Fix memory corruption related to load blocking resource move

third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

Index: third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 1c9fd3a59b1b6274383c87e2b2060006e5405300..063feee2580f440cc4f9fa56d9f9bf0575fcc3a4 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
@@ -451,6 +451,7 @@ void ResourceFetcher::moveCachedNonBlockingResourceToBlocking(
   // to not-block even after being preloaded and discovered.
   if (resource && resource->loader() &&
       resource->isLoadEventBlockingResourceType() &&
+      m_nonBlockingLoaders.contains(resource->loader()) &&
       resource->isLinkPreload() && !request.forPreload()) {
     m_nonBlockingLoaders.remove(resource->loader());
     m_loaders.add(resource->loader());
@@ -1280,6 +1281,7 @@ void ResourceFetcher::acceptDataFromThreadedReceiver(unsigned long identifier,
 }
 
 void ResourceFetcher::moveResourceLoaderToNonBlocking(ResourceLoader* loader) {
+  DCHECK(loader);
   m_nonBlockingLoaders.add(loader);
   m_loaders.remove(loader);

[bokan, 2016/11/30 14:52:42]

Should we check that loader is in m_loaders here too? Maybe at least a DCHECK?

[Yoav Weiss, 2016/11/30 16:11:42]

That makes sense. Not sure how to exercise that code with an indirect test...

[Charlie Harrison, 2016/11/30 16:51:33]

I think we can DCHECK, afaict.

[bokan, 2016/11/30 17:01:22]

I would DCHECK and add an early return since otherwise we end up hanging the
renderer in shipped builds that don't DCHECK. Here and the other DCHECKs.

 }
@@ -1324,6 +1326,7 @@ bool ResourceFetcher::startLoad(Resource* resource) {
 }
 
 void ResourceFetcher::removeResourceLoader(ResourceLoader* loader) {
+  DCHECK(loader);
   if (m_loaders.contains(loader))
     m_loaders.remove(loader);
   else if (m_nonBlockingLoaders.contains(loader))