Fire window.onerror for uncaught IndexedDB errors

Source/modules/indexeddb/IDBRequest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 14 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "modules/indexeddb/IDBRequest.h"
 
 #include "bindings/v8/ExceptionState.h"
 #include "bindings/v8/ExceptionStatePlaceholder.h"
 #include "bindings/v8/IDBBindingUtilities.h"
+#include "bindings/v8/ScriptCallStackFactory.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/events/EventQueue.h"
+#include "core/inspector/ScriptCallFrame.h"
+#include "core/inspector/ScriptCallStack.h"
 #include "modules/indexeddb/IDBCursorWithValue.h"
 #include "modules/indexeddb/IDBDatabase.h"
 #include "modules/indexeddb/IDBEventDispatcher.h"
 #include "modules/indexeddb/IDBTracing.h"
 #include "platform/SharedBuffer.h"
 
 using blink::WebIDBCursor;
 
 namespace WebCore {
 
@@ skipping 17 matching lines @@
     , m_source(source)
     , m_hasPendingActivity(true)
     , m_cursorType(IndexedDB::CursorKeyAndValue)
     , m_cursorDirection(blink::WebIDBCursor::Next)
     , m_pendingCursor(nullptr)
     , m_didFireUpgradeNeededEvent(false)
     , m_preventPropagation(false)
     , m_resultDirty(true)
 {
     ScriptWrappable::init(this);
+
+    if (toIsolate(context)->InContext())
+        m_creationStackTrace = createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture, true);

[haraken, 2014/04/21 02:36:13]

Is it safe to limit the number of captured stack trace to
maxCallStackSizeToCapture? If there are a lot of stacks and we capture only a
part of the stacks, then we will end up firing window.error on a wrong frame
(which might be malicious).

[jsbell, 2014/04/21 16:28:38]

Is it possible to capture more? Maybe I'm misunderstanding that enum's purpose.
Is the content of the stack (other than the current frame) used for security
decisions? 

 }
 
 IDBRequest::~IDBRequest()
 {
     ASSERT(m_readyState == DONE || m_readyState == EarlyDeath || !executionContext());
 }
 
 ScriptValue IDBRequest::result(ExceptionState& exceptionState)
 {
     if (m_readyState != DONE) {
@@ skipping 380 matching lines @@
     }
 
     if (cursorToNotify)
         cursorToNotify->postSuccessHandlerCallback();
 
     // An upgradeneeded event will always be followed by a success or error event, so must
     // be kept alive.
     if (m_readyState == DONE && event->type() != EventTypeNames::upgradeneeded)
         m_hasPendingActivity = false;
 
+    if (!m_preventPropagation && dontPreventDefault && event->type() == EventTypeNames::error && m_creationStackTrace && m_creationStackTrace->size()) {
+        const ScriptCallFrame& frame = m_creationStackTrace->at(0);
+
+        // FIXME: SharableCrossOrigin or NotSharableCrossOrigin?
+        const AccessControlStatus corsStatus = NotSharableCrossOrigin;
+
+        RefPtr<ErrorEvent> errorEvent;
+        if (executionContext()->shouldSanitizeScriptError(frame.sourceURL(), corsStatus)) {

[haraken, 2014/04/21 02:36:13]

Is it OK to use the executionContext of this IDBRequest object? Or should we use
an executionContext of the |frame|?

[jsbell, 2014/04/21 16:28:38]

Great question. Anyone?

+            errorEvent = ErrorEvent::createSanitizedError(&m_scriptState->world());
+        } else {
+            // FIXME: Firefox just uses error's name. Should we include the message?

[jsbell, 2014/04/21 16:28:38]

And for the record: I plan to keep the message, especially as our messages are
pretty informative. I don't see a big compat concern here and we can hammer it
out in the IDBv2 spec.

+            String message = m_error->name() + ": " + m_error->message();
+            errorEvent = ErrorEvent::create(message, frame.sourceURL(), frame.lineNumber(), frame.columnNumber(), &m_scriptState->world());
+        }
+        executionContext()->reportException(errorEvent, m_creationStackTrace, corsStatus);
+    }
+
     return dontPreventDefault;
 }
 
 void IDBRequest::uncaughtExceptionInEventHandler()
 {
     if (m_transaction && !m_requestAborted) {
         m_transaction->setError(DOMError::create(AbortError, "Uncaught exception in event handler."));
         m_transaction->abort(IGNORE_EXCEPTION);
     }
 }
@@ skipping 34 matching lines @@
 
 void IDBRequest::dequeueEvent(Event* event)
 {
     for (size_t i = 0; i < m_enqueuedEvents.size(); ++i) {
         if (m_enqueuedEvents[i].get() == event)
             m_enqueuedEvents.remove(i);
     }
 }
 
 } // namespace WebCore