[WebSocket] Fix a crash caused by a pending empty frame.

net/websockets/websocket_channel.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/websockets/websocket_channel.h"
 
 #include <limits.h>  // for INT_MAX
 
 #include <algorithm>
 #include <deque>
@@ skipping 389 matching lines @@
   DCHECK_LE(quota, INT_MAX);
   if (!pending_received_frames_.empty()) {
     DCHECK_EQ(0, current_receive_quota_);
   }
   while (!pending_received_frames_.empty() && quota > 0) {
     PendingReceivedFrame& front = pending_received_frames_.front();
     const size_t data_size = front.size() - front.offset();
     const size_t bytes_to_send =
         std::min(base::checked_cast<size_t>(quota), data_size);
     const bool final = front.final() && data_size == bytes_to_send;
-    const char* data = front.data()->data() + front.offset();
+    const char* data = front.data() ?
+        front.data()->data() + front.offset() : NULL;
     const std::vector<char> data_vector(data, data + bytes_to_send);

[Adam Rice, 2014/04/28 04:30:08]

It would be nice to have a check like

if (bytes_to_send)
  DCHECK(data);

here.

[yhirano, 2014/04/28 04:38:16]

Done.

     DVLOG(3) << "Sending frame previously split due to quota to the "
              << "renderer: quota=" << quota << " data_size=" << data_size
              << " bytes_to_send=" << bytes_to_send;
     if (event_interface_->OnDataFrame(final, front.opcode(), data_vector) ==
         CHANNEL_DELETED)
       return;
     if (bytes_to_send < data_size) {
       front.DidConsume(bytes_to_send);
       front.ResetOpcode();
       return;
@@ skipping 641 matching lines @@
 
 void WebSocketChannel::CloseTimeout() {
   stream_->Close();
   DCHECK_NE(CLOSED, state_);
   state_ = CLOSED;
   AllowUnused(DoDropChannel(false, kWebSocketErrorAbnormalClosure, ""));
   // |this| has been deleted.
 }
 
 }  // namespace net