Try to fix crash when terminating a worker while it is XHR-ing to a blob.

Also add test to try to replicate the crash, although the best it seems to do is flakily DCHECKing. At least this CL seems to fix the DCHECK. Bug: 829859 Change-Id: I44f416d7c3edf68e2faf15c2eba7d582db947a0a Reviewed-on: https://chromium-review.googlesource.com/1014400 Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#551549}

Try to fix crash when terminating a worker while it is XHR-ing to a blob.
Also add test to try to replicate the crash, although the best it seems to do is flakily DCHECKing. At least this CL seems to fix the DCHECK. Bug: 829859 Change-Id: I44f416d7c3edf68e2faf15c2eba7d582db947a0a Reviewed-on: https://chromium-review.googlesource.com/1014400 Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#551549}
afb472c0 · Marijn Kruisselbrink · Commit Bot · f1291fb3 · afb472c0 · afb472c0
Commit afb472c0 authored Apr 18, 2018 by Marijn Kruisselbrink Committed by Commit Bot Apr 18, 2018
2 changed files
--- a/third_party/WebKit/LayoutTests/external/wpt/xhr/close-worker-with-xhr-in-progress.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/xhr/close-worker-with-xhr-in-progress.html
+<!doctype html>
+<html>
+<head>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  function workerCode(origin) {
+    const xhr = new XMLHttpRequest();
+    xhr.open('GET', origin + '/xhr/resources/image.gif?pipe=trickle(100:d2)', true);
+    xhr.responseType = 'blob';
+    xhr.send();
+    postMessage('sent');
+  }
+
+  const workerBlob = new Blob([workerCode.toString() + ";workerCode('" + location.origin + "');"], {type:"application/javascript"});
+  const w = new Worker(URL.createObjectURL(workerBlob));
+  w.onmessage = t.step_func(e => {
+    assert_equals(e.data, 'sent');
+    t.step_timeout(t.step_func(() => {
+      w.terminate();
+      t.step_timeout(t.step_func_done(() => {}), 500);
+    }, 100));
+  });
+}, 'Terminating a worker with a XHR in progress doesn\'t crash');
+</script>
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
@@ -628,12 +628,15 @@ void ResourceLoader::DidStartLoadingResponseBody(
  mojom::blink::ProgressClientAssociatedPtrInfo progress_client_ptr;
  progress_binding_.Bind(MakeRequest(&progress_client_ptr));

+  // Callback is bound to a WeakPersistent, as ResourceLoader is kept alive by
+  // ResourceFetcher as long as we still care about the result of the load.
  mojom::blink::BlobRegistry* blob_registry = BlobDataHandle::GetBlobRegistry();
  blob_registry->RegisterFromStream(
      mime_type.IsNull() ? g_empty_string : mime_type.LowerASCII(), "",
      std::max(0ll, response.ExpectedContentLength()), std::move(body),
      std::move(progress_client_ptr),
-      WTF::Bind(&ResourceLoader::FinishedCreatingBlob, WrapPersistent(this)));
+      WTF::Bind(&ResourceLoader::FinishedCreatingBlob,
+                WrapWeakPersistent(this)));
 }

 void ResourceLoader::DidDownloadData(int length, int encoded_data_length) {