Fix XMLHttpRequest leak document when send() is called multiple times.

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 427 matching lines @@
         && !name.startsWith(staticData->m_secHeaderPrefix, false);
 }
 
 void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionState& es)
 {
     open(method, url, true, es);
 }
 
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionState& es)
 {
-    internalAbort();
+    internalAbort(false);
     State previousState = m_state;
     m_state = UNSENT;
     m_error = false;
     m_uploadComplete = false;
 
     // clear stuff from possible previous load
     clearResponse();
     clearRequest();
 
     ASSERT(m_state == UNSENT);
@@ skipping 290 matching lines @@
 
         // ThreadableLoader::create can return null here, for example if we're no longer attached to a page.
         // This is true while running onunload handlers.
         // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
         // FIXME: Maybe create() can return null for other reasons too?
         m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
         if (m_loader) {
             // Neither this object nor the JavaScript wrapper should be deleted while
             // a request is in progress because we need to keep the listeners alive,
             // and they are referenced by the JavaScript wrapper.
+            ASSERT(!hasPendingActivity());

[haraken, 2013/08/14 02:35:07]

Would you add a comment on this line?

[kouhei (in TOK), 2013/08/14 03:19:30]

Done.

             setPendingActivity(this);
         }
     } else {
         request.setPriority(ResourceLoadPriorityVeryHigh);
         InspectorInstrumentation::willLoadXHRSynchronously(scriptExecutionContext());
         ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, options);
         InspectorInstrumentation::didLoadXHRSynchronously(scriptExecutionContext());
     }
 
     if (!m_exceptionCode && m_error)
         m_exceptionCode = NetworkError;
     if (m_exceptionCode)
         es.throwDOMException(m_exceptionCode);
 }
 
 void XMLHttpRequest::abort()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
 
     bool sendFlag = m_loader;
 
-    internalAbort();
+    internalAbort(false);
 
     clearResponseBuffers();
 
     // Clear headers as required by the spec
     m_requestHeaders.clear();
 
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
     else {
         ASSERT(!m_loader);
         changeState(DONE);
         m_state = UNSENT;
     }
 
     m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
-void XMLHttpRequest::internalAbort()
+void XMLHttpRequest::internalAbort(bool dropProtectionAsync)

[haraken, 2013/08/14 02:35:07]

Instead of bool, could you use a more descriptive enum?

[kouhei (in TOK), 2013/08/14 03:19:30]

Done.

 {
     bool hadLoader = m_loader;
 
     m_error = true;
 
     // FIXME: when we add the support for multi-part XHR, we will have to think be careful with this initialization.
     m_receivedLength = 0;
 
     if (hadLoader) {
         m_loader->cancel();
         m_loader = 0;
     }
 
     m_decoder = 0;
 
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
-    if (hadLoader)
-        dropProtectionSoon();
+    if (hadLoader) {
+        if (dropProtectionAsync)
+            dropProtectionSoon();
+        else
+            dropProtection();
+    }
 }
 
 void XMLHttpRequest::clearResponse()
 {
     m_response = ResourceResponse();
     clearResponseBuffers();
 }
 
 void XMLHttpRequest::clearResponseBuffers()
 {
@@ skipping 23 matching lines @@
 
 void XMLHttpRequest::networkError()
 {
     genericError();
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     }
     m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
-    internalAbort();
+    internalAbort(false);
 }
 
 void XMLHttpRequest::abortError()
 {
     genericError();
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
@@ skipping 296 matching lines @@
         else
             // Firefox calls readyStateChanged every time it receives data, 4449442
             callReadyStateChangeListener();
     }
 }
 
 void XMLHttpRequest::didTimeout()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
-    internalAbort();
+    internalAbort(false);
 
     clearResponse();
     clearRequest();
 
     m_error = true;
     m_exceptionCode = TimeoutError;
 
     if (!m_async) {
         m_state = DONE;
         m_exceptionCode = TimeoutError;
@@ skipping 20 matching lines @@
     m_progressEventThrottle.suspend();
 }
 
 void XMLHttpRequest::resume()
 {
     m_progressEventThrottle.resume();
 }
 
 void XMLHttpRequest::stop()
 {
-    internalAbort();
+    internalAbort(true);
 }
 
 void XMLHttpRequest::contextDestroyed()
 {
     ASSERT(!m_loader);
     ActiveDOMObject::contextDestroyed();
 }
 
 const AtomicString& XMLHttpRequest::interfaceName() const
 {
     return eventNames().interfaceForXMLHttpRequest;
 }
 
 ScriptExecutionContext* XMLHttpRequest::scriptExecutionContext() const
 {
     return ActiveDOMObject::scriptExecutionContext();
 }
 
 EventTargetData* XMLHttpRequest::eventTargetData()
 {
     return &m_eventTargetData;
 }
 
 EventTargetData* XMLHttpRequest::ensureEventTargetData()
 {
     return &m_eventTargetData;
 }
 
 } // namespace WebCore