Implements initial plumbing for IDBCursor.

This is the Chromium side of https://bugs.webkit.org/show_bug.cgi?id=41888
It's almost purely plumbing: actual logic and cursor implementation will follow soon.

Review URL: http://codereview.chromium.org/2918002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55693 0039d316-1c4b-4281-b951-d872f2087c98

16 files changed, 409 insertions, 12 deletions

diff --git a/chrome/browser/in_process_webkit/indexed_db_callbacks.h b/chrome/browser/in_process_webkit/indexed_db_callbacks.h
index 2bb6b2a..5421fc6 100644
--- a/chrome/browser/in_process_webkit/indexed_db_callbacks.h
+++ b/chrome/browser/in_process_webkit/indexed_db_callbacks.h
@@ -14,6 +14,7 @@
 #include "chrome/common/render_messages.h"
 #include "chrome/common/serialized_script_value.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBCallbacks.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBCursor.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabaseError.h"
 
 // Template magic to figure out what message to send to the renderer based on
@@ -73,6 +74,31 @@ class IndexedDBCallbacks : public IndexedDBCallbacksBase {
   DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBCallbacks);
 };
 
+// WebIDBCursor uses onSuccess(WebIDBCursor*) to indicate it has data, and
+// onSuccess() without params to indicate it does not contain any data, i.e.,
+// there is no key within the key range, or it has reached the end.
+template <>
+class IndexedDBCallbacks<WebKit::WebIDBCursor>
+    : public IndexedDBCallbacksBase {
+ public:
+  IndexedDBCallbacks(
+      IndexedDBDispatcherHost* dispatcher_host, int32 response_id)
+      : IndexedDBCallbacksBase(dispatcher_host, response_id) { }
+
+  virtual void onSuccess(WebKit::WebIDBCursor* idb_object) {
+    int32 object_id = dispatcher_host()->Add(idb_object);
+    dispatcher_host()->Send(
+        new ViewMsg_IDBCallbackSuccessOpenCursor(response_id(), object_id));
+  }
+
+  virtual void onSuccess() {
+    dispatcher_host()->Send(new ViewMsg_IDBCallbacksSuccessNull(response_id()));
+  }
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBCallbacks);
+};
+
 // WebIDBKey is implemented in WebKit as opposed to being an interface Chromium
 // implements.  Thus we pass a const ___& version and thus we need this
 // specialization.
diff --git a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc
index 3fd0714..9603530 100644
--- a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc
+++ b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc
@@ -13,18 +13,22 @@
 #include "chrome/common/render_messages.h"
 #include "chrome/common/serialized_script_value.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebDOMStringList.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBCursor.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabase.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabaseError.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBKeyRange.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBIndex.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBFactory.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBObjectStore.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebSecurityOrigin.h"
 
 using WebKit::WebDOMStringList;
+using WebKit::WebIDBCursor;
 using WebKit::WebIDBDatabase;
 using WebKit::WebIDBDatabaseError;
 using WebKit::WebIDBIndex;
 using WebKit::WebIDBKey;
+using WebKit::WebIDBKeyRange;
 using WebKit::WebIDBObjectStore;
 using WebKit::WebSecurityOrigin;
 using WebKit::WebSerializedScriptValue;
@@ -39,6 +43,8 @@ IndexedDBDispatcherHost::IndexedDBDispatcherHost(
           new IndexDispatcherHost(this))),
       ALLOW_THIS_IN_INITIALIZER_LIST(object_store_dispatcher_host_(
           new ObjectStoreDispatcherHost(this))),
+      ALLOW_THIS_IN_INITIALIZER_LIST(cursor_dispatcher_host_(
+          new CursorDispatcherHost(this))),
       process_handle_(0) {
   DCHECK(sender_);
   DCHECK(webkit_context_.get());
@@ -81,6 +87,10 @@ bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message) {
   DCHECK(process_handle_);
 
