Pass blob info through from the IPC to the backing store on put.

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
+#include "base/memory/scoped_vector.h"
 #include "base/process/process.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 #include "content/browser/indexed_db/indexed_db_cursor.h"
 #include "content/browser/indexed_db/indexed_db_database_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_metadata.h"
 #include "content/browser/indexed_db/indexed_db_pending_connection.h"
 #include "content/browser/indexed_db/indexed_db_value.h"
 #include "content/browser/renderer_host/render_message_filter.h"
 #include "content/common/indexed_db/indexed_db_messages.h"
@@ skipping 86 matching lines @@
   // Note that we explicitly separate CloseAll() from destruction of the
   // DatabaseDispatcherHost, since CloseAll() can invoke callbacks which need to
   // be dispatched through database_dispatcher_host_.
   database_dispatcher_host_->CloseAll();
   database_dispatcher_host_.reset();
   cursor_dispatcher_host_.reset();
 }
 
 base::TaskRunner* IndexedDBDispatcherHost::OverrideTaskRunnerForMessage(
     const IPC::Message& message) {
-  if (IPC_MESSAGE_CLASS(message) == IndexedDBMsgStart)
+  if (IPC_MESSAGE_CLASS(message) == IndexedDBMsgStart &&
+      message.type() != IndexedDBHostMsg_DatabasePut::ID)
     return indexed_db_context_->TaskRunner();
   return NULL;
 }
 
 bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message,
                                                 bool* message_was_ok) {
   if (IPC_MESSAGE_CLASS(message) != IndexedDBMsgStart)
     return false;
 
-  DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+  DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread() ||
+         message.type() == IndexedDBHostMsg_DatabasePut::ID);
 
   bool handled =
       database_dispatcher_host_->OnMessageReceived(message, message_was_ok) ||
       cursor_dispatcher_host_->OnMessageReceived(message, message_was_ok);
 
   if (!handled) {
     handled = true;
     IPC_BEGIN_MESSAGE_MAP_EX(IndexedDBDispatcherHost, message, *message_was_ok)
       IPC_MESSAGE_HANDLER(IndexedDBHostMsg_FactoryGetDatabaseNames,
                           OnIDBFactoryGetDatabaseNames)
@@ skipping 187 matching lines @@
   DCHECK(request_context_);
   Context()->GetIDBFactory()->DeleteDatabase(
       params.name,
       request_context_,
       new IndexedDBCallbacks(
           this, params.ipc_thread_id, params.ipc_callbacks_id),
       origin_url,
       indexed_db_path);
 }
 
+// OnPutHelper exists only to allow us to hop threads while holding a reference
+// to the IndexedDBDispatcherHost.
+void IndexedDBDispatcherHost::OnPutHelper(
+    const IndexedDBHostMsg_DatabasePut_Params& params,
+    std::vector<webkit_blob::BlobDataHandle*> handles) {
+  database_dispatcher_host_->OnPut(params, handles);
+}
+
 void IndexedDBDispatcherHost::OnAckReceivedBlobs(
     const std::vector<std::string>& uuids) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   std::vector<std::string>::const_iterator iter;
   for (iter = uuids.begin(); iter != uuids.end(); ++iter)
     DropBlobDataHandle(*iter);
 }
 
 void IndexedDBDispatcherHost::FinishTransaction(int64 host_transaction_id,
                                                 bool committed) {
@@ skipping 97 matching lines @@
     if (connection && connection->IsConnected()) {
       connection->Close();
       parent_->Context()->ConnectionClosed(iter->second, connection);
     }
   }
 }
 
 bool IndexedDBDispatcherHost::DatabaseDispatcherHost::OnMessageReceived(
     const IPC::Message& message,
     bool* msg_is_ok) {
+
   DCHECK(
+      (message.type() == IndexedDBHostMsg_DatabasePut::ID) ||
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_EX(
       IndexedDBDispatcherHost::DatabaseDispatcherHost, message, *msg_is_ok)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCreateObjectStore,
                         OnCreateObjectStore)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseDeleteObjectStore,
                         OnDeleteObjectStore)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCreateTransaction,
                         OnCreateTransaction)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseClose, OnClose)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseDestroyed, OnDestroyed)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseGet, OnGet)
-    IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabasePut, OnPut)
+    IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabasePut, OnPutWrapper)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseSetIndexKeys, OnSetIndexKeys)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseSetIndexesReady,
                         OnSetIndexesReady)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseOpenCursor, OnOpenCursor)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCount, OnCount)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseDeleteRange, OnDeleteRange)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseClear, OnClear)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCreateIndex, OnCreateIndex)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseDeleteIndex, OnDeleteIndex)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseAbort, OnAbort)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCommit, OnCommit)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
+
   return handled;
 }
 
