[XHR] Use hasPendingActivity() to manage XHR's life time.

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 160 matching lines @@
     , m_downloadedBlobLength(0)
     , m_error(false)
     , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
     , m_progressEventThrottle(this)
     , m_responseTypeCode(ResponseTypeDefault)
-    , m_dropProtectionRunner(this, &XMLHttpRequest::dropProtection)
     , m_securityOrigin(securityOrigin)
 {
     initializeXMLHttpRequestStaticData();
 #ifndef NDEBUG
     xmlHttpRequestCounter.increment();
 #endif
     ScriptWrappable::init(this);
 }
 
 XMLHttpRequest::~XMLHttpRequest()
@@ skipping 650 matching lines @@
     if (m_async) {
         if (m_upload)
             request.setReportUploadProgress(true);
 
         // ThreadableLoader::create can return null here, for example if we're no longer attached to a page.
         // This is true while running onunload handlers.
         // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
         // FIXME: Maybe create() can return null for other reasons too?
         ASSERT(!m_loader);
         m_loader = ThreadableLoader::create(executionContext(), this, request, options);
-        if (m_loader) {
-            // Neither this object nor the JavaScript wrapper should be deleted while
-            // a request is in progress because we need to keep the listeners alive,
-            // and they are referenced by the JavaScript wrapper.
-            setPendingActivity(this);
-        }
     } else {
         ThreadableLoader::loadResourceSynchronously(executionContext(), request, *this, options);
     }
 
     if (!m_exceptionCode && m_error)
         m_exceptionCode = NetworkError;
     if (m_exceptionCode)
         exceptionState.throwUninformativeAndGenericDOMException(m_exceptionCode);
 }
 
 void XMLHttpRequest::abort()
 {
     WTF_LOG(Network, "XMLHttpRequest %p abort()", this);
 
-    // internalAbort() calls dropProtection(), which may release the last reference.
-    RefPtr<XMLHttpRequest> protect(this);
-
     bool sendFlag = m_loader;
 
     // Response is cleared next, save needed progress event data.
     long long expectedLength = m_response.expectedContentLength();
     long long receivedLength = m_receivedLength;
 
+    // internalAbort() clears m_loader. hasPendingActivity() returns false when
+    // m_loader is 0. So, if window.onload is dispatched (see comments in
+    // internalAbort()), it's possible that the wrapper gets GC-ed during
+    // execution of the event. So, we need to keep this object alive to
+    // continue the rest of this method.
+    RefPtr<XMLHttpRequest> protect(this);
+
     if (!internalAbort())
         return;
 
     clearResponse();
 
     // Clear headers as required by the spec
     m_requestHeaders.clear();
 
     if (!((m_state <= OPENED && !sendFlag) || m_state == DONE)) {
         ASSERT(!m_loader);
         handleRequestError(0, EventTypeNames::abort, receivedLength, expectedLength);
     }
     m_state = UNSENT;
 }
 
 void XMLHttpRequest::clearVariablesForLoading()
 {
     m_decoder.clear();
 
     m_responseEncoding = String();
 }
 
-bool XMLHttpRequest::internalAbort(DropProtection async)
+bool XMLHttpRequest::internalAbort()
 {
     m_error = true;
 
     clearVariablesForLoading();
 
     InspectorInstrumentation::didFailXHRLoading(executionContext(), this, this);
 
     if (m_responseStream && m_state != DONE)
         m_responseStream->abort();
 
     if (!m_loader)
         return true;
 
     // Cancelling the ThreadableLoader m_loader may result in calling
     // window.onload synchronously. If such an onload handler contains open()
     // call on the same XMLHttpRequest object, reentry happens. If m_loader
-    // is left to be non 0, internalAbort() call for the inner open() makes
-    // an extra dropProtection() call (when we're back to the outer open(),
-    // we'll call dropProtection()). To avoid that, clears m_loader before
-    // calling cancel.
-    //
+    // is left to be non 0, internalAbort() for the inner open() repeats the
+    // the same work. To avoid that, clears m_loader before calling cancel().
+    RefPtr<ThreadableLoader> loader = m_loader.release();
+    loader->cancel();
+
     // If, window.onload contains open() and send(), m_loader will be set to
     // non 0 value. So, we cannot continue the outer open(). In such case,
     // just abort the outer open() by returning false.
-    RefPtr<ThreadableLoader> loader = m_loader.release();
-    loader->cancel();
-
-    // Save to a local variable since we're going to drop protection.
-    bool newLoadStarted = m_loader;
+    if (m_loader)
+        return false;
 
