Don't deref XMLHttpRequest synchronously below stop()

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 163 matching lines @@
     , m_error(false)
     , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
     , m_allowCrossOriginRequests(false)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
     , m_progressEventThrottle(this)
     , m_responseTypeCode(ResponseTypeDefault)
+    , m_protectionTimer(this, &XMLHttpRequest::dropProtection)
     , m_securityOrigin(securityOrigin)
 {
     initializeXMLHttpRequestStaticData();
 #ifndef NDEBUG
     xmlHttpRequestCounter.increment();
 #endif
     ScriptWrappable::init(this);
 }
 
 XMLHttpRequest::~XMLHttpRequest()
@@ skipping 633 matching lines @@
     if (hadLoader) {
         m_loader->cancel();
         m_loader = 0;
     }
 
     m_decoder = 0;
 
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
     if (hadLoader)
-        dropProtection();
+        dropProtectionSoon();
 }
 
 void XMLHttpRequest::clearResponse()
 {
     m_response = ResourceResponse();
     clearResponseBuffers();
 }
 
 void XMLHttpRequest::clearResponseBuffers()
 {
@@ skipping 36 matching lines @@
 {
     genericError();
     m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
             m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
-void XMLHttpRequest::dropProtection()
+void XMLHttpRequest::dropProtectionSoon()
 {
+    if (m_protectionTimer.isActive())
+        return;
+    m_protectionTimer.startOneShot(0);
+}
 
+void XMLHttpRequest::dropProtection(Timer<XMLHttpRequest>*)
+{
     unsetPendingActivity(this);
 }
 
 void XMLHttpRequest::overrideMimeType(const String& override)
 {
     m_mimeTypeOverride = override;
 }
 
 void XMLHttpRequest::setRequestHeader(const AtomicString& name, const String& value, ExceptionCode& ec)
 {
@@ skipping 376 matching lines @@
     info.addMember(m_responseDocument, "responseDocument");
     info.addMember(m_binaryResponseBuilder, "binaryResponseBuilder");
     info.addMember(m_responseArrayBuffer, "responseArrayBuffer");
     info.addMember(m_lastSendURL, "lastSendURL");
     info.addMember(m_eventTargetData, "eventTargetData");
     info.addMember(m_progressEventThrottle, "progressEventThrottle");
     info.addMember(m_securityOrigin, "securityOrigin");
 }
 
 } // namespace WebCore