XHR: Abort DocumentParser on internalAbort

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 896 matching lines @@
         ASSERT(!m_loader);
         handleRequestError(0, EventTypeNames::abort, receivedLength, expectedLength);
     }
     m_state = UNSENT;
 }
 
 void XMLHttpRequest::clearVariablesForLoading()
 {
     m_decoder.clear();
 
+    if (m_responseDocumentParser) {
+#if !ENABLE(OILPAN)
+        m_responseDocumentParser->detach();
+#endif
+        m_responseDocumentParser = nullptr;
+    }
+
     m_finalResponseCharset = String();
 }
 
 bool XMLHttpRequest::internalAbort()
 {
     m_error = true;
 
+    if (m_responseDocumentParser && !m_responseDocumentParser->isStopped())
+        m_responseDocumentParser->stopParsing();
+
     clearVariablesForLoading();
 
     InspectorInstrumentation::didFailXHRLoading(executionContext(), this, this);
 
     if (m_responseLegacyStream && m_state != DONE)
         m_responseLegacyStream->abort();
 
     if (m_responseStream) {
         // When the stream is already closed (including canceled from the
         // user), |error| does nothing.
@@ skipping 30 matching lines @@
     // FIXME: when we add the support for multi-part XHR, we will have to
     // be careful with this initialization.
     m_receivedLength = 0;
 
     m_response = ResourceResponse();
 
     m_responseText.clear();
 
     m_parsedResponse = false;
     m_responseDocument = nullptr;
-    m_responseDocumentParser = nullptr;
 
     m_responseBlob = nullptr;
     m_downloadedBlobLength = 0;
 
     m_responseLegacyStream = nullptr;
     m_responseStream = nullptr;
 
     // These variables may referred by the response accessors. So, we can clear
     // this only when we clear the response holder variables above.
     m_binaryResponseBuilder.clear();
@@ skipping 523 matching lines @@
     visitor->trace(m_responseStream);
     visitor->trace(m_streamSource);
     visitor->trace(m_responseDocument);
     visitor->trace(m_responseDocumentParser);
     visitor->trace(m_progressEventThrottle);
     visitor->trace(m_upload);
     XMLHttpRequestEventTarget::trace(visitor);
 }
 
 } // namespace blink