(Merge to M46) Fix crash with null ServiceWorkerProviderHost in DidDispatchFetchEvent

content/browser/service_worker/service_worker_url_request_job.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_url_request_job.h"
 
 #include <map>
 #include <string>
 #include <vector>
 
@@ skipping 571 matching lines @@
     scoped_refptr<ServiceWorkerVersion> version) {
   fetch_dispatcher_.reset();
   ServiceWorkerMetrics::RecordFetchEventStatus(is_main_resource_load_, status);
 
   // Check if we're not orphaned.
   if (!request()) {
     RecordResult(ServiceWorkerMetrics::REQUEST_JOB_ERROR_NO_REQUEST);
     return;
   }
 
+  // A null |provider_host_| probably means the tab was closed. The null value
+  // would cause problems down the line, so bail out.
+  if (!provider_host_) {
+    RecordResult(ServiceWorkerMetrics::REQUEST_JOB_ERROR_NO_PROVIDER_HOST);
+    DeliverErrorResponse();
+    return;
+  }
+
   if (status != SERVICE_WORKER_OK) {
     RecordResult(ServiceWorkerMetrics::REQUEST_JOB_ERROR_FETCH_EVENT_DISPATCH);
     if (is_main_resource_load_) {
       // Using the service worker failed, so fallback to network. Detach the
       // controller so subresource requests also skip the worker.
       provider_host_->NotifyControllerLost();
       response_type_ = FALLBACK_TO_NETWORK;
       NotifyRestartRequired();
     } else {
       DeliverErrorResponse();
@@ skipping 202 matching lines @@
   }
   if (!waiting_stream_url_.is_empty()) {
     StreamRegistry* stream_registry =
         GetStreamContextForResourceContext(resource_context_)->registry();
     stream_registry->RemoveRegisterObserver(waiting_stream_url_);
     stream_registry->AbortPendingStream(waiting_stream_url_);
   }
 }
 
 }  // namespace content