[IndexedDB] Fix RequestComplete() reentry UAF

Destroying an ConnectionRequest can cause the IndexedDBDatabase to
destruct through ConnectionClosed(). This can cause a UAF in
RequestComplete(). This change creates a WeakPtr there that can be
checked before continuing.


Bug: 966762
Change-Id: Ieda327d36390d6941771475725415e2ae65f336d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1629171
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#663344}
1 file changed