Fix XMLHttpRequest leak document when send() is called multiple times.

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 743 matching lines @@
 
         // ThreadableLoader::create can return null here, for example if we're no longer attached to a page.
         // This is true while running onunload handlers.
         // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
         // FIXME: Maybe create() can return null for other reasons too?
         m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
         if (m_loader) {
             // Neither this object nor the JavaScript wrapper should be deleted while
             // a request is in progress because we need to keep the listeners alive,
             // and they are referenced by the JavaScript wrapper.
-            setPendingActivity(this);
+            if (!hasPendingActivity())

[haraken, 2013/08/14 01:30:59]

I'm not sure if this is a right fix. If send() is called twice, you're not
setting the pending activity for the second send(). Thus, the XHR object for the
second send() can be prematurely deleted.

Maybe a right fix would be to keep track of the list of pending activities and
make sure that stop() clears all the pending activities?

[kouhei (in TOK), 2013/08/14 02:30:09]

There should not be a pending activity at this point anyway. I changed this to
assertion in updated patch. m_loader is ensured to be null on initSend(), which
must be called prior to this function.

The case where this could have a pending activity here was from
unsetPendingActivity called asynchronously. I fixed the issue in the updated
patch.

+                setPendingActivity(this);
         }
     } else {
         request.setPriority(ResourceLoadPriorityVeryHigh);
         InspectorInstrumentation::willLoadXHRSynchronously(scriptExecutionContext());
         ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, options);
         InspectorInstrumentation::didLoadXHRSynchronously(scriptExecutionContext());
     }
 
     if (!m_exceptionCode && m_error)
         m_exceptionCode = NetworkError;
     if (m_exceptionCode)
         es.throwDOMException(m_exceptionCode);
 }
 
 void XMLHttpRequest::abort()
 {
-    // internalAbort() calls dropProtection(), which may release the last reference.
-    RefPtr<XMLHttpRequest> protect(this);
-
     bool sendFlag = m_loader;
 
     internalAbort();
 
     clearResponseBuffers();
 
     // Clear headers as required by the spec
     m_requestHeaders.clear();
 
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
@@ skipping 456 matching lines @@
 {
     return &m_eventTargetData;
 }
 
 EventTargetData* XMLHttpRequest::ensureEventTargetData()
 {
     return &m_eventTargetData;
 }
 
 } // namespace WebCore