   switch (message.type()) {
+    case ViewHostMsg_IDBCursorDestroyed::ID:
+    case ViewHostMsg_IDBCursorDirection::ID:
+    case ViewHostMsg_IDBCursorKey::ID:
+    case ViewHostMsg_IDBCursorValue::ID:
     case ViewHostMsg_IDBFactoryOpen::ID:
     case ViewHostMsg_IDBDatabaseName::ID:
     case ViewHostMsg_IDBDatabaseDescription::ID:
@@ -98,6 +108,7 @@ bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message) {
     case ViewHostMsg_IDBObjectStoreKeyPath::ID:
     case ViewHostMsg_IDBObjectStoreIndexNames::ID:
     case ViewHostMsg_IDBObjectStoreGet::ID:
+    case ViewHostMsg_IDBObjectStoreOpenCursor::ID:
     case ViewHostMsg_IDBObjectStorePut::ID:
     case ViewHostMsg_IDBObjectStoreRemove::ID:
     case ViewHostMsg_IDBObjectStoreCreateIndex::ID:
@@ -147,7 +158,8 @@ void IndexedDBDispatcherHost::OnMessageReceivedWebKit(
   bool handled =
       database_dispatcher_host_->OnMessageReceived(message, &msg_is_ok) ||
       index_dispatcher_host_->OnMessageReceived(message, &msg_is_ok) ||
-      object_store_dispatcher_host_->OnMessageReceived(message, &msg_is_ok);
+      object_store_dispatcher_host_->OnMessageReceived(message, &msg_is_ok) ||
+      cursor_dispatcher_host_->OnMessageReceived(message, &msg_is_ok);
 
   if (!handled) {
     handled = true;
@@ -166,6 +178,10 @@ void IndexedDBDispatcherHost::OnMessageReceivedWebKit(
   }
 }
 
+int32 IndexedDBDispatcherHost::Add(WebIDBCursor* idb_cursor) {
+  return cursor_dispatcher_host_->map_.Add(idb_cursor);
+}
+
 int32 IndexedDBDispatcherHost::Add(WebIDBDatabase* idb_database) {
   return database_dispatcher_host_->map_.Add(idb_database);
 }
@@ -570,3 +586,99 @@ void IndexedDBDispatcherHost::ObjectStoreDispatcherHost::OnDestroyed(
   parent_->DestroyObject(
       &map_, object_id, ViewHostMsg_IDBObjectStoreDestroyed::ID);
 }
+
+//////////////////////////////////////////////////////////////////////
+// IndexedDBDispatcherHost::CursorDispatcherHost
+//
+
+IndexedDBDispatcherHost::CursorDispatcherHost::CursorDispatcherHost(
+    IndexedDBDispatcherHost* parent)
+    : parent_(parent) {
+}
+
+IndexedDBDispatcherHost::CursorDispatcherHost::~CursorDispatcherHost() {
+}
+
+bool IndexedDBDispatcherHost::CursorDispatcherHost::OnMessageReceived(
+    const IPC::Message& message, bool* msg_is_ok) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP_EX(IndexedDBDispatcherHost::CursorDispatcherHost,
+                           message, *msg_is_ok)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_IDBObjectStoreOpenCursor, OnOpenCursor)
+    IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_IDBCursorDirection,
+                                    OnDirection)
+    IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_IDBCursorKey, OnKey)
+    IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_IDBCursorValue, OnValue)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_IDBCursorDestroyed, OnDestroyed)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+void IndexedDBDispatcherHost::CursorDispatcherHost::Send(
+    IPC::Message* message) {
+  // The macro magic in OnMessageReceived requires this to link, but it should
+  // never actually be called.
+  NOTREACHED();
+  parent_->Send(message);
+}
+
+void IndexedDBDispatcherHost::CursorDispatcherHost::OnOpenCursor(
+    const ViewHostMsg_IDBObjectStoreOpenCursor_Params& params) {
+  DCHECK(ChromeThread::CurrentlyOn(ChromeThread::WEBKIT));
+  WebIDBObjectStore* idb_object_store = parent_->GetOrTerminateProcess(
+      &parent_->object_store_dispatcher_host_->map_,
+      params.idb_object_store_id_, NULL,
+      ViewHostMsg_IDBObjectStoreOpenCursor::ID);
+  if (!idb_object_store)
+    return;
+  idb_object_store->openCursor(
+      WebIDBKeyRange(params.left_key_, params.right_key_, params.flags_),
+      params.direction_,
+      new IndexedDBCallbacks<WebIDBCursor>(parent_, params.response_id_));
+}
+
+void IndexedDBDispatcherHost::CursorDispatcherHost::OnDirection(
+    int32 object_id, IPC::Message* reply_msg) {
+  WebIDBCursor* idb_cursor = parent_->GetOrTerminateProcess(
+      &map_, object_id, reply_msg,
+      ViewHostMsg_IDBCursorDirection::ID);
+  if (!idb_cursor)
+    return;
+
+  int direction = idb_cursor->direction();
+  ViewHostMsg_IDBCursorDirection::WriteReplyParams(reply_msg, direction);
+  parent_->Send(reply_msg);
+}
+
+void IndexedDBDispatcherHost::CursorDispatcherHost::OnKey(
+    int32 object_id, IPC::Message* reply_msg) {
+  WebIDBCursor* idb_cursor = parent_->GetOrTerminateProcess(
+      &map_, object_id, reply_msg,
+      ViewHostMsg_IDBCursorKey::ID);
+  if (!idb_cursor)
+    return;
+
+  IndexedDBKey key(idb_cursor->key());
+  ViewHostMsg_IDBCursorKey::WriteReplyParams(reply_msg, key);
+  parent_->Send(reply_msg);
+}
+
+void IndexedDBDispatcherHost::CursorDispatcherHost::OnValue(
+    int32 object_id, IPC::Message* reply_msg) {
+  WebIDBCursor* idb_cursor = parent_->GetOrTerminateProcess(
+      &map_, object_id, reply_msg,
+      ViewHostMsg_IDBCursorValue::ID);
+  if (!idb_cursor)
+    return;
+
+  SerializedScriptValue value(idb_cursor->value());
+  ViewHostMsg_IDBCursorValue::WriteReplyParams(reply_msg, value);
+  parent_->Send(reply_msg);
+}
+
+void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
+    int32 object_id) {
+  parent_->DestroyObject(
+      &map_, object_id, ViewHostMsg_IDBCursorDestroyed::ID);
+}
diff --git a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h
index 436b547..ff0fad2 100644
--- a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h
+++ b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h
@@ -18,8 +18,10 @@ class SerializedScriptValue;
 struct ViewHostMsg_IDBDatabaseCreateObjectStore_Params;
 struct ViewHostMsg_IDBFactoryOpen_Params;
 struct ViewHostMsg_IDBObjectStoreCreateIndex_Params;
+struct ViewHostMsg_IDBObjectStoreOpenCursor_Params;
 
