Fix UAF crash bug in WebEmbeddedWorkerImpl.

Source/web/WebEmbeddedWorkerImpl.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 186 matching lines @@
     if (data.pauseAfterDownloadMode == WebEmbeddedWorkerStartData::PauseAfterDownload)
         m_pauseAfterDownloadState = DoPauseAfterDownload;
     prepareShadowPageForLoader();
 }
 
 void WebEmbeddedWorkerImpl::terminateWorkerContext()
 {
     if (m_askedToTerminate)
         return;
     m_askedToTerminate = true;
-    if (m_mainScriptLoader)
+    if (m_mainScriptLoader) {
         m_mainScriptLoader->cancel();
+        m_mainScriptLoader.clear();
+        // This may delete 'this'.
+        m_workerContextClient->workerContextFailedToStart();
+        return;
+    }
     if (m_pauseAfterDownloadState == IsPausedAfterDownload) {
         // This may delete 'this'.
         m_workerContextClient->workerContextFailedToStart();
         return;
     }
     if (m_workerThread)
         m_workerThread->stop();
 }
 
 namespace {
@@ skipping 111 matching lines @@
     m_mainScriptLoader->load(
         toWebLocalFrameImpl(m_mainFrame)->frame()->document(),
         m_workerStartData.scriptURL,
         bind(&WebEmbeddedWorkerImpl::onScriptLoaderFinished, this));
 }
 
 void WebEmbeddedWorkerImpl::onScriptLoaderFinished()
 {
     ASSERT(m_mainScriptLoader);
 
-    if (m_mainScriptLoader->failed() || m_askedToTerminate) {
+    if (m_askedToTerminate)
+        return;
+
+    if (m_mainScriptLoader->failed()) {
         m_mainScriptLoader.clear();
         // This may delete 'this'.
         m_workerContextClient->workerContextFailedToStart();
         return;
     }
 
     if (m_pauseAfterDownloadState == DoPauseAfterDownload) {
         m_pauseAfterDownloadState = IsPausedAfterDownload;
         m_workerContextClient->didPauseAfterDownload();
         return;
@@ skipping 28 matching lines @@
     m_mainScriptLoader.clear();
 
     m_workerGlobalScopeProxy = ServiceWorkerGlobalScopeProxy::create(*this, *toWebLocalFrameImpl(m_mainFrame)->frame()->document(), *m_workerContextClient);
     m_loaderProxy = LoaderProxy::create(*this);
 
     m_workerThread = ServiceWorkerThread::create(*m_loaderProxy, *m_workerGlobalScopeProxy, startupData.release());
     m_workerThread->start();
 }
 
 } // namespace blink