The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/19718b6edfa63c8c0fb20745d87cbb5787a15284

commit 19718b6edfa63c8c0fb20745d87cbb5787a15284
Author: Victor Costan <pwnall@chromium.org>
Date: Fri May 19 01:50:47 2017

Clean up the renderer side of the IDBCursor.continue() path.

BUG= 724109 

Change-Id: I31b8442e4fef5f48d9c7cdd0f7fe53715f70298d
Reviewed-on: https://chromium-review.googlesource.com/508123
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Commit-Queue: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#473026}
[modify] https://crrev.com/19718b6edfa63c8c0fb20745d87cbb5787a15284/content/child/indexed_db/webidbcursor_impl.cc
[modify] https://crrev.com/19718b6edfa63c8c0fb20745d87cbb5787a15284/content/child/indexed_db/webidbcursor_impl.h
[modify] https://crrev.com/19718b6edfa63c8c0fb20745d87cbb5787a15284/content/child/indexed_db/webidbcursor_impl_unittest.cc
[modify] https://crrev.com/19718b6edfa63c8c0fb20745d87cbb5787a15284/third_party/WebKit/Source/modules/indexeddb/IDBCursor.cpp
[modify] https://crrev.com/19718b6edfa63c8c0fb20745d87cbb5787a15284/third_party/WebKit/public/platform/modules/indexeddb/WebIDBCursor.h

This turned out not to be relevant to the bug, but here's the path taken by IDBCursor.continue().

IDBCursor::continueFunction
-> IDBCursor::Continue
-> WebIDBCursorImpl::ContinueFunction
-> WebIDBCursorImpl::IOThreadHelper::Continue
-> Cursor::Continue (in indexed_db.mojom)
-> CursorImpl::Continue
-> CursorImpl::IDBThreadHelper::Continue
-> IndexedDBCursor::Continue
-> IndexedDBCursor::CursorIterationOperation
-> IndexedDBBackingStore::Cursor::Continue
+> IndexedDBCallbacks::OnSuccess
-> IndexedDBCallbacks::IOThreadHelper::SendSuccessCursorContinue
-> IndexedDBCallbacks::IOThreadHelper::CreateAllBlobs
   -> IndexedDBCallbacks::IOThreadHelper::CreateBlobData
        - used to populate the uuid of ReturnValue::Value
      -> ShareableFileReference::Get
      +> ShareableFileReference::GetOrCreate
         -> ShareableFileReference::GetOrCreate(ScopedFile)
      +> IndexedDBDispatcherHost::HoldBlobData
      -> base::GenerateGUID
           - creates a new UUID for files in the IDB backing store
           - this is the UUID that ends up in ReturnValue::Value
      +> BlobDataBuilder::BlobDataBuilder
      +> BlobDataBuilder::AppendFile
      +> BlobStorageContext::AddFinishedBlob
+> Callbacks::SuccessCursorContinue (in indexed_db.mojom)
-> IndexedDBCallbacksImpl::SuccessCursorContinue
-> IndexedDBCallbacksImpl::InternalState::SuccessCursorContinue
-> IndexedDBCallbacksImpl::ConvertValue
     - copies everything, including uuid
+> WebIDBCallbacksImpl::OnSuccess(WebIDBKey, WebIDBKey, WebIDBValue)
-> IDBValue::Create
+> IDBRequest::EnqueueResponse

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8ac79a0a4825252d1eb801526ffc45f2ff4ba1a4

commit 8ac79a0a4825252d1eb801526ffc45f2ff4ba1a4
Author: Victor Costan <pwnall@chromium.org>
Date: Fri May 19 21:00:08 2017

Unregister IndexedDB requests from transactions before firing events.

Currently, an IDBRequest is unregistered from its IDBTransaction right
after the (most likely "success") event is fired. This is problematic
for cursor-opening requests, because the event handler can call
IDBCursor.continue() or IDBCursor.advance() on the opened cursor, which
reuses the cursor-opening request. This situation causes the request to
be re-registered with the transaction before it is unregistered.

BUG= 724109 

Change-Id: Ief60bdb0a98198d60c93282226b705753d15d418
Reviewed-on: https://chromium-review.googlesource.com/509150
Commit-Queue: Victor Costan <pwnall@chromium.org>
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#473309}
[modify] https://crrev.com/8ac79a0a4825252d1eb801526ffc45f2ff4ba1a4/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
[modify] https://crrev.com/8ac79a0a4825252d1eb801526ffc45f2ff4ba1a4/third_party/WebKit/Source/modules/indexeddb/IDBRequest.h
[modify] https://crrev.com/8ac79a0a4825252d1eb801526ffc45f2ff4ba1a4/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp
[modify] https://crrev.com/8ac79a0a4825252d1eb801526ffc45f2ff4ba1a4/third_party/WebKit/Source/modules/indexeddb/WebIDBCallbacksImpl.cpp