[XHR] Use hasPendingActivity() to manage XHR's life time.

Source/core/xml/XMLHttpRequest.h

Index: Source/core/xml/XMLHttpRequest.h
diff --git a/Source/core/xml/XMLHttpRequest.h b/Source/core/xml/XMLHttpRequest.h
index 6cd13dc0f5f4985c47ec79d02e8e37a176e920a6..9e20da86ad502b41836ca93a50d77db5463f449f 100644
--- a/Source/core/xml/XMLHttpRequest.h
+++ b/Source/core/xml/XMLHttpRequest.h
@@ -30,7 +30,6 @@
 #include "core/loader/ThreadableLoaderClient.h"
 #include "core/xml/XMLHttpRequestEventTarget.h"
 #include "core/xml/XMLHttpRequestProgressEventThrottle.h"
-#include "platform/AsyncMethodRunner.h"
 #include "platform/network/FormData.h"
 #include "platform/network/ResourceResponse.h"
 #include "platform/weborigin/SecurityOrigin.h"
@@ -57,6 +56,9 @@ class XMLHttpRequest FINAL : public ScriptWrappable, public RefCounted<XMLHttpRe
     WTF_MAKE_FAST_ALLOCATED;
     REFCOUNTED_EVENT_TARGET(XMLHttpRequest);
 public:
+    // XMLHttpRequest instances must be used with a wrapper since this class's
+    // lifetime management is designed assuming the V8 holds a ref on it while
+    // hasPendingActivity() returns true.
     static PassRefPtr<XMLHttpRequest> create(ExecutionContext*, PassRefPtr<SecurityOrigin> = 0);
     virtual ~XMLHttpRequest();
 
@@ -79,12 +81,11 @@ public:
         ResponseTypeStream
     };
 
-    enum DropProtection {
-        DropProtectionSync,
-        DropProtectionAsync,
-    };
-
+    // ActiveDOMObject implementaions
     virtual void contextDestroyed() OVERRIDE;
+    // Keep the JavaScript wrapper alive while a request is in progress so that
+    // this object (which is a listener for m_loader) is also kept alive.
+    virtual bool hasPendingActivity() const OVERRIDE;
     virtual void suspend() OVERRIDE;
     virtual void resume() OVERRIDE;
     virtual void stop() OVERRIDE;
@@ -176,12 +177,13 @@ private:
     void changeState(State newState);
     void dispatchReadyStateChangeEvent();
 
-    void dropProtectionSoon();
-    void dropProtection();
     // Clears variables used only while the resource is being loaded.
     void clearVariablesForLoading();
-    // Returns false iff reentry happened and a new load is started.
-    bool internalAbort(DropProtection = DropProtectionSync);
+    // Returns false iff reentry happened and a new load is started. This
+    // instance may be destroyed after this method call. If you need do some
+    // work later, put a temporary reference on this instance before calling
+    // this method
+    bool internalAbort();
     // Clears variables holding response header and body data.
     void clearResponse();
     void clearRequest();
@@ -261,7 +263,6 @@ private:
 
     // An enum corresponding to the allowed string values for the responseType attribute.
     ResponseTypeCode m_responseTypeCode;
-    AsyncMethodRunner<XMLHttpRequest> m_dropProtectionRunner;
     RefPtr<SecurityOrigin> m_securityOrigin;
 };