Fix triggered RELEASE_ASSERT in ResourceLoader::didReceiveResponse()

third_party/WebKit/Source/core/fetch/ResourceLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2007 Graham Dennis (graham.dennis@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 161 matching lines @@
         releaseResources();
         return;
     }
 
     ResourceError nonNullError = error.isNull() ? ResourceError::cancelledError(m_resource->lastResourceRequest().url()) : error;
 
     WTF_LOG(ResourceLoading, "Cancelled load of '%s'.\n", m_resource->url().getString().latin1().data());
     m_state = ConnectionStateCanceled;
     m_resource->setResourceError(nonNullError);
 
+    // If we don't immediately clear m_loader when cancelling, we might get
+    // unexpected reentrancy. m_resource->error() can trigger JS events, which
+    // could start a modal dialog. Normally, a modal dialog would defer loading
+    // and prevent receiving messages for a cancelled ResourceLoader, but
+    // m_fetcher->didFailLoading() severs the connection by which all of a
+    // page's loads are deferred. A response can then arrive, see m_state
+    // is ConnectionStateCanceled, and ASSERT or break in other ways.
+    if (m_loader) {
+        m_loader->cancel();
+        m_loader.clear();
+    }
+
     if (!m_notifiedLoadComplete) {
         m_notifiedLoadComplete = true;
         m_fetcher->didFailLoading(m_resource.get(), nonNullError);
     }
 
     if (m_state != ConnectionStateReleased)
         m_resource->error(Resource::LoadError);
     if (m_state != ConnectionStateReleased)
         releaseResources();
 }
@@ skipping 202 matching lines @@
     // empty buffer is a noop in most cases, but is destructive in the case of
     // a 304, where it will overwrite the cached data we should be reusing.
     if (dataOut.size()) {
         m_fetcher->didReceiveData(m_resource.get(), dataOut.data(), dataOut.size(), encodedDataLength);
         m_resource->setResourceBuffer(dataOut);
     }
     didFinishLoading(0, monotonicallyIncreasingTime(), encodedDataLength);
 }
 
 } // namespace blink