[IndexedDB] Hold referenced to IDB::put blobs in the IDBRequest

third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 25 matching lines @@
 #include "core/dom/DOMStringList.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
 #include "modules/indexeddb/IDBAny.h"
 #include "modules/indexeddb/IDBCursorWithValue.h"
 #include "modules/indexeddb/IDBDatabase.h"
 #include "modules/indexeddb/IDBKeyPath.h"
 #include "modules/indexeddb/IDBTracing.h"
 #include "platform/Histogram.h"
 #include "platform/SharedBuffer.h"
+#include "public/platform/Platform.h"
 #include "public/platform/WebBlobInfo.h"
+#include "public/platform/WebBlobRegistry.h"
 #include "public/platform/WebData.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/indexeddb/WebIDBKey.h"
 #include "public/platform/modules/indexeddb/WebIDBKeyRange.h"
 #include "v8/include/v8.h"
 
 using blink::WebBlobInfo;
 using blink::WebIDBCallbacks;
 using blink::WebIDBCursor;
 using blink::WebIDBDatabase;
@@ skipping 442 matching lines @@
     index_ids.push_back(it.key);
     index_keys.push_back(keys);
   }
 
   IDBRequest* request =
       IDBRequest::Create(script_state, source, transaction_.Get());
   Vector<char> wire_bytes;
   serialized_value->ToWireBytes(wire_bytes);
   RefPtr<SharedBuffer> value_buffer = SharedBuffer::AdoptVector(wire_bytes);
 
+  // Add blob refs
+  blink::Platform* platform = blink::Platform::Current();
+  DCHECK(platform);
+  blink::WebBlobRegistry* registry = platform->GetBlobRegistry();
+  DCHECK(registry);
+  for (const WebBlobInfo& info : blob_info) {
+    registry->AddBlobDataRef(info.Uuid());

[michaeln, 2017/04/21 01:46:10]

Manual refcounting always makes me a little uneasy (are their any cases where
the balancing decref is not called and where is that balancing decref)

I think the serialized_value created on line 386 contains a map of
BlobDataHandles, so long as the handles in that map are retained the blobs will
not be deleted. Does the 'request' or 'callbacks' object outlive put()
completion? If so, maybe one of those could retain the references w/o manual
refcounting.

Also, is this change needed? At the time put() is called, there are valid refs
on any blobs in the value being put. Is there any chance the release msg of
those refs could beat the put msg sent on line 520? Maybe we can't depend on the
ordering of put vs release messages.

+  }
+
   BackendDB()->Put(transaction_->Id(), Id(), WebData(value_buffer), blob_info,
                    key, static_cast<WebIDBPutMode>(put_mode),
                    request->CreateWebCallbacks().release(), index_ids,
                    index_keys);
   return request;
 }
 
 IDBRequest* IDBObjectStore::deleteFunction(ScriptState* script_state,
                                            const ScriptValue& key,
                                            ExceptionState& exception_state) {
@@ skipping 533 matching lines @@
     }
   }
   return IDBIndexMetadata::kInvalidId;
 }
 
 WebIDBDatabase* IDBObjectStore::BackendDB() const {
   return transaction_->BackendDB();
 }
 
 }  // namespace blink