commit(pendingRequestCount);
+        transaction->commit(handledRequestResultsCount);
 }
 
 void NetworkStorageManager::didFinishHandlingVersionChangeTransaction(WebCore::IDBDatabaseConnectionIdentifier databaseConnectionIdentifier, const WebCore::IDBResourceIdentifier& transactionIdentifier)

Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h

@@ -191,7 +191,7 @@ class NetworkStorageManager final : public IPC::WorkQueueMessageReceiver, public
     void abortOpenAndUpgradeNeeded(WebCore::IDBDatabaseConnectionIdentifier, const std::optional<WebCore::IDBResourceIdentifier>& transactionIdentifier);
     void didFireVersionChangeEvent(WebCore::IDBDatabaseConnectionIdentifier, const WebCore::IDBResourceIdentifier& requestIdentifier, const WebCore::IndexedDB::ConnectionClosedOnBehalfOfServer);
     void abortTransaction(const WebCore::IDBResourceIdentifier&);
-    void commitTransaction(const WebCore::IDBResourceIdentifier&, uint64_t pendingRequestCount);
+    void commitTransaction(const WebCore::IDBResourceIdentifier&, uint64_t handledRequestResultsCount);
     void didFinishHandlingVersionChangeTransaction(WebCore::IDBDatabaseConnectionIdentifier, const WebCore::IDBResourceIdentifier&);
     void createObjectStore(const WebCore::IDBRequestData&, const WebCore::IDBObjectStoreInfo&);
     void deleteObjectStore(const WebCore::IDBRequestData&, const String& objectStoreName);

Source/WebKit/NetworkProcess/storage/NetworkStorageManager.messages.in

@@ -61,7 +61,7 @@
     DidFireVersionChangeEvent(WebCore::IDBDatabaseConnectionIdentifier databaseConnectionIdentifier, WebCore::IDBResourceIdentifier requestIdentifier, WebCore::IndexedDB::ConnectionClosedOnBehalfOfServer connectionClosedOnBehalfOfServer)
     DidFinishHandlingVersionChangeTransaction(WebCore::IDBDatabaseConnectionIdentifier databaseConnectionIdentifier, WebCore::IDBResourceIdentifier transactionIdentifier)
     AbortTransaction(WebCore::IDBResourceIdentifier transactionIdentifier)
-    CommitTransaction(WebCore::IDBResourceIdentifier transactionIdentifier, uint64_t pendingRequestCount)
+    CommitTransaction(WebCore::IDBResourceIdentifier transactionIdentifier, uint64_t handledRequestResultsCount)
     CreateObjectStore(WebCore::IDBRequestData requestData, WebCore::IDBObjectStoreInfo info)
     DeleteObjectStore(WebCore::IDBRequestData requestData, String objectStoreName)
     RenameObjectStore(WebCore::IDBRequestData requestData, uint64_t objectStoreIdentifier, String newName)