A possible fix is, instead of comparing pointers of ResourceClient, give each occurrence of ResourceClient a unique sequence ID (unique ID is given for each addClient()) and compare both ResourceClient pointers and sequence IDs. I'm creating a draft CL (but not so sure whether it is mergeable to beta).

|Resource::m_clients| is HashCountedSet, and Resource can have multiple occurrences of a client in |m_clients|, for example:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit/Source/core/fetch/Resource.cpp&sq=package:chromium&l=408
If we should keep this behavior, it is hard to assign a sequence ID for each occurrences of ResourceClient.
Even if we can change this behavior (i.e. we can allow at most one occurrence of a client in |m_clients| and turn |m_clients| from HashCountedSet to HashSet), the changes would be larger and perhaps become not mergeable.

Another fix is to create WeakPtr<RawResourceClient> and use it in RawResource::didAddClient() to detect destruction of clients.
This will fix the test case in #0, but doesn't fix the cases such as:
- A client is removed and then re-added (without destruction of the client), or
- A non-Raw ResourceClient is removed, destructed, and re-created at the same address and re-added.
(I haven't found specific exploitable cases though)

japhet@, do you have any comments or suggestions?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/642f15021cf5907ffdc26d919b9870cd567caf89

commit 642f15021cf5907ffdc26d919b9870cd567caf89
Author: hiroshige <hiroshige@chromium.org>
Date: Wed May 18 04:15:00 2016

Check RawResourceClient destruction in RawResource::didAddClient()

BUG= 612132 

Review-Url: https://codereview.chromium.org/1986083002
Cr-Commit-Position: refs/heads/master@{#394331}

[modify] https://crrev.com/642f15021cf5907ffdc26d919b9870cd567caf89/third_party/WebKit/Source/core/fetch/RawResource.cpp
[modify] https://crrev.com/642f15021cf5907ffdc26d919b9870cd567caf89/third_party/WebKit/Source/core/fetch/RawResource.h

The fix was landed on 52.0.2741.0 and I confirmed the test case in Comment #0 works correctly on 52.0.2741.0 canary on Windows 7.

The fix stayed for a day on canary. Requesting merge to M-51.

[Automated comment] Less than 2 weeks to go before stable on M51, manual review required.

Please mark security bugs as fixed as soon as the fix lands, and before requesting merges.

- Your friendly ClusterFuzz

Approving merge to M51 branch 2704 based on comment #6 and #7. Please merge ASAP, latest before 5:00 PM PST Monday (05/23). Thank you.

+timwillis@ (security tpm) - just fyi 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/da3930fa29674aaf2d3c0264f672171cc3fd7ef2

commit da3930fa29674aaf2d3c0264f672171cc3fd7ef2
Author: Hiroshige Hayashizaki <hiroshige@chromium.org>
Date: Mon May 23 05:09:38 2016

Check RawResourceClient destruction in RawResource::didAddClient()

BUG= 612132 

Review-Url: https://codereview.chromium.org/1986083002
Cr-Commit-Position: refs/heads/master@{#394331}
(cherry picked from commit 642f15021cf5907ffdc26d919b9870cd567caf89)

Review URL: https://codereview.chromium.org/2005743002 .

Cr-Commit-Position: refs/branch-heads/2704@{#633}
Cr-Branched-From: 6e53600def8f60d8c632fadc70d7c1939ccea347-refs/heads/master@{#386251}

[modify] https://crrev.com/da3930fa29674aaf2d3c0264f672171cc3fd7ef2/third_party/WebKit/Source/core/fetch/RawResource.cpp
[modify] https://crrev.com/da3930fa29674aaf2d3c0264f672171cc3fd7ef2/third_party/WebKit/Source/core/fetch/RawResource.h

The fix is now included in the dev channel and I verified the test case works correctly on 2.0.2743.6 (Official Build) dev-m on Windows 7.

Requesting merge to M-50 because of Security_Impact-Stable label.

s/2.0.2743.6/42.0.2743.6/

[Automated comment] Request affecting a post-stable build (M50), manual review required.

Affected URL: All.
Affected Resource type: Raw only (including XHRs).

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot