Merge 104252 - Source/WebCore: IndexedDB: fix cursor prefetch crash

Source/WebCore/storage/IDBCursorBackendImpl.cpp

Index: Source/WebCore/storage/IDBCursorBackendImpl.cpp
===================================================================
--- Source/WebCore/storage/IDBCursorBackendImpl.cpp	(revision 104309)
+++ Source/WebCore/storage/IDBCursorBackendImpl.cpp	(working copy)
@@ -47,6 +47,7 @@
     , m_cursorType(cursorType)
     , m_transaction(transaction)
     , m_objectStore(objectStore)
+    , m_closed(false)
 {
     m_transaction->registerOpenCursor(this);
 }
@@ -54,6 +55,11 @@
 IDBCursorBackendImpl::~IDBCursorBackendImpl()
 {
     m_transaction->unregisterOpenCursor(this);
+    // Order is important, the cursors have to be destructed before the objectStore.
+    m_cursor.clear();
+    m_savedCursor.clear();
+
+    m_objectStore.clear();
 }
 
 unsigned short IDBCursorBackendImpl::direction() const
@@ -174,6 +180,8 @@
     m_cursor = m_savedCursor;
     m_savedCursor = 0;
 
+    if (m_closed)
+        return;
     if (m_cursor) {
         for (int i = 0; i < usedPrefetches; ++i) {
             bool ok = m_cursor->continueFunction();
@@ -184,6 +192,7 @@
 
 void IDBCursorBackendImpl::close()
 {
+    m_closed = true;
     if (m_cursor)
         m_cursor->close();
 }