Reland: Window.postMessage() to self can cause document leaks

Source/core/frame/LocalDOMWindow.cpp

Index: Source/core/frame/LocalDOMWindow.cpp
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index 621a1b04b199fdabbc64001bc22bf4c64f0c67d0..2397d8eedd23d001e986c1e4b2784d4acf5e645d 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -118,6 +118,7 @@ public:
         , m_targetOrigin(targetOrigin)
         , m_stackTrace(stackTrace)
         , m_userGestureToken(userGestureToken)
+        , m_preventDestruction(false)
     {
         m_asyncOperationId = InspectorInstrumentation::traceAsyncOperationStarting(executionContext(), "postMessage");
     }
@@ -126,6 +127,15 @@ public:
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
     ScriptCallStack* stackTrace() const { return m_stackTrace.get(); }
     UserGestureToken* userGestureToken() const { return m_userGestureToken.get(); }
+    virtual void stop() override
+    {
+        SuspendableTimer::stop();
+
+        if (!m_preventDestruction) {
+            // Will destroy this object
+            m_window->removePostMessageTimer(this);
+        }
+    }
 
     DEFINE_INLINE_VIRTUAL_TRACE()
     {
@@ -139,8 +149,12 @@ private:
     virtual void fired() override
     {
         InspectorInstrumentationCookie cookie = InspectorInstrumentation::traceAsyncOperationCompletedCallbackStarting(executionContext(), m_asyncOperationId);
+        // Prevent calls to stop triggered from the event handler to
+        // kill this object.
+        m_preventDestruction = true;
         m_window->postMessageTimerFired(this);
-        // This object is deleted now.
+        // Will destroy this object
+        m_window->removePostMessageTimer(this);
         InspectorInstrumentation::traceAsyncCallbackCompleted(cookie);
     }
 
@@ -150,6 +164,7 @@ private:
     RefPtrWillBeMember<ScriptCallStack> m_stackTrace;
     RefPtr<UserGestureToken> m_userGestureToken;
     int m_asyncOperationId;
+    bool m_preventDestruction;
 };
 
 static void updateSuddenTerminationStatus(LocalDOMWindow* domWindow, bool addedListener, FrameLoaderClient::SuddenTerminationDisablerType disablerType)
@@ -660,7 +675,6 @@ void LocalDOMWindow::schedulePostMessage(PassRefPtrWillBeRawPtr<MessageEvent> ev
 void LocalDOMWindow::postMessageTimerFired(PostMessageTimer* timer)
 {
     if (!isCurrentlyDisplayedInFrame()) {
-        m_postMessageTimers.remove(timer);
         return;
     }
 
@@ -670,6 +684,10 @@ void LocalDOMWindow::postMessageTimerFired(PostMessageTimer* timer)
 
     event->entangleMessagePorts(document());
     dispatchMessageEventWithOriginCheck(timer->targetOrigin(), event, timer->stackTrace());
+}
+
+void LocalDOMWindow::removePostMessageTimer(PostMessageTimer* timer)
+{
     m_postMessageTimers.remove(timer);
 }