BodyStreamBuffer's drainAs* function should lock stream

third_party/WebKit/Source/modules/fetch/FetchManager.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/fetch/FetchManager.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8ThrowException.h"
@@ skipping 548 matching lines @@
     request.setHTTPMethod(m_request->method());
     request.setFetchRequestMode(m_request->mode());
     request.setFetchCredentialsMode(m_request->credentials());
     const Vector<OwnPtr<FetchHeaderList::Header>>& list = m_request->headerList()->list();
     for (size_t i = 0; i < list.size(); ++i) {
         request.addHTTPHeaderField(AtomicString(list[i]->first), AtomicString(list[i]->second));
     }
 
     if (m_request->method() != HTTPNames::GET && m_request->method() != HTTPNames::HEAD) {
         if (m_request->buffer())
-            request.setHTTPBody(m_request->buffer()->drainAsFormData());
+            request.setHTTPBody(m_request->buffer()->drainAsFormData(m_executionContext));
         if (m_request->attachedCredential())
             request.setAttachedCredential(m_request->attachedCredential());
     }
     request.setFetchRedirectMode(m_request->redirect());
     request.setUseStreamOnResponse(true);
     request.setExternalRequestStateFromRequestorAddressSpace(m_executionContext->securityContext().addressSpace());
 
     // "2. Append `Referer`/empty byte sequence, if |HTTPRequest|'s |referrer|
     // is none, and `Referer`/|HTTPRequest|'s referrer, serialized and utf-8
     // encoded, otherwise, to HTTPRequest's header list.
@@ skipping 159 matching lines @@
     loader->dispose();
 }
 
 DEFINE_TRACE(FetchManager)
 {
     visitor->trace(m_loaders);
     ContextLifecycleObserver::trace(visitor);
 }
 
 } // namespace blink