     // If abort() called internalAbort() and a nested open() ended up
     // clearing the error flag, but didn't send(), make sure the error
     // flag is still set.
-    if (!newLoadStarted)
-        m_error = true;
+    m_error = true;
 
-    if (async == DropProtectionAsync)
-        dropProtectionSoon();
-    else
-        dropProtection();
-
-    return !newLoadStarted;
+    return true;
 }
 
 void XMLHttpRequest::clearResponse()
 {
     // FIXME: when we add the support for multi-part XHR, we will have to
     // be careful with this initialization.
     m_receivedLength = 0;
 
     m_response = ResourceResponse();
 
@@ skipping 98 matching lines @@
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
             m_upload->handleRequestError(type);
     }
 
     dispatchThrottledProgressEvent(EventTypeNames::progress, receivedLength, expectedLength);
     dispatchEventAndLoadEnd(type, receivedLength, expectedLength);
 }
 
-void XMLHttpRequest::dropProtectionSoon()
-{
-    m_dropProtectionRunner.runAsync();
-}
-
-void XMLHttpRequest::dropProtection()
-{
-    unsetPendingActivity(this);
-}
-
 void XMLHttpRequest::overrideMimeType(const AtomicString& override)
 {
     m_mimeTypeOverride = override;
 }
 
 void XMLHttpRequest::setRequestHeader(const AtomicString& name, const AtomicString& value, ExceptionState& exceptionState)
 {
     if (m_state != OPENED || m_loader) {
         exceptionState.throwDOMException(InvalidStateError, "The object's state must be OPENED.");
         return;
@@ skipping 172 matching lines @@
     if (m_decoder)
         m_responseText = m_responseText.concatenateWith(m_decoder->flush());
 
     if (m_responseStream)
         m_responseStream->finalize();
 
     clearVariablesForLoading();
 
     InspectorInstrumentation::didFinishXHRLoading(executionContext(), this, this, identifier, m_responseText, m_method, m_url, m_lastSendURL, m_lastSendLineNumber);
 
-    // Prevent dropProtection releasing the last reference, and retain |this| until the end of this method.
+    // hasPendingActivity() returns false when m_loader is 0. So, it's possible
+    // that the wrapper gets GC-ed during execution of the event. So, we need
+    // to keep this object alive to continue the rest of this method.
     RefPtr<XMLHttpRequest> protect(this);
 
-    if (m_loader) {
+    if (m_loader)
         m_loader = 0;
-        dropProtection();
-    }
 
     changeState(DONE);
 }
 
 void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     WTF_LOG(Network, "XMLHttpRequest %p didSendData(%llu, %llu)", this, bytesSent, totalBytesToBeSent);
 
     if (!m_upload)
         return;
@@ skipping 92 matching lines @@
         return;
 
     m_downloadedBlobLength += dataLength;
     trackProgress(dataLength);
 }
 
 void XMLHttpRequest::handleDidTimeout()
 {
     WTF_LOG(Network, "XMLHttpRequest %p handleDidTimeout()", this);
 
-    // internalAbort() calls dropProtection(), which may release the last reference.
-    RefPtr<XMLHttpRequest> protect(this);
-
     // Response is cleared next, save needed progress event data.
     long long expectedLength = m_response.expectedContentLength();
     long long receivedLength = m_receivedLength;
 
     if (!internalAbort())
         return;
 
     handleDidFailGeneric();
     handleRequestError(TimeoutError, EventTypeNames::timeout, receivedLength, expectedLength);
 }
 
 void XMLHttpRequest::suspend()
 {
     m_progressEventThrottle.suspend();
 }
 
 void XMLHttpRequest::resume()
 {
     m_progressEventThrottle.resume();
 }
 
 void XMLHttpRequest::stop()
 {
-    internalAbort(DropProtectionAsync);
+    internalAbort();
+}
+
+bool XMLHttpRequest::hasPendingActivity() const
+{
+    return m_loader;
 }
 
 void XMLHttpRequest::contextDestroyed()
 {
     ASSERT(!m_loader);
     ActiveDOMObject::contextDestroyed();
 }
 
 const AtomicString& XMLHttpRequest::interfaceName() const
 {
     return EventTargetNames::XMLHttpRequest;
 }
 
 ExecutionContext* XMLHttpRequest::executionContext() const
 {
     return ActiveDOMObject::executionContext();
 }
 
 } // namespace WebCore