Don't deref XMLHttpRequest synchronously below stop()

Source/core/xml/XMLHttpRequest.h

 /*
  *  Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@nypop.com>
  *  Copyright (C) 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
  *  version 2 of the License, or (at your option) any later version.
@@ skipping 163 matching lines @@
     bool responseIsXML() const;
 
     bool initSend(ExceptionCode&);
     void sendBytesData(const void*, size_t, ExceptionCode&);
 
     String getRequestHeader(const AtomicString& name) const;
     void setRequestHeaderInternal(const AtomicString& name, const String& value);
 
     void changeState(State newState);
     void callReadyStateChangeListener();
-    void dropProtection();
+    void dropProtectionSoon();
+    void dropProtection(Timer<XMLHttpRequest>* = 0);
     void internalAbort();
     void clearResponse();
     void clearResponseBuffers();
     void clearRequest();
 
     void createRequest(ExceptionCode&);
 
     void genericError();
     void networkError();
     void abortError();
@@ skipping 41 matching lines @@
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
     ExceptionCode m_exceptionCode;
 
     EventTargetData m_eventTargetData;
 
     XMLHttpRequestProgressEventThrottle m_progressEventThrottle;
 
     // An enum corresponding to the allowed string values for the responseType attribute.
     ResponseTypeCode m_responseTypeCode;
-
+    Timer<XMLHttpRequest> m_protectionTimer;
     RefPtr<SecurityOrigin> m_securityOrigin;
 };
 
 } // namespace WebCore
 
 #endif // XMLHttpRequest_h