Bug 1178803. Fix the handling of the 'length' key in IDB keypaths when operating on a string. r=bent

This commit is contained in:
Boris Zbarsky 2015-07-01 00:15:30 -04:00
parent 3b8d7eed74
commit 059e75af55
3 changed files with 14 additions and 16 deletions

View File

@ -89,8 +89,8 @@ GetJSValFromKeyPathString(JSContext* aCx,
nsString targetObjectPropName;
JS::Rooted<JSObject*> targetObject(aCx, nullptr);
JS::Rooted<JSObject*> obj(aCx,
aValue.isPrimitive() ? nullptr : aValue.toObjectOrNull());
JS::Rooted<JS::Value> currentVal(aCx, aValue);
JS::Rooted<JSObject*> obj(aCx);
while (tokenizer.hasMoreTokens()) {
const nsDependentSubstring& token = tokenizer.nextToken();
@ -103,9 +103,18 @@ GetJSValFromKeyPathString(JSContext* aCx,
bool hasProp;
if (!targetObject) {
// We're still walking the chain of existing objects
if (!obj) {
// http://w3c.github.io/IndexedDB/#dfn-evaluate-a-key-path-on-a-value
// step 4 substep 1: check for .length on a String value.
if (currentVal.isString() && !tokenizer.hasMoreTokens() &&
token.EqualsLiteral("length") && aOptions == DoNotCreateProperties) {
aKeyJSVal->setNumber(double(JS_GetStringLength(currentVal.toString())));
break;
}
if (!currentVal.isObject()) {
return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
}
obj = &currentVal.toObject();
bool ok = JS_HasUCProperty(aCx, obj, keyPathChars, keyPathLen,
&hasProp);
@ -123,10 +132,7 @@ GetJSValFromKeyPathString(JSContext* aCx,
}
if (tokenizer.hasMoreTokens()) {
// ...and walk to it if there are more steps...
if (intermediate.isPrimitive()) {
return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
}
obj = intermediate.toObjectOrNull();
currentVal = intermediate;
}
else {
// ...otherwise use it as key

View File

@ -45,7 +45,7 @@ function testSteps()
const objectStoreDataLengthSort = [
{ key: "5", value: arr},
//{ key: "4", value: str},
{ key: "4", value: str},
];
let request = indexedDB.open(name, 1);

View File

@ -1,8 +0,0 @@
[keypath.htm]
type: testharness
[Keypath - str.length]
expected: FAIL
[Keypath - length]
expected: FAIL