Fix XMLHttpRequest leak document when send() is called multiple times.

Source/core/xml/XMLHttpRequest.cpp

Index: Source/core/xml/XMLHttpRequest.cpp
diff --git a/Source/core/xml/XMLHttpRequest.cpp b/Source/core/xml/XMLHttpRequest.cpp
index 9dc97ee7509cd4ae2a148c472ff68bf20c0d3840..e38f50ef7dae361e9ae342b1b463411d523ea649 100644
--- a/Source/core/xml/XMLHttpRequest.cpp
+++ b/Source/core/xml/XMLHttpRequest.cpp
@@ -445,7 +445,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionState&
 
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionState& es)
 {
-    internalAbort();
+    internalAbort(false);
     State previousState = m_state;
     m_state = UNSENT;
     m_error = false;
@@ -756,6 +756,7 @@ void XMLHttpRequest::createRequest(ExceptionState& es)
             // Neither this object nor the JavaScript wrapper should be deleted while
             // a request is in progress because we need to keep the listeners alive,
             // and they are referenced by the JavaScript wrapper.
+            ASSERT(!hasPendingActivity());

[haraken, 2013/08/14 02:35:07]

Would you add a comment on this line?

[kouhei (in TOK), 2013/08/14 03:19:30]

Done.

             setPendingActivity(this);
         }
     } else {
@@ -778,7 +779,7 @@ void XMLHttpRequest::abort()
 
     bool sendFlag = m_loader;
 
-    internalAbort();
+    internalAbort(false);
 
     clearResponseBuffers();
 
@@ -801,7 +802,7 @@ void XMLHttpRequest::abort()
     }
 }
 
-void XMLHttpRequest::internalAbort()
+void XMLHttpRequest::internalAbort(bool dropProtectionAsync)

[haraken, 2013/08/14 02:35:07]

Instead of bool, could you use a more descriptive enum?

[kouhei (in TOK), 2013/08/14 03:19:30]

Done.

 {
     bool hadLoader = m_loader;
 
@@ -819,8 +820,12 @@ void XMLHttpRequest::internalAbort()
 
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
-    if (hadLoader)
-        dropProtectionSoon();
+    if (hadLoader) {
+        if (dropProtectionAsync)
+            dropProtectionSoon();
+        else
+            dropProtection();
+    }
 }
 
 void XMLHttpRequest::clearResponse()
@@ -864,7 +869,7 @@ void XMLHttpRequest::networkError()
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     }
     m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
-    internalAbort();
+    internalAbort(false);
 }
 
 void XMLHttpRequest::abortError()
@@ -1181,7 +1186,7 @@ void XMLHttpRequest::didTimeout()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
-    internalAbort();
+    internalAbort(false);
 
     clearResponse();
     clearRequest();
@@ -1222,7 +1227,7 @@ void XMLHttpRequest::resume()
 
 void XMLHttpRequest::stop()
 {
-    internalAbort();
+    internalAbort(true);
 }
 
 void XMLHttpRequest::contextDestroyed()