M56: Messaging: Fix crash when MessagePort is closed while messages are queued

third_party/WebKit/Source/core/dom/MessagePort.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 172 matching lines @@
 
 bool MessagePort::tryGetMessage(
     RefPtr<SerializedScriptValue>& message,
     std::unique_ptr<MessagePortChannelArray>& channels) {
   if (!m_entangledChannel)
     return false;
   return tryGetMessageFrom(*m_entangledChannel, message, channels);
 }
 
 void MessagePort::dispatchMessages() {
-  // Because close() doesn't cancel any in flight calls to dispatchMessages() we
-  // need to check if the port is still open before dispatch.
-  if (m_closed)
-    return;
-
   // Messages for contexts that are not fully active get dispatched too, but
   // JSAbstractEventListener::handleEvent() doesn't call handlers for these.
   // The HTML5 spec specifies that any messages sent to a document that is not
   // fully active should be dropped, so this behavior is OK.
   if (!started())
     return;
 
-  RefPtr<SerializedScriptValue> message;
-  std::unique_ptr<MessagePortChannelArray> channels;
-  while (tryGetMessage(message, channels)) {
-    // close() in Worker onmessage handler should prevent next message from
-    // dispatching.
+  while (true) {
+    // Because close() doesn't cancel any in flight calls to dispatchMessages(),
+    // and can be triggered by the onmessage event handler, we need to check if
+    // the port is still open before each dispatch.
+    if (m_closed)
+      break;
+
+    // WorkerGlobalScope::close() in Worker onmessage handler should prevent
+    // the next message from dispatching.
     if (getExecutionContext()->isWorkerGlobalScope() &&
-        toWorkerGlobalScope(getExecutionContext())->isClosing())
-      return;
+        toWorkerGlobalScope(getExecutionContext())->isClosing()) {
+      break;
+    }
+
+    RefPtr<SerializedScriptValue> message;
+    std::unique_ptr<MessagePortChannelArray> channels;
+    if (!tryGetMessage(message, channels))
+      break;
 
     MessagePortArray* ports =
         MessagePort::entanglePorts(*getExecutionContext(), std::move(channels));
     Event* evt = MessageEvent::create(ports, message.release());
 
     dispatchEvent(evt);
   }
 }
 
 bool MessagePort::hasPendingActivity() const {
@@ skipping 60 matching lines @@
   }
   return portArray;
 }
 
 DEFINE_TRACE(MessagePort) {
   ActiveDOMObject::trace(visitor);
   EventTargetWithInlineData::trace(visitor);
 }
 
 }  // namespace blink