Clear Resource::m_loader in Resource::finish() and Resource::error()

third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 30 matching lines @@
 
 DEFINE_TRACE(ResourceLoaderSet)
 {
     visitor->trace(m_set);
 }
 
 void ResourceLoaderSet::cancelAll()
 {
     HeapVector<Member<ResourceLoader>> loadersCopy;
     copyToVector(m_set, loadersCopy);
-    for (const auto& loader : loadersCopy)
-        loader->cancel();
+    for (const auto& loader : loadersCopy) {
+        // cancelAll() can reenter. Don't cancel the same ResourceLoader twice.
+        if (m_set.contains(loader))
+            loader->cancel();
+    }
 }
 
 void ResourceLoaderSet::setAllDefersLoading(bool defers)
 {
     HeapVector<Member<ResourceLoader>> loadersCopy;
     copyToVector(m_set, loadersCopy);
     for (const auto& loader : loadersCopy)
         loader->setDefersLoading(defers);
 }
 
 } // namespace blink