Clear Resource::m_loader in Resource::finish() and Resource::error()

third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp

Index: third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp
diff --git a/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp b/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp
index d933b00ce7441756f3f34bb2f4737e775ec3b2bd..d292e8d0196234a51357d95f14eefae7ef2479cf 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp
@@ -48,8 +48,11 @@ void ResourceLoaderSet::cancelAll()
 {
     HeapVector<Member<ResourceLoader>> loadersCopy;
     copyToVector(m_set, loadersCopy);
-    for (const auto& loader : loadersCopy)
-        loader->cancel();
+    for (const auto& loader : loadersCopy) {
+        // cancelAll() can reenter. Don't cancel the same ResourceLoader twice.
+        if (m_set.contains(loader))
+            loader->cancel();
+    }
 }
 
 void ResourceLoaderSet::setAllDefersLoading(bool defers)