 namespace WebKit {
+class WebIDBCursor;
 class WebIDBDatabase;
 class WebIDBIndex;
 class WebIDBObjectStore;
@@ -54,6 +56,7 @@ class IndexedDBDispatcherHost
 
   // The various IndexedDBCallbacks children call these methods to add the
   // results into the applicable map.  See below for more details.
+  int32 Add(WebKit::WebIDBCursor* idb_cursor);
   int32 Add(WebKit::WebIDBDatabase* idb_database);
   int32 Add(WebKit::WebIDBIndex* idb_index);
   int32 Add(WebKit::WebIDBObjectStore* idb_object_store);
@@ -152,6 +155,25 @@ class IndexedDBDispatcherHost
     IndexedDBDispatcherHost* parent_;
     IDMap<WebKit::WebIDBObjectStore, IDMapOwnPointer> map_;
   };
+
+  class CursorDispatcherHost {
+   public:
+    explicit CursorDispatcherHost(IndexedDBDispatcherHost* parent);
+    ~CursorDispatcherHost();
+
+    bool OnMessageReceived(const IPC::Message& message, bool *msg_is_ok);
+    void Send(IPC::Message* message);
+
+    void OnOpenCursor(
+        const ViewHostMsg_IDBObjectStoreOpenCursor_Params& params);
+    void OnDirection(int32 idb_object_store_id, IPC::Message* reply_msg);
+    void OnKey(int32 idb_object_store_id, IPC::Message* reply_msg);
+    void OnValue(int32 idb_object_store_id, IPC::Message* reply_msg);
+    void OnDestroyed(int32 idb_cursor_id);
+
+    IndexedDBDispatcherHost* parent_;
+    IDMap<WebKit::WebIDBCursor, IDMapOwnPointer> map_;
+  };
   // Only use on the IO thread.
   IPC::Message::Sender* sender_;
 
@@ -162,6 +184,7 @@ class IndexedDBDispatcherHost
   scoped_ptr<DatabaseDispatcherHost> database_dispatcher_host_;
   scoped_ptr<IndexDispatcherHost> index_dispatcher_host_;
   scoped_ptr<ObjectStoreDispatcherHost> object_store_dispatcher_host_;
+  scoped_ptr<CursorDispatcherHost> cursor_dispatcher_host_;
 
