ThreadableLoader::cancel should be called before loader destruction

third_party/WebKit/Source/core/loader/ThreadableLoaderClientWrapper.h

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 72 matching lines @@
 
     void didReceiveCachedMetadata(std::unique_ptr<Vector<char>> data)
     {
         if (m_client)
             m_client->didReceiveCachedMetadata(data->data(), data->size());
     }
 
     void didFinishLoading(unsigned long identifier, double finishTime)
     {
         m_done = true;
-        if (m_client)
-            m_client->didFinishLoading(identifier, finishTime);
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;

[hiroshige, 2016/07/19 06:56:14]

Lines 93--127: same as the comment for DocumentThreadableLoader.cpp.

[yhirano, 2016/07/19 08:05:04]

Yes

+            m_client = nullptr;
+            client->didFinishLoading(identifier, finishTime);
+        }
     }
 
     void didFail(const ResourceError& error)
     {
         m_done = true;
-        if (m_client)
-            m_client->didFail(error);
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFail(error);
+        }
     }
 
     void didFailAccessControlCheck(const ResourceError& error)
     {
         m_done = true;
-        if (m_client)
-            m_client->didFailAccessControlCheck(error);
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFailAccessControlCheck(error);
+        }
     }
 
     void didFailRedirectCheck()
     {
         m_done = true;
-        if (m_client)
-            m_client->didFailRedirectCheck();
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFailRedirectCheck();
+        }
     }
 
     void didDownloadData(int dataLength)
     {
         if (m_client)
             m_client->didDownloadData(dataLength);
     }
 
     void didReceiveResourceTiming(std::unique_ptr<CrossThreadResourceTimingInfoData> timingData)
     {
@@ skipping 11 matching lines @@
 
 private:
     Member<WorkerGlobalScope> m_workerGlobalScope;
     ThreadableLoaderClient* m_client = nullptr;
     bool m_done = false;
 };
 
 } // namespace blink
 
 #endif // ThreadableLoaderClientWrapper_h