While testing XMLHttpRequest behaviour, I have hit that assertion. Test case will come.
Created attachment 19302 [details] test case Explanation : the readystatechange listener is called from processSyncLoadResults line changeState(Sent). When we call open in the previous listener, we first set m_aborted to true in internalAbort but later in open we set it to false. As a consequence, when we come to processSyncLoadResults the previous XMLHttpRequest is not cancelled (m_aborted is false) and then triggers the assertion as m_loader != 0 (we have created an async XHR in the listener).
There are no assertions in XMLHttpRequest::didFinishLoading() now, but I'm getting an assertion failure in a different place: ASSERTION FAILED: !m_didTellLoaderAboutRequest (/Volumes/Data/Safari/OpenSource/WebCore/xml/XMLHttpRequest.cpp:571 void WebCore::XMLHttpRequest::createRequest(WebCore::ExceptionCode&))
This is fixed by r63680, as we no longer dispatch readystatechange at wrong times. *** This bug has been marked as a duplicate of bug 40996 ***