   // If we get a corrupt message from a renderer, we need to kill it using this
   // handle.
diff --git a/chrome/chrome_renderer.gypi b/chrome/chrome_renderer.gypi
index c616afd..dc5beef 100644
--- a/chrome/chrome_renderer.gypi
+++ b/chrome/chrome_renderer.gypi
@@ -159,6 +159,8 @@
         'renderer/renderer_webapplicationcachehost_impl.h',
         'renderer/renderer_webcookiejar_impl.cc',
         'renderer/renderer_webcookiejar_impl.h',
+        'renderer/renderer_webidbcursor_impl.cc',
+        'renderer/renderer_webidbcursor_impl.h',
         'renderer/renderer_webidbdatabase_impl.cc',
         'renderer/renderer_webidbdatabase_impl.h',
         'renderer/renderer_webidbindex_impl.cc',
diff --git a/chrome/common/indexed_db_key.cc b/chrome/common/indexed_db_key.cc
index 31a9386..315e5b2 100644
--- a/chrome/common/indexed_db_key.cc
+++ b/chrome/common/indexed_db_key.cc
@@ -14,11 +14,8 @@ IndexedDBKey::IndexedDBKey()
       number_(0) {
 }
 
-IndexedDBKey::IndexedDBKey(const WebIDBKey& key)
-    : type_(key.type()),
-      string_(key.type() == WebIDBKey::StringType
-              ? static_cast<string16>(key.string()) : string16()),
-      number_(key.type() == WebIDBKey::NumberType ? key.number() : 0) {
+IndexedDBKey::IndexedDBKey(const WebIDBKey& key) {
+  Set(key);
 }
 
 void IndexedDBKey::SetNull() {
@@ -39,6 +36,13 @@ void IndexedDBKey::Set(int32_t number) {
   number_ = number;
 }
 
+void IndexedDBKey::Set(const WebIDBKey& key) {
+  type_ = key.type();
+  string_ = key.type() == WebIDBKey::StringType ?
+                static_cast<string16>(key.string()) : string16();
+  number_ = key.type() == WebIDBKey::NumberType ? key.number() : 0;
+}
+
 IndexedDBKey::operator WebIDBKey() const {
   switch (type_) {
     case WebIDBKey::NullType:
diff --git a/chrome/common/indexed_db_key.h b/chrome/common/indexed_db_key.h
index 9b0662a..41fb10b 100644
--- a/chrome/common/indexed_db_key.h
+++ b/chrome/common/indexed_db_key.h
@@ -19,6 +19,7 @@ class IndexedDBKey {
   void SetInvalid();
   void Set(const string16& string);
   void Set(int32_t number);
+  void Set(const WebKit::WebIDBKey& key);
 
   WebKit::WebIDBKey::Type type() const { return type_; }
   const string16& string() const { return string_; }
diff --git a/chrome/common/render_messages.h b/chrome/common/render_messages.h
index 02790e5..55e4044 100644
--- a/chrome/common/render_messages.h
+++ b/chrome/common/render_messages.h
@@ -651,6 +651,22 @@ struct ViewHostMsg_IDBObjectStoreCreateIndex_Params {
   int32 idb_object_store_id_;
 };
 
+// Used to open an IndexedDB cursor.
+struct ViewHostMsg_IDBObjectStoreOpenCursor_Params {
+  // The response should have this id.
+  int32 response_id_;
+  // The serialized left key.
+  IndexedDBKey left_key_;
+  // The serialized right key.
+  IndexedDBKey right_key_;
+  // The key flags.
+  int32 flags_;
+  // The direction of this cursor.
+  int32 direction_;
+  // The object store the index belongs to.
+  int32 idb_object_store_id_;
+};
+
 // Allows an extension to execute code in a tab.
 struct ViewMsg_ExecuteCode_Params {
   ViewMsg_ExecuteCode_Params() {}
@@ -2828,6 +2844,44 @@ struct ParamTraits<ViewHostMsg_IDBObjectStoreCreateIndex_Params> {
   }
 };
 
