DocumentThreadableLoader: Add guards for sync notifyFinished() in setResource()

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

Index: third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index 2e82f636155df855d69dd6a1789aed0c8d70f67b..aba263d5cb7b3445563896e24b5ab1465a614c63 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -842,6 +842,8 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Resou
             newRequest.setOriginRestriction(FetchRequest::NoOriginRestriction);
         ASSERT(!resource());
 
+        WeakPtr<DocumentThreadableLoader> self(m_weakFactory.createWeakPtr());
+
         if (request.requestContext() == WebURLRequest::RequestContextVideo || request.requestContext() == WebURLRequest::RequestContextAudio)
             setResource(RawResource::fetchMedia(newRequest, document().fetcher()));
         else if (request.requestContext() == WebURLRequest::RequestContextManifest)
@@ -849,9 +851,19 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Resou
         else
             setResource(RawResource::fetch(newRequest, document().fetcher()));
 
+        // setResource() might call notifyFinished() synchronously, and thus
+        // clear() might be called and |this| may be dead here.
+        if (!self)
+            return;
+
         if (!resource()) {
             ThreadableLoaderClient* client = m_client;
             clear();
+            // setResource() might call notifyFinished() and thus clear()
+            // synchronously, and in such cases ThreadableLoaderClient is
+            // already notified and |client| is null.
+            if (!client)
+                return;
             client->didFail(ResourceError(errorDomainBlinkInternal, 0, requestURL.getString(), "Failed to start loading."));
             // |this| may be dead here.
             return;