[IndexedDB] Hold referenced to IDB::put blobs in the IDBRequest

third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 223 matching lines @@
   DCHECK(ready_state_ == PENDING || ready_state_ == DONE);
   if (request_aborted_)
     return false;
   DCHECK_EQ(ready_state_, PENDING);
   DCHECK(!error_ && !result_);
   return true;
 }
 
 void IDBRequest::OnError(DOMException* error) {
   IDB_TRACE("IDBRequest::onError()");
+  ClearTransitBlobHandles();
   if (!ShouldEnqueueEvent())
     return;
 
   error_ = error;
   SetResult(IDBAny::CreateUndefined());
   pending_cursor_.Clear();
   EnqueueEvent(Event::CreateCancelableBubble(EventTypeNames::error));
 }
 
 void IDBRequest::OnSuccess(const Vector<String>& string_list) {
@@ skipping 28 matching lines @@
                                      this, source_.Get(), transaction_.Get());
       break;
     default:
       NOTREACHED();
   }
   SetResultCursor(cursor, key, primary_key, std::move(value));
 }
 
 void IDBRequest::OnSuccess(IDBKey* idb_key) {
   IDB_TRACE("IDBRequest::onSuccess(IDBKey)");
+  ClearTransitBlobHandles();

[michaeln, 2017/04/25 23:37:00]

There are many OnSuccess variants, no doubt this is the one that get's called
for Put(), maybe to ensure and make clear this method isn't needed for the other
variants, add a DCHECK(!transit_blobs) to OnSucessInternal.

[dmurph, 2017/04/27 22:04:12]

Done.

   if (!ShouldEnqueueEvent())
     return;
 
   if (idb_key && idb_key->IsValid())
     OnSuccessInternal(IDBAny::Create(idb_key));
   else
     OnSuccessInternal(IDBAny::CreateUndefined());
 }
 
 void IDBRequest::OnSuccess(const Vector<RefPtr<IDBValue>>& values) {
@@ skipping 251 matching lines @@
 }
 
 void IDBRequest::DequeueEvent(Event* event) {
   for (size_t i = 0; i < enqueued_events_.size(); ++i) {
     if (enqueued_events_[i].Get() == event)
       enqueued_events_.erase(i);
   }
 }
 
 }  // namespace blink