Prevent entering XHR methods while loader is being cancelled.

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 154 matching lines @@
     return xmlHttpRequest.release();
 }
 
 XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context, PassRefPtr<SecurityOrigin> securityOrigin)
     : ActiveDOMObject(context)
     , m_async(true)
     , m_includeCredentials(false)
     , m_timeoutMilliseconds(0)
     , m_state(UNSENT)
     , m_createdDocument(false)
+    , m_preventReentrant(false)
     , m_error(false)
     , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
     , m_progressEventThrottle(this)
     , m_responseTypeCode(ResponseTypeDefault)
     , m_protectionTimer(this, &XMLHttpRequest::dropProtection)
@@ skipping 289 matching lines @@
         && !name.startsWith(staticData->m_secHeaderPrefix, false);
 }
 
 void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionState& es)
 {
     open(method, url, true, es);
 }
 
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionState& es)
 {
+    if (m_preventReentrant) {
+        es.throwDOMException(InvalidStateError, ExceptionMessages::failedToExecute("open", "XMLHttpRequest", "reentrant is not allowed."));
+        return;
+    }
+
     internalAbort();
     State previousState = m_state;
     m_state = UNSENT;
     m_error = false;
     m_uploadComplete = false;
 
     // clear stuff from possible previous load
     clearResponse();
     clearRequest();
 
@@ skipping 65 matching lines @@
 {
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
     urlWithCredentials.setPass(password);
 
     open(method, urlWithCredentials, async, es);
 }
 
 bool XMLHttpRequest::initSend(ExceptionState& es)
 {
+    if (m_preventReentrant) {
+        es.throwDOMException(InvalidStateError, ExceptionMessages::failedToExecute("send", "XMLHttpRequest", "reentrant is not allowed."));
+        return false;
+    }
+
     if (!scriptExecutionContext())
         return false;
 
     if (m_state != OPENED || m_loader) {
         es.throwDOMException(InvalidStateError, ExceptionMessages::failedToExecute("send", "XMLHttpRequest", "the object's state must be OPENED."));
         return false;
     }
 
     m_error = false;
     return true;
@@ skipping 130 matching lines @@
         m_requestEntityBody = FormData::create(data, length);
         if (m_upload)
             m_requestEntityBody->setAlwaysStream(true);
     }
 
     createRequest(es);
 }
 
 void XMLHttpRequest::sendForInspectorXHRReplay(PassRefPtr<FormData> formData, ExceptionState& es)
 {
+    if (m_preventReentrant) {
+        es.throwDOMException(InvalidStateError, ExceptionMessages::failedToExecute("sendForInspectorXHRReplay", "XMLHttpRequest", "reentrant is not allowed."));
+        return;
+    }
+
     m_requestEntityBody = formData ? formData->deepCopy() : 0;
     createRequest(es);
     m_exceptionCode = es.code();
 }
 
 void XMLHttpRequest::createRequest(ExceptionState& es)
 {
     // Only GET request is supported for blob URL.
     if (m_url.protocolIs("blob") && m_method != "GET") {
         es.throwDOMException(NetworkError, ExceptionMessages::failedToExecute("send", "XMLHttpRequest", "'GET' is the only method allowed for 'blob:' URLs."));
@@ skipping 74 matching lines @@
         ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, options);
         InspectorInstrumentation::didLoadXHRSynchronously(scriptExecutionContext());
     }
 
     if (!m_exceptionCode && m_error)
         m_exceptionCode = NetworkError;
     if (m_exceptionCode)
         es.throwDOMException(m_exceptionCode);
 }
 
-void XMLHttpRequest::abort()
+void XMLHttpRequest::abort(ExceptionState& es)
 {
+    if (m_preventReentrant) {
+        es.throwDOMException(InvalidStateError, ExceptionMessages::failedToExecute("abort", "XMLHttpRequest", "reentrant is not allowed."));
+        return;
+    }
+
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
 
     bool sendFlag = m_loader;
 
     internalAbort();
 
     clearResponseBuffers();
 
     // Clear headers as required by the spec
@@ skipping 24 matching lines @@
     m_decoder = 0;
 
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
     if (m_responseStream && m_state != DONE)
         m_responseStream->abort();
 
     if (!m_loader)
         return;
 
+    m_preventReentrant = true;
     m_loader->cancel();

[Nate Chapin, 2013/09/19 16:31:30]

Is it possible to solve this similarly to
http://src.chromium.org/viewvc/blink?view=revision&revision=120845, by storing
an RefPtr locally and clearing m_loader before calling cancel()?

+    m_preventReentrant = false;
     m_loader = 0;
 
     if (async == DropProtectionAsync)
         dropProtectionSoon();
     else
         dropProtection();
 }
 
 void XMLHttpRequest::clearResponse()
 {
@@ skipping 424 matching lines @@
 {
     return eventNames().interfaceForXMLHttpRequest;
 }
 
 ScriptExecutionContext* XMLHttpRequest::scriptExecutionContext() const
 {
     return ActiveDOMObject::scriptExecutionContext();
 }
 
 } // namespace WebCore