Revert 159087 "Revert 159004 "Merge 158146 "[XHR] Abort method e..."

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 432 matching lines @@
         && !name.startsWith(staticData->m_secHeaderPrefix, false);
 }
 
 void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionState& es)
 {
     open(method, url, true, es);
 }
 
 void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionState& es)
 {
-    internalAbort();
+    if (!internalAbort())
+        return;
+
     State previousState = m_state;
     m_state = UNSENT;
     m_error = false;
     m_uploadComplete = false;
 
     // clear stuff from possible previous load
     clearResponse();
     clearRequest();
 
     ASSERT(m_state == UNSENT);
@@ skipping 312 matching lines @@
         es.throwDOMException(m_exceptionCode);
 }
 
 void XMLHttpRequest::abort()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
 
     bool sendFlag = m_loader;
 
-    internalAbort();
+    if (!internalAbort())
+        return;
 
     clearResponseBuffers();
 
     // Clear headers as required by the spec
     m_requestHeaders.clear();
 
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
     else {
         ASSERT(!m_loader);
         changeState(DONE);
         m_state = UNSENT;
     }
 
     m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
-void XMLHttpRequest::internalAbort()
+bool XMLHttpRequest::internalAbort()
 {
     bool hadLoader = m_loader;
 
     m_error = true;
 
     // FIXME: when we add the support for multi-part XHR, we will have to think be careful with this initialization.
     m_receivedLength = 0;
 
     if (hadLoader) {
-        m_loader->cancel();
-        m_loader = 0;
+        // Cancelling the ThreadableLoader m_loader may result in calling
+        // window.onload synchronously. If such an onload handler contains
+        // open() call on the same XMLHttpRequest object, reentry happens. If
+        // m_loader is left to be non 0, internalAbort() call for the inner
+        // open() makes an extra dropProtection() call (when we're back to the
+        // outer open(), we'll call dropProtection()). To avoid that, clears
+        // m_loader before calling cancel.
+        //
+        // If, window.onload contains open() and send(), m_loader will be set to
+        // non 0 value. So, we cannot continue the outer open(). In such case,
+        // just abort the outer open() by returning false.
+        RefPtr<ThreadableLoader> loader = m_loader.release();
+        loader->cancel();
     }
 
     m_decoder = 0;
 
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
     if (hadLoader)
         dropProtectionSoon();
+
+    return !m_loader;
 }
 
 void XMLHttpRequest::clearResponse()
 {
     m_response = ResourceResponse();
     clearResponseBuffers();
 }
 
 void XMLHttpRequest::clearResponseBuffers()
 {
@@ skipping 340 matching lines @@
         else
             // Firefox calls readyStateChanged every time it receives data, 4449442
             callReadyStateChangeListener();
     }
 }
 
 void XMLHttpRequest::didTimeout()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
     RefPtr<XMLHttpRequest> protect(this);
-    internalAbort();
+    if (!internalAbort())
+        return;
 
     clearResponse();
     clearRequest();
 
     m_error = true;
     m_exceptionCode = TimeoutError;
 
     if (!m_async) {
         m_state = DONE;
         m_exceptionCode = TimeoutError;
@@ skipping 50 matching lines @@
 {
     return &m_eventTargetData;
 }
 
 EventTargetData* XMLHttpRequest::ensureEventTargetData()
 {
     return &m_eventTargetData;
 }
 
 } // namespace WebCore