This is the stack trace:
blink::KURL::operator= [0x076823E1+17]
blink::ResourceResponse::operator= [0x075A3823+19]
blink::WebURLResponse::operator= [0x072C6063+339]
blink::SimRequest::didReceiveResponse [0x008EBB89+41]
blink::SimNetwork::didReceiveResponse [0x008EA717+343]
blink::WebURLLoaderMock::ServeAsynchronousRequest [0x01597D6C+332]
blink::WebURLLoaderMockFactoryImpl::serveAsynchronousRequests [0x015961C7+471]
blink::SimNetwork::servePendingRequests [0x008EB612+50]
blink::SimRequest::start [0x008EBD6F+31]
blink::SimRequest::complete [0x008EBAEF+15]
blink::DeferredLoadingTest_Visible_Test::TestBody [0x0065360A+74]
I think it's because SimRequest's constructor statically adds itself to
SimNetwork:
SimNetwork::current().addRequest(*this);
So the first object that's created in createMainResource() adds itself and then
goes out of scope. But the SimNetwork isn't notified on destruction and later
tries to do stuff with the destroyed object.
https://codereview.chromium.org/2437193002/