Fix crash in CSSStyleSheetResource::appendData

third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.cpp

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 224 matching lines @@
     m_rule.clear();
     m_ruleValue.clear();
 }
 
 CSSPreloaderResourceClient::CSSPreloaderResourceClient(Resource* resource, HTMLResourcePreloader* preloader)
     : m_resource(resource)
     , m_preloader(preloader)
 {
 }
 
+void CSSPreloaderResourceClient::stopObserving()
+{
+    if (m_resource) {
+        m_resource->removeClient(this);
+        m_resource.clear();
+    }
+}
+
+CSSPreloaderResourceClient::~CSSPreloaderResourceClient()
+{
+    stopObserving();

[Nate Chapin, 2016/05/03 18:25:30]

Alternately, you can have CSSPreloaderResourceClient inherit
ResourceOwner<CSSStyleSheetResource>.

[Charlie Harrison, 2016/05/03 20:32:11]

Very good point. Thanks for the suggestion.

+}
+
 void CSSPreloaderResourceClient::notifyFinished(Resource* resource)
 {
-    resource->removeClient(this);
-    m_resource.clear();
+    stopObserving();
 }
 
 // Only attach for one appendData call, as that's where most imports will likely
 // be (according to spec).
 void CSSPreloaderResourceClient::didAppendFirstData(const CSSStyleSheetResource* resource)
 {
     const String& chunk = resource->decodedText();
     if (!chunk.isNull() && m_preloader) {
         CSSPreloadScanner cssPreloadScanner;
         PreloadRequestStream preloads;
         // Passing an empty SegmentedString here results in PreloadRequests
         // with no file/line information.
         // TODO(csharrison): If this becomes an issue the CSSPreloadScanner
         // may be augmented to take care of this case without performing an
         // additional copy.
         cssPreloadScanner.scan(chunk, SegmentedString(), preloads, resource->response().url());
         int currentPreloadCount = m_preloader->countPreloads();
         m_preloader->takeAndPreload(preloads);
         DEFINE_STATIC_LOCAL(CustomCountHistogram, cssImportHistogram, ("PreloadScanner.ExternalCSS.PreloadCount", 1, 100, 50));
         cssImportHistogram.count(m_preloader->countPreloads() - currentPreloadCount);
     }
-    m_resource->removeClient(this);
-    m_resource.clear();
+    stopObserving();
 }
 
 } // namespace blink