Don't deref XMLHttpRequest synchronously below stop()

Source/core/xml/XMLHttpRequest.cpp

Index: Source/core/xml/XMLHttpRequest.cpp
diff --git a/Source/core/xml/XMLHttpRequest.cpp b/Source/core/xml/XMLHttpRequest.cpp
index 712a03155673bdadd2e3b5bf6757c7f7ad1b037b..8f79ae23e200a7f857446141a0080229e8481d83 100644
--- a/Source/core/xml/XMLHttpRequest.cpp
+++ b/Source/core/xml/XMLHttpRequest.cpp
@@ -181,6 +181,7 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context, PassRefPtr<Secur
     , m_exceptionCode(0)
     , m_progressEventThrottle(this)
     , m_responseTypeCode(ResponseTypeDefault)
+    , m_protectionTimer(this, &XMLHttpRequest::dropProtection)
     , m_securityOrigin(securityOrigin)
 {
     initializeXMLHttpRequestStaticData();
@@ -834,7 +835,7 @@ void XMLHttpRequest::internalAbort()
     InspectorInstrumentation::didFailXHRLoading(scriptExecutionContext(), this);
 
     if (hadLoader)
-        dropProtection();
+        dropProtectionSoon();
 }
 
 void XMLHttpRequest::clearResponse()
@@ -891,9 +892,15 @@ void XMLHttpRequest::abortError()
     }
 }
 
-void XMLHttpRequest::dropProtection()
+void XMLHttpRequest::dropProtectionSoon()
 {
+    if (m_protectionTimer.isActive())
+        return;
+    m_protectionTimer.startOneShot(0);
+}
 
+void XMLHttpRequest::dropProtection(Timer<XMLHttpRequest>*)
+{
     unsetPendingActivity(this);
 }