IndexedDB: Fix cursor prefetching edge cases

content/child/indexed_db/webidbcursor_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/indexed_db/webidbcursor_impl.h"
 
 #include <vector>
 
 #include "content/child/indexed_db/indexed_db_dispatcher.h"
 #include "content/child/indexed_db/indexed_db_key_builders.h"
@@ skipping 143 matching lines @@
   IndexedDBKey primary_key = prefetch_primary_keys_.front();
   WebData value = prefetch_values_.front();
 
   prefetch_keys_.pop_front();
   prefetch_primary_keys_.pop_front();
   prefetch_values_.pop_front();
   ++used_prefetches_;
 
   ++pending_onsuccess_callbacks_;
 
+  if (!continue_count_) {
+    // The cache was invalidated by a call to ResetPrefetchCache()
+    // after the RequestIDBCursorPrefetch() was made. Now that the
+    // initiating continue() call has been satisfied, discard
+    // the rest of the cache.
+    ResetPrefetchCache();
+  }
+
   callbacks->onSuccess(WebIDBKeyBuilder::Build(key),
                        WebIDBKeyBuilder::Build(primary_key),
                        value);
 }
 
 void WebIDBCursorImpl::ResetPrefetchCache() {
   continue_count_ = 0;
   prefetch_amount_ = kMinPrefetchAmount;
 
   if (!prefetch_keys_.size()) {
     // No prefetch cache, so no need to reset the cursor in the back-end.
     return;
   }
 
   IndexedDBDispatcher* dispatcher =
       IndexedDBDispatcher::ThreadSpecificInstance(thread_safe_sender_.get());
   dispatcher->RequestIDBCursorPrefetchReset(
       used_prefetches_, prefetch_keys_.size(), ipc_cursor_id_);
   prefetch_keys_.clear();
   prefetch_primary_keys_.clear();
   prefetch_values_.clear();
 
   pending_onsuccess_callbacks_ = 0;
 }
 
 }  // namespace content