Add IndexedDB browser test that causes a crash.

content/browser/in_process_webkit/indexed_db_dispatcher_host.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/in_process_webkit/indexed_db_dispatcher_host.h"
 
 #include "base/command_line.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/content_settings/host_content_settings_map.h"
 #include "chrome/browser/metrics/user_metrics.h"
@@ skipping 95 matching lines @@
     *thread = BrowserThread::WEBKIT;
 }
 
 bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message,
                                                 bool* message_was_ok) {
   if (IPC_MESSAGE_CLASS(message) != IndexedDBMsgStart)
     return false;
 
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
 
+  // TODO(dgrogan): The page cycler test can crash here because
+  // database_dispatcher_host_ becomes invalid.

[jorlow, 2011/03/15 02:30:04]

Add a bug number.

[dgrogan, 2011/03/16 22:00:12]

Will do.  I'm suddenly having a hard time reproducing (sigh).

   bool handled =
       database_dispatcher_host_->OnMessageReceived(message, message_was_ok) ||
       index_dispatcher_host_->OnMessageReceived(message, message_was_ok) ||
       object_store_dispatcher_host_->OnMessageReceived(
           message, message_was_ok) ||
       cursor_dispatcher_host_->OnMessageReceived(message, message_was_ok) ||
       transaction_dispatcher_host_->OnMessageReceived(message, message_was_ok);
 
   if (!handled) {
     handled = true;
@@ skipping 920 matching lines @@
   if (!idb_transaction)
     return;
 
   idb_transaction->didCompleteTaskEvents();
 }
 
 void IndexedDBDispatcherHost::TransactionDispatcherHost::OnDestroyed(
     int32 object_id) {
   parent_->DestroyObject(&map_, object_id);
 }