Merge 91571 - Fix crash in IDBRequest::abort

Source/WebCore/storage/IDBRequest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 48 matching lines @@
     , m_cursorType(IDBCursorBackendInterface::InvalidCursorType)
 {
     if (m_transaction) {
         m_transaction->registerRequest(this);
         IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
     }
 }
 
 IDBRequest::~IDBRequest()
 {
-    ASSERT(m_readyState == DONE || m_readyState == EarlyDeath);
+    ASSERT(m_readyState == DONE || m_readyState == EarlyDeath || !scriptExecutionContext());
     if (m_transaction)
         m_transaction->unregisterRequest(this);
 }
 
 PassRefPtr<IDBAny> IDBRequest::result(ExceptionCode& ec) const
 {
     if (m_readyState != DONE) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return 0;
     }
@@ skipping 62 matching lines @@
 {
     return m_source.get();
 }
 
 void IDBRequest::abort()
 {
     if (m_readyState != LOADING) {
         ASSERT(m_readyState == DONE);
         return;
     }
+    // FIXME: Remove isDocument check when
+    // https://bugs.webkit.org/show_bug.cgi?id=57789 is resolved.
+    if (!scriptExecutionContext() || !scriptExecutionContext()->isDocument())
+        return;
 
-    ASSERT(scriptExecutionContext()->isDocument());
     EventQueue* eventQueue = static_cast<Document*>(scriptExecutionContext())->eventQueue();
     for (size_t i = 0; i < m_enqueuedEvents.size(); ++i) {
         bool removed = eventQueue->cancelEvent(m_enqueuedEvents[i].get());
         ASSERT_UNUSED(removed, removed);
     }
     m_enqueuedEvents.clear();
 
     m_errorCode = 0;
     m_errorMessage = String();
     m_result.clear();
@@ skipping 161 matching lines @@
 }
 
 EventTargetData* IDBRequest::ensureEventTargetData()
 {
     return &m_eventTargetData;
 }
 
 } // namespace WebCore
 
 #endif