Fix BlobBytesConsumer state assumption on cancellation

third_party/WebKit/Source/modules/fetch/BlobBytesConsumer.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/fetch/BlobBytesConsumer.h"
 
 #include "core/fetch/FetchInitiatorTypeNames.h"
 #include "core/loader/ThreadableLoader.h"
 #include "modules/fetch/BytesConsumerForDataConsumerHandle.h"
 #include "platform/blob/BlobData.h"
@@ skipping 213 matching lines @@
     return;
   DCHECK(!isClean());
   BytesConsumer::Client* client = m_client;
   close();
   if (client)
     client->onStateChange();
 }
 
 void BlobBytesConsumer::didFail(const ResourceError& e) {
   if (e.isCancellation()) {
-    DCHECK_EQ(PublicState::Closed, m_state);
-    return;
+    // |m_loader| can be canceled when
+    //  - this object explicitly cancels it, or
+    //  - the global context is shutting down.
+    // In the first case, |m_state| should be Closed.
+    if (getExecutionContext() && !getExecutionContext()->isContextDestroyed())
+      DCHECK_EQ(PublicState::Closed, m_state);
+    if (m_state == PublicState::Closed)
+      return;
   }
   DCHECK_EQ(PublicState::ReadableOrWaiting, m_state);
   m_loader = nullptr;
   BytesConsumer::Client* client = m_client;
   error();
   if (isClean()) {
     // This function is called synchronously in ThreadableLoader::start.
     return;
   }
   if (client) {
@@ skipping 52 matching lines @@
 void BlobBytesConsumer::clear() {
   DCHECK_NE(m_state, PublicState::ReadableOrWaiting);
   if (m_loader) {
     m_loader->cancel();
     m_loader = nullptr;
   }
   m_client = nullptr;
 }
 
 }  // namespace blink