Code: void IndexedDBCursor::RemoveCursorFromTransaction() {
  if (transaction_)
    transaction_->UnregisterOpenCursor(this);
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Commit Message: [IndexedDB] Fix Cursor UAF

If the connection is closed before we return a cursor, it dies in
IndexedDBCallbacks::IOThreadHelper::SendSuccessCursor. It's deleted on
the correct thread, but we also need to makes sure to remove it from its
transaction.

To make things simpler, we have the cursor remove itself from its
transaction on destruction.

R: pwnall@chromium.org
Bug: 728887
Change-Id: I8c76e6195c2490137a05213e47c635d12f4d3dd2
Reviewed-on: https://chromium-review.googlesource.com/526284
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#477504}