+// Traits for ViewHostMsg_IDBObjectStoreOpenCursor_Params.
+template <>
+struct ParamTraits<ViewHostMsg_IDBObjectStoreOpenCursor_Params> {
+  typedef ViewHostMsg_IDBObjectStoreOpenCursor_Params param_type;
+  static void Write(Message* m, const param_type& p) {
+    WriteParam(m, p.response_id_);
+    WriteParam(m, p.left_key_);
+    WriteParam(m, p.right_key_);
+    WriteParam(m, p.flags_);
+    WriteParam(m, p.direction_);
+    WriteParam(m, p.idb_object_store_id_);
+  }
+  static bool Read(const Message* m, void** iter, param_type* p) {
+    return
+        ReadParam(m, iter, &p->response_id_) &&
+        ReadParam(m, iter, &p->left_key_) &&
+        ReadParam(m, iter, &p->right_key_) &&
+        ReadParam(m, iter, &p->flags_) &&
+        ReadParam(m, iter, &p->direction_) &&
+        ReadParam(m, iter, &p->idb_object_store_id_);
+  }
+  static void Log(const param_type& p, std::wstring* l) {
+    l->append(L"(");
+    LogParam(p.response_id_, l);
+    l->append(L", ");
+    LogParam(p.left_key_, l);
+    l->append(L", ");
+    LogParam(p.right_key_, l);
+    l->append(L", ");
+    LogParam(p.flags_, l);
+    l->append(L", ");
+    LogParam(p.direction_, l);
+    l->append(L", ");
+    LogParam(p.idb_object_store_id_, l);
+    l->append(L")");
+  }
+};
+
 // Traits for ViewHostMsg_CreateWorker_Params
 template <>
 struct ParamTraits<ViewHostMsg_CreateWorker_Params> {
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index 95389c4..674cb4f 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -868,6 +868,9 @@ IPC_BEGIN_MESSAGES(View)
   IPC_MESSAGE_CONTROL2(ViewMsg_IDBCallbacksSuccessSerializedScriptValue,
                        int32 /* response_id */,
                        SerializedScriptValue /* serialized_script_value */)
+  IPC_MESSAGE_CONTROL2(ViewMsg_IDBCallbackSuccessOpenCursor,
+                       int32 /* response_id */,
+                       int32 /* cursor_id */)
   IPC_MESSAGE_CONTROL3(ViewMsg_IDBCallbacksError,
                        int32 /* response_id */,
                        int /* code */,
@@ -2230,6 +2233,21 @@ IPC_BEGIN_MESSAGES(ViewHost)
                               GURL /* url */,
                               bool /* something_cleared */)
 
+  // WebIDBCursor::direction() message.
+  IPC_SYNC_MESSAGE_CONTROL1_1(ViewHostMsg_IDBCursorDirection,
+                              int32, /* idb_cursor_id */
+                              int32 /* direction */)
+
+  // WebIDBCursor::key() message.
+  IPC_SYNC_MESSAGE_CONTROL1_1(ViewHostMsg_IDBCursorKey,
+                              int32, /* idb_cursor_id */
+                              IndexedDBKey)
+
+  // WebIDBCursor::value() message.
+  IPC_SYNC_MESSAGE_CONTROL1_1(ViewHostMsg_IDBCursorValue,
+                              int32, /* idb_cursor_id */
+                              SerializedScriptValue)
+
   // WebIDBFactory::open() message.
   IPC_MESSAGE_CONTROL1(ViewHostMsg_IDBFactoryOpen,
                        ViewHostMsg_IDBFactoryOpen_Params)
@@ -2347,10 +2365,18 @@ IPC_BEGIN_MESSAGES(ViewHost)
                        int32, /* response_id */
                        string16 /* name */)
 
+   // WebIDBObjectStore::openCursor() message.
+   IPC_MESSAGE_CONTROL1(ViewHostMsg_IDBObjectStoreOpenCursor,
+                        ViewHostMsg_IDBObjectStoreOpenCursor_Params)
+
   // WebIDBObjectStore::~WebIDBObjectStore() message.
   IPC_MESSAGE_CONTROL1(ViewHostMsg_IDBObjectStoreDestroyed,
                        int32 /* idb_object_store_id */)
 
+  // WebIDBDatabase::~WebIDBCursor() message.
+  IPC_MESSAGE_CONTROL1(ViewHostMsg_IDBCursorDestroyed,
+                       int32 /* idb_cursor_id */)
+
   // Get file size in bytes. Set result to -1 if failed to get the file size.
   IPC_SYNC_MESSAGE_CONTROL1_1(ViewHostMsg_GetFileSize,
                               FilePath /* path */,
diff --git a/chrome/common/serialized_script_value.cc b/chrome/common/serialized_script_value.cc
index 095f4e6..776cfc7 100644
--- a/chrome/common/serialized_script_value.cc
+++ b/chrome/common/serialized_script_value.cc
@@ -21,11 +21,8 @@ SerializedScriptValue::SerializedScriptValue(
 }
 
 SerializedScriptValue::SerializedScriptValue(
-    const WebSerializedScriptValue& value)
-    : is_null_(value.isNull()),
-      is_invalid_(value.isNull() ? false : value.toString().isNull()),
-      data_(value.isNull() ? string16()
-                           : static_cast<string16>(value.toString())) {
+    const WebSerializedScriptValue& value) {
+  set_web_serialized_script_value(value);
 }
 
