Fix a big with bad args to object stores with keypaths

2010-06-14 17:19:55 -07:00 · 2010-06-14 17:19:55 -07:00 · 565a1483ca
--- a/dom/indexedDB/IDBObjectStoreRequest.cpp
+++ b/dom/indexedDB/IDBObjectStoreRequest.cpp
@ -327,7 +327,10 @@ nsresult
 IDBObjectStoreRequest::GetKeyFromVariant(nsIVariant* aKeyVariant,
                                         Key& aKey)
 {
-  NS_ASSERTION(aKeyVariant, "Null pointer!");
+  if (!aKeyVariant) {
+    aKey = Key::UNSETKEY;
+    return NS_OK;
+  }

  PRUint16 type;
  nsresult rv = aKeyVariant->GetDataType(&type);
@ -556,7 +559,11 @@ IDBObjectStoreRequest::GetAddInfo(/* jsval aValue, */
    }
  }
  else {
-    // Inline keys live on the object.
+    // Inline keys live on the object. Make sure it is an object.
+    if (JSVAL_IS_PRIMITIVE(clone.value())) {
+      return NS_ERROR_INVALID_ARG;
+    }
+
    rv = GetKeyFromObject(cx, JSVAL_TO_OBJECT(clone.value()), mKeyPath, aKey);
    NS_ENSURE_SUCCESS(rv, rv);

--- a/dom/indexedDB/test/Makefile.in
+++ b/dom/indexedDB/test/Makefile.in
@ -47,6 +47,7 @@ include $(topsrcdir)/config/rules.mk
 _TEST_FILES = \
  helpers.js \
  test_add_twice_failure.html \
+  test_bad_keypath.html \
  test_create_index.html \
  test_create_objectStore.html \
  test_cursors.html \
--- a/dom/indexedDB/test/test_bad_keypath.html
+++ b/dom/indexedDB/test/test_bad_keypath.html
@ -0,0 +1,55 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>Indexed Database Property Test</title>
+
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <script type="text/javascript;version=1.7">
+    function testSteps()
+    {
+      const name = window.location.pathname;
+      const description = "My Test Database";
+      const NS_ERROR_INVALID_ARG = 0x80070057;
+
+      let request = moz_indexedDB.open(name, description);
+      request.onerror = errorHandler;
+      request.onsuccess = grabEventAndContinueHandler;
+      let event = yield;
+
+      let db = event.result;
+
+      request = db.createObjectStore("foo", "keyPath");
+      request.onerror = errorHandler;
+      request.onsuccess = grabEventAndContinueHandler;
+      event = yield;
+
+      let objectStore = event.result;
+
+      request = objectStore.add({keyPath:"foo"});
+      request.onerror = errorHandler;
+      request.onsuccess = grabEventAndContinueHandler;
+      event = yield;
+
+      try {
+        request = objectStore.add({});
+      }
+      catch (e) {
+        is(e.result, NS_ERROR_INVALID_ARG, "Good error");
+      }
+
+      finishTest();
+      yield;
+    }
+  </script>
+  <script type="text/javascript;version=1.7" src="helpers.js"></script>
+</head>
+
+<body onload="runTest();"></body>
+
+</html>