1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
// Copyright 2025 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const DB = 'db';
const STORE = 'store';
const DATA = 'data';
// Regression test for crbug.com/392376370
// This test reads a blob out of IDB, creates a second blob that contains that
// blob, releases the IDB blob, and the looks up the same IDB blob again. This
// caused a crash because the containing blob held alive a reference to the
// BlobDataItemReader connection, and therefore the BlobReader. The living
// BlobReader would be reused for the second IDB lookup, but did not fully
// re-initialize itself with the blob registry.
function run() {
Object.assign(indexedDB.open(DB), {
onerror: unexpectedErrorCallback,
onupgradeneeded(e) {
debug('Created object store.');
e.target.result.createObjectStore(STORE);
},
onsuccess(e) {
debug('Opened database.');
const idb = /** @type IDBDatabase */ e.target.result;
const op = idb.transaction(STORE, 'readwrite')
.objectStore(STORE)
.put(new Blob([DATA]), 'foo');
op.onerror = unexpectedErrorCallback;
op.onsuccess = () => {
debug('Wrote blob.');
idb.close();
setTimeout(verify);
}
},
});
}
var blob;
var runs = 0;
function verify(e) {
debug('Reading blob.');
Object.assign(indexedDB.open(DB), {
onerror: unexpectedErrorCallback,
onsuccess(e) {
const idb = /** @type IDBDatabase */ e.target.result;
const op =
idb.transaction(STORE, 'readonly').objectStore(STORE).get('foo');
op.onerror = unexpectedErrorCallback;
op.onsuccess = e => {
debug('Got blob.');
// Puts the returned IDB blob in another blob (as an array of length 1).
blob = new Blob([e.target.result], {type: e.target.result.type});
// The IDB blob needs to be GC'd to trigger the buggy path.
setTimeout(gc);
if (++runs < 2) {
// Verify should be run twice, since the bug involved looking up the
// IDB blob more than once.
setTimeout(verify);
} else {
// No renderer crash = pass.
done();
}
}
},
});
}
|