 SerializedScriptValue::operator WebSerializedScriptValue() const {
@@ -35,3 +32,10 @@ SerializedScriptValue::operator WebSerializedScriptValue() const {
     return WebSerializedScriptValue::createInvalid();
   return WebSerializedScriptValue::fromString(data_);
 }
+
+void SerializedScriptValue::set_web_serialized_script_value(
+    const WebSerializedScriptValue& value) {
+  is_null_ = value.isNull();
+  is_invalid_ = value.isNull() ? false : value.toString().isNull();
+  data_ = value.isNull() ? string16() : static_cast<string16>(value.toString());
+}
diff --git a/chrome/common/serialized_script_value.h b/chrome/common/serialized_script_value.h
index 794d410..75baef6 100644
--- a/chrome/common/serialized_script_value.h
+++ b/chrome/common/serialized_script_value.h
@@ -24,6 +24,9 @@ class SerializedScriptValue {
   void set_data(const string16& data) { data_ = data; }
   const string16& data() const { return data_; }
 
+  void set_web_serialized_script_value(
+      const WebKit::WebSerializedScriptValue& value);
+
   operator WebKit::WebSerializedScriptValue() const;
 
  private:
diff --git a/chrome/renderer/indexed_db_dispatcher.cc b/chrome/renderer/indexed_db_dispatcher.cc
index a059512..83f7f49 100644
--- a/chrome/renderer/indexed_db_dispatcher.cc
+++ b/chrome/renderer/indexed_db_dispatcher.cc
@@ -8,16 +8,20 @@
 #include "chrome/common/serialized_script_value.h"
 #include "chrome/renderer/render_thread.h"
 #include "chrome/renderer/render_view.h"
+#include "chrome/renderer/renderer_webidbcursor_impl.h"
 #include "chrome/renderer/renderer_webidbdatabase_impl.h"
 #include "chrome/renderer/renderer_webidbindex_impl.h"
 #include "chrome/renderer/renderer_webidbobjectstore_impl.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabaseError.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBKeyRange.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebSecurityOrigin.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSerializedScriptValue.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebString.h"
 
 using WebKit::WebFrame;
 using WebKit::WebIDBCallbacks;
+using WebKit::WebIDBKeyRange;
 using WebKit::WebIDBDatabase;
 using WebKit::WebIDBDatabaseError;
 
@@ -40,6 +44,8 @@ bool IndexedDBDispatcher::OnMessageReceived(const IPC::Message& msg) {
                         OnSuccessIDBObjectStore)
     IPC_MESSAGE_HANDLER(ViewMsg_IDBCallbacksSuccessIDBIndex,
                         OnSuccessIDBIndex)
+    IPC_MESSAGE_HANDLER(ViewMsg_IDBCallbackSuccessOpenCursor,
+                        OnSuccessOpenCursor)
     IPC_MESSAGE_HANDLER(ViewMsg_IDBCallbacksSuccessSerializedScriptValue,
                         OnSuccessSerializedScriptValue)
     IPC_MESSAGE_HANDLER(ViewMsg_IDBCallbacksError,
@@ -155,6 +161,21 @@ void IndexedDBDispatcher::RequestIDBObjectStoreRemoveIndex(
           name));
 }
 
+void IndexedDBDispatcher::RequestIDBObjectStoreOpenCursor(
+    const WebIDBKeyRange& idb_key_range, unsigned short direction,
+    WebIDBCallbacks* callbacks_ptr, int32 idb_object_store_id) {
+  scoped_ptr<WebIDBCallbacks> callbacks(callbacks_ptr);
+  ViewHostMsg_IDBObjectStoreOpenCursor_Params params;
+  params.response_id_ = pending_callbacks_.Add(callbacks.release());
+  params.left_key_.Set(idb_key_range.left());
+  params.right_key_.Set(idb_key_range.right());
+  params.flags_ = idb_key_range.flags();
+  params.direction_ = direction;
+  params.idb_object_store_id_ = idb_object_store_id;
+  RenderThread::current()->Send(
+      new ViewHostMsg_IDBObjectStoreOpenCursor(params));
+}
+
 void IndexedDBDispatcher::OnSuccessNull(int32 response_id) {
   WebKit::WebIDBCallbacks* callbacks = pending_callbacks_.Lookup(response_id);
   callbacks->onSuccess();
@@ -196,6 +217,14 @@ void IndexedDBDispatcher::OnSuccessSerializedScriptValue(
   pending_callbacks_.Remove(response_id);
 }
 
