Bug 463907 - mozStorageConnection::ExecuteAsync does not check that provided statements have not been finalized; r=sdwilsh

storage/src/mozStorageConnection.cpp

@@ -399,6 +399,10 @@ mozStorageConnection::ExecuteAsync(mozIStorageStatement ** aStatements,
     nsTArray<sqlite3_stmt *> stmts(aNumStatements);
     for (PRUint32 i = 0; i < aNumStatements && rc == SQLITE_OK; i++) {
         sqlite3_stmt *old_stmt = aStatements[i]->GetNativeStatementPointer();
+        if (!old_stmt) {
+          rc = SQLITE_MISUSE;
+          break;
+        }
         NS_ASSERTION(sqlite3_db_handle(old_stmt) == mDBConn,
                      "Statement must be from this database connection!");
 

storage/test/unit/test_storage_statement_executeAsync.js

@@ -481,6 +481,21 @@ function test_double_execute()
   stmt.finalize();
 }
 
+function test_finalized_statement_does_not_crash()
+{
+  dump("test_finalized_statement_does_not_crash()\n");
+
+  var stmt = getOpenedDatabase().createStatement(
+    "SELECT * FROM TEST"
+  );
+  stmt.finalize();
+  // we are concerned about a crash here; an error is fine.
+  try {
+    stmt.executeAsync();
+  }
+  catch (ex) {}
+}
+
 var tests =
 [
   test_add_data,
@@ -493,6 +508,7 @@ var tests =
   test_immediate_cancellation,
   test_double_cancellation,
   test_double_execute,
+  test_finalized_statement_does_not_crash,
 ];
 
 function run_test()