MHTML generation: safely serialize image documents

Downstream code expects nonzero resources to be discovered during
FrameSerializer::serializeFrame. However, this can happen in some cases
when processing image documents.

BUG=678893

Review-Url: https://codereview.chromium.org/2613253002
Cr-Commit-Position: refs/heads/master@{#442058}

third_party/WebKit/Source/web/WebFrameSerializer.cpp

@@ -294,6 +294,11 @@ WebThreadSafeData WebFrameSerializer::generateMHTMLParts(
     FrameSerializer serializer(resources, coreDelegate);
     serializer.serializeFrame(*frame);
   }
+
+  // There was an error serializing the frame (e.g. of an image resource).
+  if (resources.isEmpty())
+    return WebThreadSafeData();
+
   TRACE_EVENT_END1("page-serialization",
                    "WebFrameSerializer::generateMHTMLParts serializing",
                    "resource count",
@@ -302,7 +307,6 @@ WebThreadSafeData WebFrameSerializer::generateMHTMLParts(
   // Encode serialized resources as MHTML.
   RefPtr<RawData> output = RawData::create();
   {
-    DCHECK(!resources.isEmpty());
     SCOPED_BLINK_UMA_HISTOGRAM_TIMER(
         "PageSerialization.MhtmlGeneration.EncodingTime.SingleFrame");
     // Frame is the 1st resource (see FrameSerializer::serializeFrame doc

third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp

@@ -198,10 +198,12 @@ class WebFrameSerializerSanitizationTest : public WebFrameSerializerTest {
 
   ~WebFrameSerializerSanitizationTest() override {}
 
-  String generateMHTMLParts(const String& url, const String& fileName) {
+  String generateMHTMLParts(const String& url,
+                            const String& fileName,
+                            const String& mimeType = "text/html") {
     KURL parsedURL(ParsedURLString, url);
     URLTestHelpers::registerMockedURLLoad(parsedURL, fileName,
-                                          "frameserialization/", "text/html");
+                                          "frameserialization/", mimeType);
     FrameTestHelpers::loadFrame(mainFrameImpl(), url.utf8().data());
     WebThreadSafeData result = WebFrameSerializer::generateMHTMLParts(
         WebString("boundary"), mainFrameImpl(), &m_mhtmlDelegate);
@@ -274,4 +276,12 @@ TEST_F(WebFrameSerializerSanitizationTest, RemoveHiddenElements) {
   EXPECT_NE(WTF::kNotFound, mhtml.find("<div"));
 }
 
+// Regression test for crbug.com/678893, where in some cases serializing an
+// image document could cause code to pick an element from an empty container.
+TEST_F(WebFrameSerializerSanitizationTest, FromBrokenImageDocument) {
+  String mhtml = generateMHTMLParts("http://www.test.com", "broken-image.png",
+                                    "image/png");
+  EXPECT_TRUE(mhtml.isEmpty());
+}
+
 }  // namespace blink

third_party/WebKit/Source/web/tests/data/frameserialization/broken-image.png

+broken image / this is not a png file