[IndexedDB] Closing mojo connections when renderer quits

content/browser/indexed_db/cursor_impl.h

Index: content/browser/indexed_db/cursor_impl.h
diff --git a/content/browser/indexed_db/cursor_impl.h b/content/browser/indexed_db/cursor_impl.h
index 69254289cd27628972935caaf6d7bd1ea6c3acc8..9806765ad740831875594f54b120a2987abc24ff 100644
--- a/content/browser/indexed_db/cursor_impl.h
+++ b/content/browser/indexed_db/cursor_impl.h
@@ -11,7 +11,7 @@
 #include "content/common/indexed_db/indexed_db.mojom.h"
 
 namespace base {
-class SingleThreadTaskRunner;
+class SequencedTaskRunner;
 }
 
 namespace content {
@@ -20,11 +20,13 @@ class IndexedDBCursor;
 class IndexedDBDispatcherHost;
 class IndexedDBKey;
 
+// Expected to be constructed, called, and destructed on the IO thread.
 class CursorImpl : public ::indexed_db::mojom::Cursor {
  public:
   CursorImpl(std::unique_ptr<IndexedDBCursor> cursor,
              const url::Origin& origin,
-             scoped_refptr<IndexedDBDispatcherHost> dispatcher_host);
+             IndexedDBDispatcherHost* dispatcher_host,
+             scoped_refptr<base::SequencedTaskRunner> idb_runner);
   ~CursorImpl() override;
 
   // ::indexed_db::mojom::Cursor implementation
@@ -47,9 +49,11 @@ class CursorImpl : public ::indexed_db::mojom::Cursor {
   class IDBThreadHelper;
 
   IDBThreadHelper* helper_;
-  scoped_refptr<IndexedDBDispatcherHost> dispatcher_host_;
+  // This raw pointer is safe because all CursorImpl instances are owned by an
+  // IndexedDBDispatcherHost.
+  IndexedDBDispatcherHost* dispatcher_host_;
   const url::Origin origin_;
-  scoped_refptr<base::SingleThreadTaskRunner> idb_runner_;
+  scoped_refptr<base::SequencedTaskRunner> idb_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(CursorImpl);
 };