Chromium Code Reviews Chromium Code Reviews
Issue 1369773004:
IndexedDB: Fix null ptr crash in IDBCursor::value(). (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master| Index: third_party/WebKit/LayoutTests/storage/indexeddb/cursor-after-range-bug.html |
| diff --git a/third_party/WebKit/LayoutTests/storage/indexeddb/cursor-after-range-bug.html b/third_party/WebKit/LayoutTests/storage/indexeddb/cursor-after-range-bug.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..d391ae8a198d581fd72de61a22ddd41cb1c661b0 |
| --- /dev/null |
| +++ b/third_party/WebKit/LayoutTests/storage/indexeddb/cursor-after-range-bug.html |
| @@ -0,0 +1,52 @@ |
| +<!DOCTYPE html> |
| +<title>IndexedDB: Reading cursor value after advancing past range.</title> |
| +<script src="../../resources/testharness.js"></script> |
| +<script src="../../resources/testharnessreport.js"></script> |
| +<script> |
| + |
| +function doSetup(dbName, dbVersion, onsuccess) { |
|
jsbell
2015/09/30 20:34:06
You should make this all part of the async_test, o
cmumford
2015/09/30 21:59:43
Done.
|
| + var delete_request = indexedDB.deleteDatabase(dbName); |
| + delete_request.onerror = function() { |
| + assert_unreached('deleteDatabase should not fail'); |
| + }; |
| + delete_request.onsuccess = function(e) { |
| + var req = indexedDB.open(dbName, dbVersion); |
| + req.onsuccess = onsuccess; |
| + req.onerror = function() { |
| + assert_unreached('open should not fail'); |
| + }; |
| + req.onupgradeneeded = function(evt) { |
| + var connection = evt.target.result; |
| + store = connection.createObjectStore('store', null); |
| + for (var i = 0; i < 10; ++i) |
| + store.put(i, i); |
| + }; |
| + }; |
| +} |
| + |
| +// A regression test for http://crbug.com/487711 |
| +doSetup(location.pathname + '-afterCursorAdvance', 1, function(evt) { |
| + var connection = evt.target.result; |
| + async_test(function(t) { |
| + var transaction = connection.transaction('store', 'readonly'); |
| + var store = transaction.objectStore('store'); |
| + var req = store.openCursor(); |
| + var last_cursor; |
| + req.onsuccess = function(evt) { |
|
jsbell
2015/09/30 20:34:06
Callbacks need to be wrapped in t.step_func, e.g.
cmumford
2015/09/30 21:59:43
Done.
|
| + var cursor = evt.target.result; |
| + if (cursor) { |
| + last_cursor = cursor; |
| + cursor.continue(); |
| + } else { |
| + assert_equals(last_cursor.value, undefined); |
|
jsbell
2015/09/30 20:34:06
Cool - that does match the spec. :) I wasn't sure.
cmumford
2015/09/30 21:59:43
Acknowledged.
|
| + t.done(); |
| + } |
| + }; |
| + req.onerror = function() { |
|
jsbell
2015/09/30 20:34:06
ditto
cmumford
2015/09/30 21:59:43
Done.
|
| + assert_unreached('open should not fail'); |
| + }; |
| + }, 'afterCursorAdvance'); |
| +}); |
| + |
| +</script> |
| + |
