Index: Source/core/xml/XMLHttpRequest.cpp |
=================================================================== |
--- Source/core/xml/XMLHttpRequest.cpp (revision 184240) |
+++ Source/core/xml/XMLHttpRequest.cpp (working copy) |
@@ -978,7 +978,6 @@ |
// If, window.onload contains open() and send(), m_loader will be set to |
// non 0 value. So, we cannot continue the outer open(). In such case, |
// just abort the outer open() by returning false. |
- RefPtrWillBeRawPtr<XMLHttpRequest> protect(this); |
RefPtr<ThreadableLoader> loader = m_loader.release(); |
loader->cancel(); |
@@ -1049,6 +1048,10 @@ |
long long expectedLength = m_response.expectedContentLength(); |
long long receivedLength = m_receivedLength; |
+ // Prevent the XMLHttpRequest instance from being destoryed during |
+ // |internalAbort()|. |
+ RefPtrWillBeRawPtr<XMLHttpRequest> protect(this); |
+ |
if (!internalAbort()) |
return; |
@@ -1063,6 +1066,10 @@ |
long long expectedLength = m_response.expectedContentLength(); |
long long receivedLength = m_receivedLength; |
+ // Prevent the XMLHttpRequest instance from being destoryed during |
+ // |internalAbort()|. |
+ RefPtrWillBeRawPtr<XMLHttpRequest> protect(this); |
+ |
if (!internalAbort()) |
return; |
@@ -1269,11 +1276,13 @@ |
if (error.isCancellation()) { |
handleDidCancel(); |
+ // Now the XMLHttpRequest instance may be dead. |
return; |
} |
if (error.isTimeout()) { |
handleDidTimeout(); |
+ // Now the XMLHttpRequest instance may be dead. |
return; |
} |
@@ -1282,6 +1291,7 @@ |
logConsoleError(executionContext(), "XMLHttpRequest cannot load " + error.failingURL() + ". " + error.localizedDescription()); |
handleNetworkError(); |
+ // Now the XMLHttpRequest instance may be dead. |
} |
void XMLHttpRequest::didFailRedirectCheck() |
@@ -1289,6 +1299,7 @@ |
WTF_LOG(Network, "XMLHttpRequest %p didFailRedirectCheck()", this); |
handleNetworkError(); |
+ // Now the XMLHttpRequest instance may be dead. |
} |
void XMLHttpRequest::didFinishLoading(unsigned long identifier, double) |
@@ -1515,6 +1526,10 @@ |
long long expectedLength = m_response.expectedContentLength(); |
long long receivedLength = m_receivedLength; |
+ // Prevent the XMLHttpRequest instance from being destoryed during |
+ // |internalAbort()|. |
+ RefPtrWillBeRawPtr<XMLHttpRequest> protect(this); |
+ |
if (!internalAbort()) |
return; |