From 44ea79213069136f72cf922e0b10e0f6eff04045 Mon Sep 17 00:00:00 2001
From: violet <violet.bugreport@gmail.com>
Date: Fri, 22 Mar 2019 14:01:31 +0000
Subject: [PATCH] Bug 1507229 - Argument sanity check at CreateMutableFile() to
 avoid assertion failure r=janv

CreateMutableFile() doesn't allow empty name, we should check it before
further processing to avoid assertion failure.

Differential Revision: https://phabricator.services.mozilla.com/D23999

--HG--
extra : moz-landing-system : lando
---
 dom/indexedDB/IDBDatabase.cpp            | 5 +++++
 dom/indexedDB/crashtests/1507229-1.html  | 5 +++++
 dom/indexedDB/crashtests/crashtests.list | 1 +
 3 files changed, 11 insertions(+)
 create mode 100644 dom/indexedDB/crashtests/1507229-1.html

diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 2f8820497dca..51f4527d3f5f 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -667,6 +667,11 @@ already_AddRefed<IDBRequest> IDBDatabase::CreateMutableFile(
     ErrorResult& aRv) {
   AssertIsOnOwningThread();
 
+  if (aName.IsEmpty()) {
+    aRv.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+    return nullptr;
+  }
+
   if (QuotaManager::IsShuttingDown()) {
     IDB_REPORT_INTERNAL_ERR();
     aRv.Throw(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
diff --git a/dom/indexedDB/crashtests/1507229-1.html b/dom/indexedDB/crashtests/1507229-1.html
new file mode 100644
index 000000000000..f260b4430c6b
--- /dev/null
+++ b/dom/indexedDB/crashtests/1507229-1.html
@@ -0,0 +1,5 @@
+<script>
+  window.indexedDB.open("hello").onsuccess = function(event) {
+    event.target.result.createMutableFile("");
+  }
+</script>
diff --git a/dom/indexedDB/crashtests/crashtests.list b/dom/indexedDB/crashtests/crashtests.list
index 69f5dab0bb3f..610ab98b1e22 100644
--- a/dom/indexedDB/crashtests/crashtests.list
+++ b/dom/indexedDB/crashtests/crashtests.list
@@ -1 +1,2 @@
 load 726376-1.html
+load 1507229-1.html