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnCreateObjectStore(
     const IndexedDBHostMsg_DatabaseCreateObjectStore_Params& params) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   IndexedDBConnection* connection =
       parent_->GetOrTerminateProcess(&map_, params.ipc_database_id);
   if (!connection || !connection->IsConnected())
@@ skipping 89 matching lines @@
       parent_, params.ipc_thread_id, params.ipc_callbacks_id));
   connection->database()->Get(
       parent_->HostTransactionId(params.transaction_id),
       params.object_store_id,
       params.index_id,
       make_scoped_ptr(new IndexedDBKeyRange(params.key_range)),
       params.key_only,
       callbacks);
 }
 
+void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnPutWrapper(
+    const IndexedDBHostMsg_DatabasePut_Params& params) {
+  std::vector<webkit_blob::BlobDataHandle*> handles;
+  for (size_t i = 0; i < params.blob_or_file_info.size(); ++i) {
+    const IndexedDBMsg_BlobOrFileInfo& info = params.blob_or_file_info[i];
+    handles.push_back(parent_->blob_storage_context_->context()
+                          ->GetBlobDataFromUUID(info.uuid)
+                          .release());
+  }
+  parent_->indexed_db_context_->TaskRunner()->PostTask(
+      FROM_HERE,
+      base::Bind(
+          &IndexedDBDispatcherHost::OnPutHelper, parent_, params, handles));
+}
+
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnPut(
-    const IndexedDBHostMsg_DatabasePut_Params& params) {
+    const IndexedDBHostMsg_DatabasePut_Params& params,
+    std::vector<webkit_blob::BlobDataHandle*> handles) {
+
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
 
+  ScopedVector<webkit_blob::BlobDataHandle> scoped_handles;
+  scoped_handles.swap(handles);
+
   IndexedDBConnection* connection =
       parent_->GetOrTerminateProcess(&map_, params.ipc_database_id);
   if (!connection || !connection->IsConnected())
     return;
   scoped_refptr<IndexedDBCallbacks> callbacks(new IndexedDBCallbacks(
       parent_, params.ipc_thread_id, params.ipc_callbacks_id));
 
   int64 host_transaction_id = parent_->HostTransactionId(params.transaction_id);
+
+  std::vector<IndexedDBBlobInfo> blob_info(params.blob_or_file_info.size());
+
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+
+  for (size_t i = 0; i < params.blob_or_file_info.size(); ++i) {
+    const IndexedDBMsg_BlobOrFileInfo& info = params.blob_or_file_info[i];
+    if (info.is_file) {
+      base::FilePath path = base::FilePath::FromUTF16Unsafe(info.file_path);
+      if (!policy->CanReadFile(parent_->ipc_process_id_, path)) {
+        parent_->BadMessageReceived();
+        return;
+      }
+      blob_info[i] = IndexedDBBlobInfo(path, info.file_name, info.mime_type);
+    } else {
+      blob_info[i] = IndexedDBBlobInfo(info.uuid, info.mime_type, info.size);
+    }
+  }
+
   // TODO(alecflett): Avoid a copy here.
   IndexedDBValue value;
   value.bits = params.value;
+  value.blob_info.swap(blob_info);
   connection->database()->Put(
       host_transaction_id,
       params.object_store_id,
       &value,
+      &scoped_handles,
       make_scoped_ptr(new IndexedDBKey(params.key)),
       static_cast<IndexedDBDatabase::PutMode>(params.put_mode),
       callbacks,
       params.index_keys);
   TransactionIDToSizeMap* map =
       &parent_->database_dispatcher_host_->transaction_size_map_;
   // Size can't be big enough to overflow because it represents the
   // actual bytes passed through IPC.
   (*map)[host_transaction_id] += params.value.size();
 }
@@ skipping 196 matching lines @@
     IndexedDBDispatcherHost* parent)
     : parent_(parent) {
   map_.set_check_on_null_data(true);
 }
 
 IndexedDBDispatcherHost::CursorDispatcherHost::~CursorDispatcherHost() {}
 
 bool IndexedDBDispatcherHost::CursorDispatcherHost::OnMessageReceived(
     const IPC::Message& message,
     bool* msg_is_ok) {
-  DCHECK(
-      parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
-
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_EX(
       IndexedDBDispatcherHost::CursorDispatcherHost, message, *msg_is_ok)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_CursorAdvance, OnAdvance)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_CursorContinue, OnContinue)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_CursorPrefetch, OnPrefetch)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_CursorPrefetchReset, OnPrefetchReset)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_CursorDestroyed, OnDestroyed)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
+
+  DCHECK(
+      !handled ||
+      parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+
   return handled;
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnAdvance(
     int32 ipc_cursor_id,
     int32 ipc_thread_id,
     int32 ipc_callbacks_id,
     unsigned long count) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
@@ skipping 67 matching lines @@
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content