Merge 104252 - Source/WebCore: IndexedDB: fix cursor prefetch crash

Source/WebCore/storage/IDBCursorBackendImpl.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 29 matching lines @@
 #include "SerializedScriptValue.h"
 
 namespace WebCore {
 
 IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor> cursor, IDBCursor::Direction direction, CursorType cursorType, IDBTransactionBackendInterface* transaction, IDBObjectStoreBackendInterface* objectStore)
     : m_cursor(cursor)
     , m_direction(direction)
     , m_cursorType(cursorType)
     , m_transaction(transaction)
     , m_objectStore(objectStore)
+    , m_closed(false)
 {
     m_transaction->registerOpenCursor(this);
 }
 
 IDBCursorBackendImpl::~IDBCursorBackendImpl()
 {
     m_transaction->unregisterOpenCursor(this);
+    // Order is important, the cursors have to be destructed before the objectStore.
+    m_cursor.clear();
+    m_savedCursor.clear();
+
+    m_objectStore.clear();
 }
 
 unsigned short IDBCursorBackendImpl::direction() const
 {
     return m_direction;
 }
 
 PassRefPtr<IDBKey> IDBCursorBackendImpl::key() const
 {
     return m_cursor->key();
@@ skipping 100 matching lines @@
     cursor->m_transaction->addPendingEvents(foundKeys.size() - 1);
     callbacks->onSuccessWithPrefetch(foundKeys, foundPrimaryKeys, foundValues);
 }
 
 void IDBCursorBackendImpl::prefetchReset(int usedPrefetches, int unusedPrefetches)
 {
     m_transaction->addPendingEvents(-unusedPrefetches);
     m_cursor = m_savedCursor;
     m_savedCursor = 0;
 
+    if (m_closed)
+        return;
     if (m_cursor) {
         for (int i = 0; i < usedPrefetches; ++i) {
             bool ok = m_cursor->continueFunction();
             ASSERT_UNUSED(ok, ok);
         }
     }
 }
 
 void IDBCursorBackendImpl::close()
 {
+    m_closed = true;
     if (m_cursor)
         m_cursor->close();
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)