Created attachment 259163 [details]
ASan crash log for http/tests/appcache/deferred-events-delete-while-raising.html
See attached crash log.
The issue is that the TemporaryChange added in r188486 is declared before |protect|, which means its destructor will be called after the last ref to the SubresourceLoader is possibly removed.
Created attachment 259164 [details]
ASan crash for http/tests/appcache/deferred-events-delete-while-raising.html
Created attachment 259167 [details]
Comment on attachment 259167 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=259167&action=review
> + // This must be destroyed before |protect| to ensure the object is still alive when accessing m_callingDidReceiveResponse.
Not sure if this comment is useful.
Committed r188531: <http://trac.webkit.org/changeset/188531>