[XHR] Use hasPendingActivity() to manage XHR's life time.

Source/core/xml/XMLHttpRequest.h

 /*
  *  Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@nypop.com>
  *  Copyright (C) 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
  *  version 2 of the License, or (at your option) any later version.
@@ skipping 12 matching lines @@
 #define XMLHttpRequest_h
 
 #include "bindings/v8/ScriptString.h"
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/dom/ActiveDOMObject.h"
 #include "core/events/EventListener.h"
 #include "core/events/ThreadLocalEventNames.h"
 #include "core/loader/ThreadableLoaderClient.h"
 #include "core/xml/XMLHttpRequestEventTarget.h"
 #include "core/xml/XMLHttpRequestProgressEventThrottle.h"
-#include "platform/AsyncMethodRunner.h"
 #include "platform/network/FormData.h"
 #include "platform/network/ResourceResponse.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/text/AtomicStringHash.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
 class Blob;
 class DOMFormData;
 class Document;
 class ExceptionState;
 class ResourceRequest;
 class SecurityOrigin;
 class SharedBuffer;
 class Stream;
 class TextResourceDecoder;
 class ThreadableLoader;
 
 typedef int ExceptionCode;
 
 class XMLHttpRequest FINAL : public ScriptWrappable, public RefCounted<XMLHttpRequest>, public XMLHttpRequestEventTarget, private ThreadableLoaderClient, public ActiveDOMObject {
     WTF_MAKE_FAST_ALLOCATED;
     REFCOUNTED_EVENT_TARGET(XMLHttpRequest);
 public:
+    // XMLHttpRequest instances must be used with a wrapper since this class's
+    // lifetime management is designed assuming the V8 holds a ref on it while
+    // hasPendingActivity() returns true.
     static PassRefPtr<XMLHttpRequest> create(ExecutionContext*, PassRefPtr<SecurityOrigin> = 0);
     virtual ~XMLHttpRequest();
 
     // These exact numeric values are important because JS expects them.
     enum State {
         UNSENT = 0,
         OPENED = 1,
         HEADERS_RECEIVED = 2,
         LOADING = 3,
         DONE = 4
     };
 
     enum ResponseTypeCode {
         ResponseTypeDefault,
         ResponseTypeText,
         ResponseTypeJSON,
         ResponseTypeDocument,
         ResponseTypeBlob,
         ResponseTypeArrayBuffer,
         ResponseTypeStream
     };
 
-    enum DropProtection {
-        DropProtectionSync,
-        DropProtectionAsync,
-    };
-
+    // ActiveDOMObject implementaions
     virtual void contextDestroyed() OVERRIDE;
+    // Keep the JavaScript wrapper alive while a request is in progress so that
+    // this object (which is a listener for m_loader) is also kept alive.
+    virtual bool hasPendingActivity() const OVERRIDE;
     virtual void suspend() OVERRIDE;
     virtual void resume() OVERRIDE;
     virtual void stop() OVERRIDE;
 
     virtual const AtomicString& interfaceName() const OVERRIDE;
     virtual ExecutionContext* executionContext() const OVERRIDE;
 
     const KURL& url() const { return m_url; }
     String statusText() const;
     int status() const;
@@ skipping 71 matching lines @@
 
     const AtomicString& getRequestHeader(const AtomicString& name) const;
     void setRequestHeaderInternal(const AtomicString& name, const AtomicString& value);
 
     void trackProgress(int dataLength);
     // Changes m_state and dispatches a readyStateChange event if new m_state
     // value is different from last one.
     void changeState(State newState);
     void dispatchReadyStateChangeEvent();
 
-    void dropProtectionSoon();
-    void dropProtection();
     // Clears variables used only while the resource is being loaded.
     void clearVariablesForLoading();
-    // Returns false iff reentry happened and a new load is started.
-    bool internalAbort(DropProtection = DropProtectionSync);
+    // Returns false iff reentry happened and a new load is started. This
+    // instance may be destroyed after this method call. If you need do some
+    // work later, put a temporary reference on this instance before calling
+    // this method
+    bool internalAbort();
     // Clears variables holding response header and body data.
     void clearResponse();
     void clearRequest();
 
     void createRequest(ExceptionState&);
 
     // Dispatches an event of the specified type to m_progressEventThrottle.
     void dispatchEventAndLoadEnd(const AtomicString&, long long, long long);
 
     // Dispatches a response progress event to m_progressEventThrottle.
@@ skipping 59 matching lines @@
     String m_lastSendURL;
     // An exception to throw in synchronous mode. It's set when failure
     // notification is received from m_loader and thrown at the end of send() if
     // any.
     ExceptionCode m_exceptionCode;
 
     XMLHttpRequestProgressEventThrottle m_progressEventThrottle;
 
     // An enum corresponding to the allowed string values for the responseType attribute.
     ResponseTypeCode m_responseTypeCode;
-    AsyncMethodRunner<XMLHttpRequest> m_dropProtectionRunner;
     RefPtr<SecurityOrigin> m_securityOrigin;
 };
 
 } // namespace WebCore
 
 #endif // XMLHttpRequest_h