+void IndexedDBDispatcher::OnSuccessOpenCursor(int32 repsonse_id,
+                                              int32 object_id) {
+  WebKit::WebIDBCallbacks* callbacks =
+        pending_callbacks_.Lookup(repsonse_id);
+  callbacks->onSuccess(new RendererWebIDBCursorImpl(object_id));
+  pending_callbacks_.Remove(repsonse_id);
+}
+
 void IndexedDBDispatcher::OnError(int32 response_id, int code,
                                   const string16& message) {
   WebKit::WebIDBCallbacks* callbacks = pending_callbacks_.Lookup(response_id);
diff --git a/chrome/renderer/indexed_db_dispatcher.h b/chrome/renderer/indexed_db_dispatcher.h
index ed551ec..5c04180 100644
--- a/chrome/renderer/indexed_db_dispatcher.h
+++ b/chrome/renderer/indexed_db_dispatcher.h
@@ -17,6 +17,7 @@ class SerializedScriptValue;
 
 namespace WebKit {
 class WebFrame;
+class WebIDBKeyRange;
 }
 
 // Handle the indexed db related communication for this entire renderer.
@@ -64,6 +65,10 @@ class IndexedDBDispatcher {
       const string16& name, WebKit::WebIDBCallbacks* callbacks,
       int32 idb_object_store_id);
 
+  void RequestIDBObjectStoreOpenCursor(
+      const WebKit::WebIDBKeyRange& idb_key_range, unsigned short direction,
+      WebKit::WebIDBCallbacks* callbacks, int32 idb_object_store_id);
+
  private:
   // IDBCallback message handlers.
   void OnSuccessNull(int32 response_id);
@@ -71,6 +76,7 @@ class IndexedDBDispatcher {
   void OnSuccessIndexedDBKey(int32 response_id, const IndexedDBKey& key);
   void OnSuccessIDBObjectStore(int32 response_id, int32 object_id);
   void OnSuccessIDBIndex(int32 response_id, int32 object_id);
+  void OnSuccessOpenCursor(int32 response_id, int32 object_id);
   void OnSuccessSerializedScriptValue(int32 response_id,
                                       const SerializedScriptValue& value);
   void OnError(int32 response_id, int code, const string16& message);
diff --git a/chrome/renderer/renderer_webidbcursor_impl.cc b/chrome/renderer/renderer_webidbcursor_impl.cc
new file mode 100644
index 0000000..b647173
--- /dev/null
+++ b/chrome/renderer/renderer_webidbcursor_impl.cc
@@ -0,0 +1,59 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/renderer/renderer_webidbcursor_impl.h"
+
+#include "chrome/common/render_messages.h"
+#include "chrome/renderer/render_thread.h"
+
+using WebKit::WebIDBCallbacks;
+using WebKit::WebIDBKey;
+using WebKit::WebSerializedScriptValue;
+
+RendererWebIDBCursorImpl::RendererWebIDBCursorImpl(int32 idb_cursor_id)
+    : idb_cursor_id_(idb_cursor_id) {
+}
+
+RendererWebIDBCursorImpl::~RendererWebIDBCursorImpl() {
+  RenderThread::current()->Send(new ViewHostMsg_IDBCursorDestroyed(
+      idb_cursor_id_));
+}
+
+unsigned short RendererWebIDBCursorImpl::direction() const {
+  int direction;
+  RenderThread::current()->Send(
+      new ViewHostMsg_IDBCursorDirection(idb_cursor_id_, &direction));
+  return direction;
+}
+
+WebIDBKey RendererWebIDBCursorImpl::key() const {
+  IndexedDBKey key;
+  RenderThread::current()->Send(
+      new ViewHostMsg_IDBCursorKey(idb_cursor_id_, &key));
+  return key;
+}
+
+WebSerializedScriptValue RendererWebIDBCursorImpl::value() const {
+  SerializedScriptValue value;
+  RenderThread::current()->Send(
+      new ViewHostMsg_IDBCursorValue(idb_cursor_id_, &value));
+  return value;
+}
+
+void RendererWebIDBCursorImpl::update(const WebSerializedScriptValue& value,
+                                      WebIDBCallbacks* callback) {
+  // TODO(bulach): implement this.
+  NOTREACHED();
+}
+
+void RendererWebIDBCursorImpl::continueFunction(const WebIDBKey& key,
+                                                WebIDBCallbacks* callback) {
+  // TODO(bulach): implement this.
+  NOTREACHED();
+}
+
+void RendererWebIDBCursorImpl::remove(WebIDBCallbacks* callback) {
+  // TODO(bulach): implement this.
+  NOTREACHED();
+}
diff --git a/chrome/renderer/renderer_webidbcursor_impl.h b/chrome/renderer/renderer_webidbcursor_impl.h
new file mode 100644
index 0000000..9f197f8
--- /dev/null
+++ b/chrome/renderer/renderer_webidbcursor_impl.h
@@ -0,0 +1,34 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_RENDERER_RENDERER_WEBIDBCURSOR_IMPL_H_
+#define CHROME_RENDERER_RENDERER_WEBIDBCURSOR_IMPL_H_
+
+#include "base/basictypes.h"
+#include "chrome/common/indexed_db_key.h"
+#include "chrome/common/serialized_script_value.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBCallbacks.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBCursor.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBKey.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSerializedScriptValue.h"
+
+class RendererWebIDBCursorImpl : public WebKit::WebIDBCursor {
+ public:
+  RendererWebIDBCursorImpl(int32 idb_cursor_id);
+  virtual ~RendererWebIDBCursorImpl();
+
+  virtual unsigned short direction() const;
+  virtual WebKit::WebIDBKey key() const;
+  virtual WebKit::WebSerializedScriptValue value() const;
+  virtual void update(const WebKit::WebSerializedScriptValue& value,
+                      WebKit::WebIDBCallbacks* callback);
+  virtual void continueFunction(const WebKit::WebIDBKey& key,
+                                WebKit::WebIDBCallbacks* callback);
+  virtual void remove(WebKit::WebIDBCallbacks* callback);
+
+ private:
+  int32 idb_cursor_id_;
+};
+
+#endif  // CHROME_RENDERER_RENDERER_WEBIDBCURSOR_IMPL_H_
diff --git a/chrome/renderer/renderer_webidbobjectstore_impl.cc b/chrome/renderer/renderer_webidbobjectstore_impl.cc
index 5441dab..d29a326 100644
--- a/chrome/renderer/renderer_webidbobjectstore_impl.cc
+++ b/chrome/renderer/renderer_webidbobjectstore_impl.cc
@@ -12,11 +12,14 @@
 #include "chrome/renderer/renderer_webidbindex_impl.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebDOMStringList.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebIDBKey.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebIDBKeyRange.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSerializedScriptValue.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebString.h"
 
