Don't crash when aborting a fetch in a destroyed context

Once the context in which a fetch is executing has been destroyed the fetch cannot be aborted. blink::BodyStreamBuffer was attempting to abort the fetch anyway, leading to a crash. Check that the context hasn't been destroyed before attempting the abort. BUG=860063 Change-Id: I593dcbfe2f2dacd7be9df456399cd0328da7af39 Reviewed-on: https://chromium-review.googlesource.com/1125543Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Adam Rice <ricea@chromium.org> Cr-Commit-Position: refs/heads/master@{#572493}

Don't crash when aborting a fetch in a destroyed context
Once the context in which a fetch is executing has been destroyed the fetch cannot be aborted. blink::BodyStreamBuffer was attempting to abort the fetch anyway, leading to a crash. Check that the context hasn't been destroyed before attempting the abort. BUG=860063 Change-Id: I593dcbfe2f2dacd7be9df456399cd0328da7af39 Reviewed-on: https://chromium-review.googlesource.com/1125543Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Adam Rice <ricea@chromium.org> Cr-Commit-Position: refs/heads/master@{#572493}
9e56ad82 · Adam Rice · Commit Bot · 197ddf9e · 9e56ad82 · 9e56ad82
Commit 9e56ad82 authored Jul 04, 2018 by Adam Rice Committed by Commit Bot Jul 04, 2018
2 changed files
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/abort/destroyed-context.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/abort/destroyed-context.html
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// This is a regression test for crbug.com/860063.
+window.controller = new AbortController();
+async_test(t => {
+  onmessage = t.step_func(event => {
+    assert_equals(event.data, 'started');
+    const iframe = document.querySelector('iframe');
+    document.body.removeChild(iframe);
+    controller.abort();
+    t.done();
+  });
+}, 'aborting a fetch in a destroyed context should not crash');
+</script>
+<iframe srcdoc="
+                <!DOCTYPE html>
+                <meta charset=utf-8>
+                <script>
+                fetch('../resources/infinite-slow-response.py', { signal: parent.controller.signal }).then(() => {
+                  parent.postMessage('started', '*');
+                });
+                </script>
+                ">
+</iframe>
--- a/third_party/blink/renderer/core/fetch/body_stream_buffer.cc
+++ b/third_party/blink/renderer/core/fetch/body_stream_buffer.cc
@@ -423,6 +423,11 @@ bool BodyStreamBuffer::IsAborted() {
 }

 void BodyStreamBuffer::Abort() {
+  if (!Controller()) {
+    DCHECK(!GetExecutionContext());
+    DCHECK(!consumer_);
+    return;
+  }
  Controller()->GetError(DOMException::Create(DOMExceptionCode::kAbortError));
  CancelConsumer();
 }