IndexedDB: Ignore duplicate transaction IDs sent by renderer

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/process/process.h"
@@ skipping 458 matching lines @@
     const IndexedDBHostMsg_DatabaseCreateTransaction_Params& params) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   IndexedDBConnection* connection =
       parent_->GetOrTerminateProcess(&map_, params.ipc_database_id);
   if (!connection)
     return;
 
   int64 host_transaction_id = parent_->HostTransactionId(params.transaction_id);
 
+  if (transaction_database_map_.find(host_transaction_id) !=
+      transaction_database_map_.end()) {
+    DLOG(ERROR) << "Duplicate host_transaction_id.";
+    return;
+  }
+
   connection->database()->CreateTransaction(
       host_transaction_id, connection, params.object_store_ids, params.mode);
   transaction_database_map_[host_transaction_id] = params.ipc_database_id;
   parent_->RegisterTransactionId(host_transaction_id,
                                  database_url_map_[params.ipc_database_id]);
 }
 
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnClose(
     int32 ipc_database_id) {
   DCHECK(
@@ skipping 372 matching lines @@
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content