[IndexedDB] Abort transaction on unknown blob

content/browser/indexed_db/database_impl.cc

Index: content/browser/indexed_db/database_impl.cc
diff --git a/content/browser/indexed_db/database_impl.cc b/content/browser/indexed_db/database_impl.cc
index 922feabba842b04e0821e401a99b482e556f8bad..b6790c79485f2e8424b07b0303d969089c794201 100644
--- a/content/browser/indexed_db/database_impl.cc
+++ b/content/browser/indexed_db/database_impl.cc
@@ -5,6 +5,7 @@
 #include "content/browser/indexed_db/database_impl.h"
 
 #include "base/memory/ptr_util.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ -20,9 +21,10 @@
 using std::swap;
 
 namespace content {
+class IndexedDBDatabaseError;
 
 namespace {
-const char kInvalidBlobUuid[] = "Blob UUID is invalid";
+const char kInvalidBlobUuid[] = "Blob does not exist";
 const char kInvalidBlobFilePath[] = "Blob file path is invalid";
 }  // namespace
 
@@ -118,6 +120,8 @@ class DatabaseImpl::IDBThreadHelper {
                    int64_t index_id,
                    const base::string16& new_name);
   void Abort(int64_t transaction_id);
+  void AbortWithError(int64_t transaction_id,
+                      const IndexedDBDatabaseError& error);
   void Commit(int64_t transaction_id);
   void OnGotUsageAndQuotaForCommit(int64_t transaction_id,
                                    storage::QuotaStatusCode status,
@@ -258,6 +262,9 @@ void DatabaseImpl::Put(
   ChildProcessSecurityPolicyImpl* policy =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
+  scoped_refptr<IndexedDBCallbacks> callbacks(new IndexedDBCallbacks(
+      dispatcher_host_.get(), origin_, std::move(callbacks_info)));
+
   std::vector<std::unique_ptr<storage::BlobDataHandle>> handles(
       value->blob_or_file_info.size());
   std::vector<IndexedDBBlobInfo> blob_info(value->blob_or_file_info.size());
@@ -267,10 +274,21 @@ void DatabaseImpl::Put(
     std::unique_ptr<storage::BlobDataHandle> handle =
         dispatcher_host_->blob_storage_context()->GetBlobDataFromUUID(
             info->uuid);
+
+    UMA_HISTOGRAM_BOOLEAN("Storage.IndexedDB.PutValidBlob", !!handle);

[pwnall, 2017/03/27 20:56:33]

Can you please add a comment explaining why this is expected to happen? You can
probably reuse most of the text in the commit message.

[dmurph, 2017/03/27 23:03:32]

Done.

     if (!handle) {
-      mojo::ReportBadMessage(kInvalidBlobUuid);
+      IndexedDBDatabaseError error(blink::WebIDBDatabaseExceptionUnknownError,
+                                   kInvalidBlobUuid);
+      idb_runner_->PostTask(FROM_HERE, base::Bind(&IndexedDBCallbacks::OnError,
+                                                  callbacks, error));
+      idb_runner_->PostTask(
+          FROM_HERE,
+          base::Bind(&IDBThreadHelper::AbortWithError,
+                     base::Unretained(helper_), transaction_id, error));
       return;
     }
+    UMA_HISTOGRAM_COUNTS("Storage.IndexedDB.PutBlobSize", handle->size());
+
     handles[i] = std::move(handle);
 
     if (info->file) {
@@ -291,9 +309,6 @@ void DatabaseImpl::Put(
     }
   }
 
-  scoped_refptr<IndexedDBCallbacks> callbacks(new IndexedDBCallbacks(
-      dispatcher_host_.get(), origin_, std::move(callbacks_info)));
-
   idb_runner_->PostTask(
       FROM_HERE,
       base::Bind(&IDBThreadHelper::Put, base::Unretained(helper_),
@@ -792,6 +807,20 @@ void DatabaseImpl::IDBThreadHelper::Abort(int64_t transaction_id) {
   connection_->AbortTransaction(transaction);
 }
 
+void DatabaseImpl::IDBThreadHelper::AbortWithError(
+    int64_t transaction_id,
+    const IndexedDBDatabaseError& error) {
+  if (!connection_->IsConnected())
+    return;
+
+  IndexedDBTransaction* transaction =
+      connection_->GetTransaction(transaction_id);
+  if (!transaction)
+    return;
+
+  connection_->AbortTransaction(transaction, error);
+}
+
 void DatabaseImpl::IDBThreadHelper::Commit(int64_t transaction_id) {
   if (!connection_->IsConnected())
     return;