[IndexedDB] Fix Cursor UAF

If the connection is closed before we return a cursor, it dies in
IndexedDBCallbacks::IOThreadHelper::SendSuccessCursor. It's deleted on
the correct thread, but we also need to makes sure to remove it from its
transaction.

To make things simpler, we have the cursor remove itself from its
transaction on destruction.

R: pwnall@chromium.org
Bug: 728887
Change-Id: I8c76e6195c2490137a05213e47c635d12f4d3dd2
Reviewed-on: https://chromium-review.googlesource.com/526284
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#477504}
CursorImpl::IDBThreadHelper::~IDBThreadHelper() {

CursorImpl::IDBThreadHelper::~IDBThreadHelper() {
  cursor_->RemoveCursorFromTransaction();
}
