Fix crash in CSSStyleSheetResource::appendData

third_party/WebKit/Source/core/fetch/CSSStyleSheetResource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 84 matching lines @@
     if (!m_decodedSheetText.isNull())
         return m_decodedSheetText;
 
     // Don't cache the decoded text, regenerating is cheap and it can use quite a bit of memory
     return decodedText();
 }
 
 void CSSStyleSheetResource::appendData(const char* data, size_t length)
 {
     Resource::appendData(data, length);
+    if (!m_data)

[Nate Chapin, 2016/05/02 19:00:43]

This should only be possible when m_options.dataBufferingPolicy ==
DoNotBufferData, but it doesn't look like CSSStyleSheetResource loads ever use
DoNotBufferData.

[Charlie Harrison, 2016/05/02 19:27:56]

Ah good point.

+        return;
     if (m_didNotifyFirstData)
         return;
     ResourceClientWalker<StyleSheetResourceClient> w(m_clients);
     while (StyleSheetResourceClient* c = w.next())
         c->didAppendFirstData(this);

[Nate Chapin, 2016/05/02 19:00:43]

I'm wondering whether this bug is happening when there are multiple m_clients,
and one of the clients cancels the load (thus clearing m_data) inside
didAppendFirstData(), causing the next client to crash.

[Charlie Harrison, 2016/05/02 19:27:56]

Hm well there's only one client of didAppendFirstData and they don't cancel any
loads.

     m_didNotifyFirstData = true;
 }
 
 void CSSStyleSheetResource::checkNotify()
 {
     // Decode the data to find out the encoding and keep the sheet text around during checkNotify()
     if (m_data)
         m_decodedSheetText = decodedText();
 
     ResourceClientWalker<StyleSheetResourceClient> w(m_clients);
@@ skipping 69 matching lines @@
 
     setDecodedSize(m_parsedStyleSheetCache->estimatedSizeInBytes());
 
     // Check if this stylesheet resource didn't conflict with
     // another resource and has indeed been added to the cache.
     if (memoryCache()->contains(this))
         m_parsedStyleSheetCache->addedToMemoryCache();
 }
 
 } // namespace blink