IndexedDB: Prevent terminated worker from hanging connections

Source/modules/indexeddb/IDBTransaction.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 178 matching lines @@
 
 void IDBTransaction::abort(ExceptionState& exceptionState)
 {
     if (m_state == Finishing || m_state == Finished) {
         exceptionState.throwDOMException(InvalidStateError, IDBDatabase::transactionFinishedErrorMessage);
         return;
     }
 
     m_state = Finishing;
 
-    if (!m_contextStopped) {
-        while (!m_requestList.isEmpty()) {
-            RefPtr<IDBRequest> request = *m_requestList.begin();
-            m_requestList.remove(request);
-            request->abort();
-        }
+    if (m_contextStopped)
+        return;
+
+    while (!m_requestList.isEmpty()) {
+        RefPtr<IDBRequest> request = *m_requestList.begin();
+        m_requestList.remove(request);
+        request->abort();
     }
 
     RefPtr<IDBTransaction> selfRef = this;
     backendDB()->abort(m_id);
 }
 
 void IDBTransaction::registerRequest(IDBRequest* request)
 {
     ASSERT(request);
     ASSERT(m_state == Active);
     m_requestList.add(request);
 }
 
 void IDBTransaction::unregisterRequest(IDBRequest* request)
 {
     ASSERT(request);
     // If we aborted the request, it will already have been removed.
     m_requestList.remove(request);
 }
 
 void IDBTransaction::onAbort(PassRefPtr<DOMError> prpError)
 {
     IDB_TRACE("IDBTransaction::onAbort");
+    if (m_contextStopped) {
+        RefPtr<IDBTransaction> protect(this);
+        m_database->transactionFinished(this);
+        return;
+    }
+
     RefPtr<DOMError> error = prpError;
     ASSERT(m_state != Finished);
 
     if (m_state != Finishing) {
         ASSERT(error.get());
         setError(error.release());
 
         // Abort was not triggered by front-end, so outstanding requests must
         // be aborted now.
         while (!m_requestList.isEmpty()) {
@@ skipping 16 matching lines @@
     enqueueEvent(Event::createBubble(EventTypeNames::abort));
 
     // If script has stopped and GC has completed, database may have last reference to this object.
     RefPtr<IDBTransaction> protect(this);
     m_database->transactionFinished(this);
 }
 
 void IDBTransaction::onComplete()
 {
     IDB_TRACE("IDBTransaction::onComplete");
+    if (m_contextStopped) {
+        RefPtr<IDBTransaction> protect(this);
+        m_database->transactionFinished(this);
+        return;
+    }
+
     ASSERT(m_state != Finished);
     m_state = Finishing;
     m_objectStoreCleanupMap.clear();
 
     // Enqueue events before notifying database, as database may close which enqueues more events and order matters.
     enqueueEvent(Event::create(EventTypeNames::complete));
 
     // If script has stopped and GC has completed, database may have last reference to this object.
     RefPtr<IDBTransaction> protect(this);
     m_database->transactionFinished(this);
@@ skipping 103 matching lines @@
     event->setTarget(this);
     eventQueue->enqueueEvent(event);
 }
 
 blink::WebIDBDatabase* IDBTransaction::backendDB() const
 {
     return m_database->backend();
 }
 
 } // namespace WebCore