Add IndexedDB browser test that causes a crash.

chrome/test/data/indexeddb/database_callbacks_first.html

Index: chrome/test/data/indexeddb/database_callbacks_first.html
diff --git a/chrome/test/data/indexeddb/database_callbacks_first.html b/chrome/test/data/indexeddb/database_callbacks_first.html
new file mode 100644
index 0000000000000000000000000000000000000000..41aeac786c6140f50eaf5de7a6f254981df915e5
--- /dev/null
+++ b/chrome/test/data/indexeddb/database_callbacks_first.html
@@ -0,0 +1,8 @@
+<script>
+  webkitIndexedDB.open().onsuccess = function () {
+    setTimeout(function() {

[Paweł Hajdan Jr., 2011/03/15 19:49:11]

Is setTimeout really needed here? If yes, could you add comments why? Similarly
about gc().

[jorlow, 2011/03/15 20:25:46]

The gc is...and it makes it more deterministic, so I'm not sure why you're
concerned about that.

the setTimeout should be given a param of 0 however.  And yeah, is it needed? 
(Pawel, such a timeout is deterministic however, so you shouldn't be concerned
from a flake perspective.)

[dgrogan, 2011/03/15 20:49:07]

Yeah, I'll comment these.

I think setTimeout makes the IDBRequest returned by webkitIndexedDB.open()
available to the garbage collector.

The IDBRequest needs to be gone because it has a reference to the IDBDatabase
connection object that would prevent it (IDBDatabase object) from being
destroyed on stopActiveDOMObjects.

I'll do some testing to make sure this is actually the case.

[Paweł Hajdan Jr., 2011/03/16 14:53:09]

I still consider even setTimeout with 0 somewhat problematic. For example, my
understanding is that in an onload handler, without setTimeout the function is
guaranteed to finish running before the page load finishes. With setTimeout,
even with 0 timeout, I think it isn't. Please correct me if I'm wrong.

Also, could you explain more why we need to make it more deterministic via gc()?
I think I remember some differences between gc being run one or twice (the
latter being more thorough), so that's also a bit suspicious for me (again, I'm
not familiar with the specifics here).

[dgrogan, 2011/03/16 22:00:12]

I don't know if you're right or wrong, but I think it doesn't matter in this
case because the function isn't being called in an onload handler, it's being
called when the database connection is established.
We're using gc so that the garbage collector will call IDBRequest's destructor. 
The js in the next patch set is cleaner and commented.

The specifics:
This test is being used to test a fix for a crash.  The crash occurred when
stopActiveDOMObjects was called and the only thing holding a RefPtr to
IDBDatabase was the chrome indexeddb message dispatcher.

Here, idbRequest has a reference to IDBDatabase in its 'result' property, so to
reproduce the crash conditions we need to delete the webcore object underlying
idbRequest.  Otherwise the message dispatcher would not be the lone referrer to
IDBDatabase.

Without setTimeout, window.event (and potentially other things) have a reference
to idbRequest that prevents it from being garbage collected.  I say potentially
other things because, e.g., setting window.event = 0 doesn't make idbEvent
available for garbage collection.  Using setTimeout is the only thing I've found
that works, but I'm no javascript expert.  Suggestions welcome.

+      gc();
+      location.href = 'database_callbacks_second.html';
+    });
+  }
+</script>