Protect XHR's wrapper while dispatching event.

Protect XHR's wrapper while dispatching event.

In the current impl, XMLHttpRequest::hasPendingActivity returns false when
the associated loader is gone. On the ohter hand, event dispatching, which may
happen *after* the associated loader is gone, needs the wrapper. This CL extends
the protection for the wrapper via hasPendingActivity by introducing
m_eventDispatchRecursionLevel.
As we have suffered from insufficient protection for a long time, this CL
protects the wrapper conservatively.

This CL drops RefPtr-based protections because they are covered by
hasPendingActivity based protections.

BUG=458970
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=190531

[yhirano, 2015-02-19 08:09:04]

yhirano@chromium.org changed reviewers:
+ kouhei@chromium.org, tyoshino@chromium.org

[yhirano, 2015-02-19 08:09:05]

PTAL

[kouhei (in TOK), 2015-02-19 10:08:33]

On 2015/02/19 08:09:05, yhirano wrote:
> PTAL

lgtm
I'm not a big fan of this patch as this reminds me of the old addPendingActivity
counter, but this patch resolves the issue and I don't have a better idea on how
to resolve this atm.

I think we don't need this in Oilpan, as this ptr is on stack/register thus
protected.
Would you add #ifdef !ENABLE(OILPAN) to those changes?

[yhirano, 2015-02-19 10:37:32]

On 2015/02/19 10:08:33, kouhei wrote:
> 
> I think we don't need this in Oilpan, as this ptr is on stack/register thus
> protected.
> Would you add #ifdef !ENABLE(OILPAN) to those changes?
IIUC Oilpan protects the C++ XHR object, but what I want to protect is its
wrapper.
When called from a loader callback, there is no wrapper's pointer on the stack.

[kouhei (in TOK), 2015-02-19 11:18:22]

On 2015/02/19 10:37:32, yhirano wrote:
> On 2015/02/19 10:08:33, kouhei wrote:
> > 
> > I think we don't need this in Oilpan, as this ptr is on stack/register thus
> > protected.
> > Would you add #ifdef !ENABLE(OILPAN) to those changes?
> IIUC Oilpan protects the C++ XHR object, but what I want to protect is its
> wrapper.
> When called from a loader callback, there is no wrapper's pointer on the
stack.

You're right. Please ignore my last comment

[tyoshino (SeeGerritForStatus), 2015-02-20 03:57:57]

lgtm ps3

[yhirano, 2015-02-20 04:06:18]

The CQ bit was checked by yhirano@chromium.org

[commit-bot: I haz the power, 2015-02-20 04:06:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/942433003/40001

[commit-bot: I haz the power, 2015-02-20 05:30:03]

Committed patchset #3 (id:40001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=190531

[sof, 2015-02-20 07:35:45]

sigbjornf@opera.com changed reviewers:
+ sigbjornf@opera.com

[sof, 2015-02-20 07:35:45]

Do we have a test for this?

[yhirano, 2015-02-20 08:05:51]

I could reproduce the issue with Chrome 40, but the failure rate was fairly low
(< 1%). https://codereview.chromium.org/938553003/