IndexedDB: Fix null ptr crash in IDBCursor::value().

third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 303 matching lines @@
     return ScriptValue::from(scriptState, m_primaryKey);
 }
 
 ScriptValue IDBCursor::value(ScriptState* scriptState)
 {
     ASSERT(isCursorWithValue());
 
     IDBObjectStore* objectStore = effectiveObjectStore();
     const IDBObjectStoreMetadata& metadata = objectStore->metadata();
     IDBAny* value;
-    if (metadata.autoIncrement && !metadata.keyPath.isNull()) {
+    if (!m_value) {

[jsbell, 2015/09/28 17:11:28]

From code inspection, it looks like this can happen at the point where a cursor
has been run to the end of its range:

IDBRequest::onSuccess(PassRefPtr<IDBValue>) where the value is null and
m_pendingCursor is true. This calls IDBCursor::close().

Can we add a layout test?

+        value = IDBAny::createUndefined();
+    } else if (metadata.autoIncrement && !metadata.keyPath.isNull()) {
         RefPtr<IDBValue> idbValue = IDBValue::create(m_value.get(), m_primaryKey, metadata.keyPath);
 #if ENABLE(ASSERT)
         assertPrimaryKeyValidOrInjectable(scriptState, idbValue.get());
 #endif
         value = IDBAny::create(idbValue.release());
     } else {
         value = IDBAny::create(m_value);
     }
 
     m_valueDirty = false;
@@ skipping 66 matching lines @@
     case WebIDBCursorDirectionPrevNoDuplicate:
         return IndexedDBNames::prevunique;
 
     default:
         ASSERT_NOT_REACHED();
         return IndexedDBNames::next;
     }
 }
 
 } // namespace blink