Oilpan: IDBCursor should be detached from IDBRequest when the IDBRequest stops

Source/modules/indexeddb/IDBRequest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 351 matching lines @@
 }
 
 bool IDBRequest::hasPendingActivity() const
 {
     // FIXME: In an ideal world, we should return true as long as anyone has a or can
     //        get a handle to us and we have event listeners. This is order to handle
     //        user generated events properly.
     return m_hasPendingActivity && !m_contextStopped;
 }
 
+void IDBRequest::contextWillBeDestroyed()
+{
+    checkForReferenceCycle();

[haraken, 2014/04/01 05:56:14]

I need to reconsider what I should do here. Currently this code results in an
infinite loop in some layout tests.

[Mads Ager (chromium), 2014/04/01 11:38:38]

What we want to ensure in this call is that any cursors are detached from the
cursor backend before the dispatcher goes away.

All of these objects for this worker thread are going to die now, so as far as I
can tell, what you need to do here is m_backend.clear() on the IDBCursor object.

That will detach the IDBCursor from the backend while the dispatcher is still
alive. Then we will kill the dispatcher. Then we GC and that will kill these
objects which is now safe since we have detached from the backend before the
dispatcher got killed?

+}
+
 void IDBRequest::stop()
 {
     if (m_contextStopped)
         return;
 
     m_contextStopped = true;
     m_requestState.clear();
 
     RefPtr<IDBRequest> protect(this);
 
@@ skipping 139 matching lines @@
 
 void IDBRequest::dequeueEvent(Event* event)
 {
     for (size_t i = 0; i < m_enqueuedEvents.size(); ++i) {
         if (m_enqueuedEvents[i].get() == event)
             m_enqueuedEvents.remove(i);
     }
 }
 
 } // namespace WebCore