Merge 112740 - IndexedDB: Race condition causes version change transaction to commit after onblocked

Source/WebCore/Modules/indexeddb/IDBRequest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 360 matching lines @@
     ASSERT(event->type() == eventNames().successEvent || event->type() == eventNames().errorEvent || event->type() == eventNames().blockedEvent);
     bool dontPreventDefault = IDBEventDispatcher::dispatch(event.get(), targets);
 
     // If the result was of type IDBCursor, or a onBlocked event, then we'll fire again.
     if (event->type() != eventNames().blockedEvent && (!cursorToNotify || m_cursorFinished))
         m_requestFinished = true;
 
     if (cursorToNotify)
         cursorToNotify->postSuccessHandlerCallback();
 
-    if (m_transaction) {
+    if (m_transaction && event->type() != eventNames().blockedEvent) {
         // If an error event and the default wasn't prevented...
         if (dontPreventDefault && event->type() == eventNames().errorEvent)
             m_transaction->backend()->abort();
         m_transaction->backend()->didCompleteTaskEvents();
     }
     return dontPreventDefault;
 }
 
 void IDBRequest::uncaughtExceptionInEventHandler()
 {
@@ skipping 33 matching lines @@
         m_result = IDBAny::create(prpCursor);
         return;
     }
 
     m_result = IDBAny::create(IDBCursorWithValue::fromCursor(prpCursor));
 }
 
 } // namespace WebCore
 
 #endif