Fix memory corruption related to load blocking resource move

third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

Index: third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 00d807218a61299fbaa8e77c23990a47be8d5ece..1cc43eebaa89da6c79a3827109c1f09064b3468d 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
@@ -451,6 +451,7 @@ void ResourceFetcher::moveCachedNonBlockingResourceToBlocking(
   // to not-block even after being preloaded and discovered.
   if (resource && resource->loader() &&
       resource->isLoadEventBlockingResourceType() &&
+      m_nonBlockingLoaders.contains(resource->loader()) &&
       resource->isLinkPreload() && !request.forPreload()) {
     m_nonBlockingLoaders.remove(resource->loader());
     m_loaders.add(resource->loader());
@@ -1282,6 +1283,9 @@ void ResourceFetcher::acceptDataFromThreadedReceiver(unsigned long identifier,
 }
 
 void ResourceFetcher::moveResourceLoaderToNonBlocking(ResourceLoader* loader) {
+  DCHECK(loader);
+  // TODO(yoav): Convert CHECK to DCHECK if no crash reports come in.
+  CHECK(m_loaders.contains(loader));
   m_nonBlockingLoaders.add(loader);
   m_loaders.remove(loader);
 }
@@ -1326,6 +1330,7 @@ bool ResourceFetcher::startLoad(Resource* resource) {
 }
 
 void ResourceFetcher::removeResourceLoader(ResourceLoader* loader) {
+  DCHECK(loader);
   if (m_loaders.contains(loader))
     m_loaders.remove(loader);
   else if (m_nonBlockingLoaders.contains(loader))