Port messages sent by WebIDBFactoryImpl to Mojo.

third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp

Index: third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
index 98a496d4aa758f8f43343b3513516115990c90ab..ea832a61bd7829d8d877ca5ea69611d0da677ad5 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
@@ -42,6 +42,7 @@
 #include "modules/indexeddb/IDBEventDispatcher.h"
 #include "modules/indexeddb/IDBTracing.h"
 #include "modules/indexeddb/IDBValue.h"
+#include "modules/indexeddb/WebIDBCallbacksImpl.h"
 #include "platform/SharedBuffer.h"
 #include "public/platform/WebBlobInfo.h"
 #include <memory>
@@ -132,6 +133,19 @@ const String& IDBRequest::readyState() const {
   return IndexedDBNames::done;
 }
 
+std::unique_ptr<WebIDBCallbacks> IDBRequest::createWebCallbacks() {
+  DCHECK(!m_webCallbacks);
+  std::unique_ptr<WebIDBCallbacks> callbacks =
+      WebIDBCallbacksImpl::create(this);
+  m_webCallbacks = callbacks.get();
+  return callbacks;
+}
+
+void IDBRequest::webCallbacksDestroyed() {
+  DCHECK(m_webCallbacks);
+  m_webCallbacks = nullptr;

[haraken, 2016/10/18 19:01:29]

Don't we need to call m_webCallbacks->detach()?

Just to confirm: Why do we need to call webCallbacksDestroyed() when the context
gets detached? I just want to confirm that contextDestroyed() is a right timing
to call webCallbacksDestroyed().

[Reilly Grant (use Gerrit), 2016/10/19 00:36:51]

m_webCallbacks->detach() just clears the callback object's pointer back to this
object. Since we know the callback object is being destroyed here there's no
reason to tell it to clear a pointer that's about to be cleared anyways.
We call IDBRequest::webCallbacksDestroyed() so that IDBRequest doesn't call
WebIDBCallbacks::detach() after the WebIDBCallbacks has been destroyed. The
detach is the important part because it prevents IDBRequest from getting calls
after the execution context been destroyed because existing code in IDBRequest
assumes that getExecutionContext() will always return non-NULL. The call to
webCallbacksDestroyed() exists to prevent a use after free in the other
direction since these two objects can be destroyed in either order.

Note that all of this mess can go away when IDBRequest owns the
mojo::Binding<Callbacks> that WebIDBCallbacksImpl currently does and calls
Binding::reset() in both contextDestroyed() and its pre-finalizer.

+}
+
 void IDBRequest::abort() {
   DCHECK(!m_requestAborted);
   if (m_contextStopped || !getExecutionContext())
@@ -397,6 +411,10 @@ void IDBRequest::contextDestroyed() {
     m_result->contextWillBeDestroyed();
   if (m_pendingCursor)
     m_pendingCursor->contextWillBeDestroyed();
+  if (m_webCallbacks) {
+    m_webCallbacks->detach();
+    m_webCallbacks = nullptr;
+  }
 }
 
 const AtomicString& IDBRequest::interfaceName() const {