Window.postMessage() to self can cause document leaks

Source/core/frame/LocalDOMWindow.cpp

Index: Source/core/frame/LocalDOMWindow.cpp
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index 719d0b2fad727cc1998cfa5b86017462b894e77d..12eb9a022395a5e52bb4d71d8f9552bb325d3bdf 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -126,6 +126,12 @@ public:
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
     ScriptCallStack* stackTrace() const { return m_stackTrace.get(); }
     UserGestureToken* userGestureToken() const { return m_userGestureToken.get(); }
+    virtual void stop() override
+    {
+        SuspendableTimer::stop();
+        // Will destroy this object
+        m_window->postMessageTimerStopped(this);
+    }
 
     DEFINE_INLINE_VIRTUAL_TRACE()
     {
@@ -663,6 +669,11 @@ void LocalDOMWindow::postMessageTimerFired(PostMessageTimer* timer)
     m_postMessageTimers.remove(timer);
 }
 
+void LocalDOMWindow::postMessageTimerStopped(PostMessageTimer* timer)
+{
+    m_postMessageTimers.remove(timer);
+}
+
 void LocalDOMWindow::dispatchMessageEventWithOriginCheck(SecurityOrigin* intendedTargetOrigin, PassRefPtrWillBeRawPtr<Event> event, PassRefPtrWillBeRawPtr<ScriptCallStack> stackTrace)
 {
     if (intendedTargetOrigin) {