IndexedDB: Fix null ptr crash in IDBCursor::value().

third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp

Index: third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp
index 3605b535c0cbd7889939a98cd10bbef4fc5e4af5..e376f6c21636cf081a3b1c7ff1a2ff1f68fe37c6 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp
@@ -321,7 +321,9 @@ ScriptValue IDBCursor::value(ScriptState* scriptState)
     IDBObjectStore* objectStore = effectiveObjectStore();
     const IDBObjectStoreMetadata& metadata = objectStore->metadata();
     IDBAny* value;
-    if (metadata.autoIncrement && !metadata.keyPath.isNull()) {
+    if (!m_value) {

[jsbell, 2015/09/28 17:11:28]

From code inspection, it looks like this can happen at the point where a cursor
has been run to the end of its range:

IDBRequest::onSuccess(PassRefPtr<IDBValue>) where the value is null and
m_pendingCursor is true. This calls IDBCursor::close().

Can we add a layout test?

+        value = IDBAny::createUndefined();
+    } else if (metadata.autoIncrement && !metadata.keyPath.isNull()) {
         RefPtr<IDBValue> idbValue = IDBValue::create(m_value.get(), m_primaryKey, metadata.keyPath);
 #if ENABLE(ASSERT)
         assertPrimaryKeyValidOrInjectable(scriptState, idbValue.get());