Fix XMLHttpRequest leak document when send() is called multiple times.

Source/core/xml/XMLHttpRequest.cpp

Index: Source/core/xml/XMLHttpRequest.cpp
diff --git a/Source/core/xml/XMLHttpRequest.cpp b/Source/core/xml/XMLHttpRequest.cpp
index 9dc97ee7509cd4ae2a148c472ff68bf20c0d3840..3cd6fd68b3d161fb06b2a4ccfe1e0c87c2d122a7 100644
--- a/Source/core/xml/XMLHttpRequest.cpp
+++ b/Source/core/xml/XMLHttpRequest.cpp
@@ -445,7 +445,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionState&
 
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionState& es)
 {
-    internalAbort();
+    internalAbort(DropProtectionSync);
     State previousState = m_state;
     m_state = UNSENT;
     m_error = false;
@@ -751,11 +751,15 @@ void XMLHttpRequest::createRequest(ExceptionState& es)
         // This is true while running onunload handlers.
         // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
         // FIXME: Maybe create() can return null for other reasons too?
+        ASSERT(!m_loader);
         m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
         if (m_loader) {
             // Neither this object nor the JavaScript wrapper should be deleted while
             // a request is in progress because we need to keep the listeners alive,
             // and they are referenced by the JavaScript wrapper.
+
+            // m_loader was null, so there should be no pending activity at this point.
+            ASSERT(!hasPendingActivity());
             setPendingActivity(this);
         }
     } else {
@@ -778,7 +782,7 @@ void XMLHttpRequest::abort()
 
     bool sendFlag = m_loader;
 
-    internalAbort();
+    internalAbort(DropProtectionSync);
 
     clearResponseBuffers();
 
@@ -801,7 +805,7 @@ void XMLHttpRequest::abort()
     }
 }
 
-void XMLHttpRequest::internalAbort()
+void XMLHttpRequest::internalAbort(DropProtection async)
 {
     bool hadLoader = m_loader;
 
@@ -819,8 +823,12 @@ void XMLHttpRequest::internalAbort()
 
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
-    if (hadLoader)
-        dropProtectionSoon();
+    if (hadLoader) {
+        if (async == DropProtectionAsync)
+            dropProtectionSoon();
+        else
+            dropProtection();
+    }
 }
 
 void XMLHttpRequest::clearResponse()
@@ -864,7 +872,7 @@ void XMLHttpRequest::networkError()
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     }
     m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
-    internalAbort();
+    internalAbort(DropProtectionSync);
 }
 
 void XMLHttpRequest::abortError()
@@ -1181,7 +1189,7 @@ void XMLHttpRequest::didTimeout()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
-    internalAbort();
+    internalAbort(DropProtectionSync);
 
     clearResponse();
     clearRequest();
@@ -1222,7 +1230,7 @@ void XMLHttpRequest::resume()
 
 void XMLHttpRequest::stop()
 {
-    internalAbort();
+    internalAbort(DropProtectionAsync);

[abarth-chromium, 2013/08/14 04:11:49]

What I would do is make DropProtectionSync the default value and have
DropProtectionAsync in the one call site that needs it.  That makes it clear
that most code wants to drop protection sync.

LGTM

[kouhei (in TOK), 2013/08/14 04:58:20]

Done.

 }
 
 void XMLHttpRequest::contextDestroyed()