From 0a2e5d2dc2b06607dc8ba3c584ee80a2cda2ead7 Mon Sep 17 00:00:00 2001
From: violet <violet.bugreport@gmail.com>
Date: Wed, 17 Apr 2019 12:52:46 +0000
Subject: [PATCH] Bug 1505821 - DeserializeFromString should append an empty
 string for a trailing comma r=asuth

KeyPath [..., ''] will be serialized to have a trailing comma, when deserializing it, we should
append back the empty string. Otherwise we will get inconsistent result with the KeyPath::Parse() method, causing assertions failure.

Differential Revision: https://phabricator.services.mozilla.com/D24724

--HG--
extra : moz-landing-system : lando
---
 dom/indexedDB/KeyPath.cpp                |  7 +++++++
 dom/indexedDB/crashtests/1505821-1.html  | 16 ++++++++++++++++
 dom/indexedDB/crashtests/1507229-1.html  |  3 ++-
 dom/indexedDB/crashtests/crashtests.list |  1 +
 4 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 dom/indexedDB/crashtests/1505821-1.html

diff --git a/dom/indexedDB/KeyPath.cpp b/dom/indexedDB/KeyPath.cpp
index 2558d80230a4..4b6ff946a03a 100644
--- a/dom/indexedDB/KeyPath.cpp
+++ b/dom/indexedDB/KeyPath.cpp
@@ -466,6 +466,13 @@ KeyPath KeyPath::DeserializeFromString(const nsAString& aString) {
       keyPath.mStrings.AppendElement(tokenizer.nextToken());
     }
 
+    if (tokenizer.separatorAfterCurrentToken()) {
+      // There is a trailing comma, indicating the original KeyPath has
+      // a trailing empty string, i.e. [..., '']. We should append this
+      // empty string.
+      keyPath.mStrings.AppendElement(nsString{});
+    }
+
     return keyPath;
   }
 
diff --git a/dom/indexedDB/crashtests/1505821-1.html b/dom/indexedDB/crashtests/1505821-1.html
new file mode 100644
index 000000000000..da4bd31ab336
--- /dev/null
+++ b/dom/indexedDB/crashtests/1505821-1.html
@@ -0,0 +1,16 @@
+<script>
+  const dbRequest = window.indexedDB.open('bug1505821_1_hello');
+  dbRequest.onupgradeneeded = function (event) {
+    const store = event.target.result.createObjectStore('IDBStore_1', {autoIncrement: true});
+    store.createIndex('I', [''], {unique: true});
+    store.createIndex('J', ['a', ''], {unique: true});
+    store.createIndex('M', ['', 'a'], {unique: true});
+    store.createIndex('K', ['', 'a', ''], {unique: true});
+    store.createIndex('L', ['', '', ''], {unique: true});
+  }
+
+  const dbRequest2 = window.indexedDB.open('bug1505821_1_hello');
+  dbRequest.onsuccess = function (event) {
+    window.indexedDB.deleteDatabase("bug1507229_1_hello");
+  }
+</script>
diff --git a/dom/indexedDB/crashtests/1507229-1.html b/dom/indexedDB/crashtests/1507229-1.html
index f260b4430c6b..b190bee6ad0f 100644
--- a/dom/indexedDB/crashtests/1507229-1.html
+++ b/dom/indexedDB/crashtests/1507229-1.html
@@ -1,5 +1,6 @@
 <script>
-  window.indexedDB.open("hello").onsuccess = function(event) {
+  window.indexedDB.open("bug1507229_1_hello").onsuccess = function(event) {
     event.target.result.createMutableFile("");
+    window.indexedDB.deleteDatabase("bug1507229_1_hello");
   }
 </script>
diff --git a/dom/indexedDB/crashtests/crashtests.list b/dom/indexedDB/crashtests/crashtests.list
index 610ab98b1e22..d98ecca1cac5 100644
--- a/dom/indexedDB/crashtests/crashtests.list
+++ b/dom/indexedDB/crashtests/crashtests.list
@@ -1,2 +1,3 @@
 load 726376-1.html
+load 1505821-1.html
 load 1507229-1.html