 using WebKit::WebDOMStringList;
 using WebKit::WebFrame;
 using WebKit::WebIDBCallbacks;
+using WebKit::WebIDBKeyRange;
 using WebKit::WebIDBIndex;
 using WebKit::WebIDBKey;
 using WebKit::WebSerializedScriptValue;
@@ -112,3 +115,12 @@ void RendererWebIDBObjectStoreImpl::removeIndex(const WebString& name,
   dispatcher->RequestIDBObjectStoreRemoveIndex(name, callbacks,
                                                idb_object_store_id_);
 }
+
+void RendererWebIDBObjectStoreImpl::openCursor(
+    const WebIDBKeyRange& idb_key_range,
+    unsigned short direction, WebIDBCallbacks* callbacks) {
+  IndexedDBDispatcher* dispatcher =
+      RenderThread::current()->indexed_db_dispatcher();
+  dispatcher->RequestIDBObjectStoreOpenCursor(idb_key_range, direction,
+                                              callbacks,  idb_object_store_id_);
+}
diff --git a/chrome/renderer/renderer_webidbobjectstore_impl.h b/chrome/renderer/renderer_webidbobjectstore_impl.h
index 7e14826..88e5ad4 100644
--- a/chrome/renderer/renderer_webidbobjectstore_impl.h
+++ b/chrome/renderer/renderer_webidbobjectstore_impl.h
@@ -15,6 +15,7 @@ class WebFrame;
 class WebIDBCallbacks;
 class WebIDBIndex;
 class WebIDBKey;
+class WebIDBKeyRange;
 class WebString;
 }
 
@@ -41,7 +42,8 @@ class RendererWebIDBObjectStoreImpl : public WebKit::WebIDBObjectStore {
   WebKit::WebIDBIndex* index(const WebKit::WebString& name);
   void removeIndex(const WebKit::WebString& name,
                    WebKit::WebIDBCallbacks* callbacks);
-
+  void openCursor(const WebKit::WebIDBKeyRange& idb_key_range,
+                  unsigned short direction, WebKit::WebIDBCallbacks* callbacks);
  private:
   int32 idb_object_store_id_;
 };