Add virtual tests for XHR with mojo-loading

content/child/url_response_body_consumer.cc

Index: content/child/url_response_body_consumer.cc
diff --git a/content/child/url_response_body_consumer.cc b/content/child/url_response_body_consumer.cc
index 5016ee3a5b6c0646e383d43c26b745bbcdd6c816..0bbb44d6db7b99ab23d5318401c58900d71ef3a8 100644
--- a/content/child/url_response_body_consumer.cc
+++ b/content/child/url_response_body_consumer.cc
@@ -87,6 +87,9 @@ void URLResponseBodyConsumer::OnReadable(MojoResult unused) {
   if (has_been_cancelled_ || has_seen_end_of_data_)
     return;
 
+  // Protect |this| as RequestPeer::OnReceivedData may call deref.
+  scoped_refptr<URLResponseBodyConsumer> protect(this);

[nasko, 2016/11/08 01:12:12]

What causes the OnReceivedData to ref-count down this object? Is it a failure
condition? Is this code safe in face of such condition?

[yhirano, 2016/11/08 01:34:45]

RequestPeer::OnReceivedData may cancel the request. The cancel operation 

 1. calls URLResponseBodyConsumer::Cancel, and
 2. dereferences the URLResponseBodyConsumer.

Without this scoped_refptr, |this| URLResponseBodyConsumer will be destructed at
that time. With this scoped_refptr, this function will return because
has_been_cancelled_ will be set when URLResponseBodyConsumer::Cancel is called.

[nasko, 2016/11/08 16:32:15]

I was missing the bit about has_been_cancelled_ being set to true in the
::Cancel method. Thanks for the details!

+
   // TODO(yhirano): Suppress notification when deferred.
   while (!has_been_cancelled_) {
     const void* buffer = nullptr;