Fix XMLHttpRequest leak document when send() is called multiple times.

Source/core/xml/XMLHttpRequest.cpp

Index: Source/core/xml/XMLHttpRequest.cpp
diff --git a/Source/core/xml/XMLHttpRequest.cpp b/Source/core/xml/XMLHttpRequest.cpp
index e65a4a720fdbfada888d91a162972db8b908dfab..3c4b59b40beeb76873f08d20678d0ae4b77afb04 100644
--- a/Source/core/xml/XMLHttpRequest.cpp
+++ b/Source/core/xml/XMLHttpRequest.cpp
@@ -761,7 +761,8 @@ void XMLHttpRequest::createRequest(ExceptionState& es)
             // Neither this object nor the JavaScript wrapper should be deleted while
             // a request is in progress because we need to keep the listeners alive,
             // and they are referenced by the JavaScript wrapper.
-            setPendingActivity(this);
+            if (!hasPendingActivity())

[haraken, 2013/08/14 01:30:59]

I'm not sure if this is a right fix. If send() is called twice, you're not
setting the pending activity for the second send(). Thus, the XHR object for the
second send() can be prematurely deleted.

Maybe a right fix would be to keep track of the list of pending activities and
make sure that stop() clears all the pending activities?

[kouhei (in TOK), 2013/08/14 02:30:09]

There should not be a pending activity at this point anyway. I changed this to
assertion in updated patch. m_loader is ensured to be null on initSend(), which
must be called prior to this function.

The case where this could have a pending activity here was from
unsetPendingActivity called asynchronously. I fixed the issue in the updated
patch.

+                setPendingActivity(this);
         }
     } else {
         request.setPriority(ResourceLoadPriorityVeryHigh);
@@ -778,9 +779,6 @@ void XMLHttpRequest::createRequest(ExceptionState& es)
 
 void XMLHttpRequest::abort()
 {
-    // internalAbort() calls dropProtection(), which may release the last reference.
-    RefPtr<XMLHttpRequest> protect(this);
-
     bool sendFlag = m_loader;
 
     internalAbort();