Fix crash on incorrectly formatted MHTML documents

Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 268 matching lines @@
     if (!responseEndTime)
         responseEndTime = m_timeOfLastDataReceived;
     if (!responseEndTime)
         responseEndTime = monotonicallyIncreasingTime();
     timing()->setResponseEnd(responseEndTime);
 
     commitIfReady();
     if (!frameLoader())
         return;
 
-    if (isArchiveMIMEType(m_response.mimeType())) {
-        createArchive();
-    } else {
+    if (!isArchiveMIMEType(m_response.mimeType()) || !createArchive()) {

[Nate Chapin, 2014/01/06 23:04:11]

Should we consider changing this function's name back to maybeCreateArchive()
and move the isArchiveMIMEType() check into it?

That's how this code was a few months ago. I'm debating which one is more
readable.

[Inactive, 2014/01/07 00:38:17]

Done.

         // If this is an empty document, it will not have actually been created yet. Commit dummy data so that
         // DocumentWriter::begin() gets called and creates the Document.
         if (!m_writer)
             commitData(0, 0);
     }
 
     endWriting(m_writer.get());
 
     if (!m_mainDocumentError.isNull())
         return;
@@ skipping 336 matching lines @@
         if (doc->isDelayingLoadEvent() && !doc->loadEventFinished())
             return true;
         if (doc->processingLoadEvent())
             return true;
         if (doc->hasActiveParser())
             return true;
     }
     return frameLoader()->subframeIsLoading();
 }
 
-void DocumentLoader::createArchive()
+bool DocumentLoader::createArchive()
 {
     ASSERT(m_mainResource);
     m_archive = MHTMLArchive::create(m_response.url(), m_mainResource->resourceBuffer());
-    RELEASE_ASSERT(m_archive);
+    // Invalid MHTML.
+    if (!m_archive || !m_archive->mainResource()) {
+        m_archive.clear();
+        return false;
+    }
 
     addAllArchiveResources(m_archive.get());
     ArchiveResource* mainResource = m_archive->mainResource();
 
     // The origin is the MHTML file, we need to set the base URL to the document encoded in the MHTML so
     // relative URLs are resolved properly.
     ensureWriter(mainResource->mimeType(), m_archive->mainResource()->url());
 
     commitData(mainResource->data()->data(), mainResource->data()->size());
+    return true;
 }
 
 void DocumentLoader::addAllArchiveResources(MHTMLArchive* archive)
 {
     ASSERT(archive);
     if (!m_archiveResourceCollection)
         m_archiveResourceCollection = adoptPtr(new ArchiveResourceCollection);
     m_archiveResourceCollection->addAllResources(archive);
 }
 
@@ skipping 216 matching lines @@
 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader().stopAllLoaders();
     m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url(), mimeType(), m_writer ? m_writer->encoding() : emptyAtom,  m_writer ? m_writer->encodingWasChosenByUser() : false, true);
     if (!source.isNull())
         m_writer->appendReplacingData(source);
     endWriting(m_writer.get());
 }
 
 } // namespace WebCore