Prevent access to null handler in RTCDataChannel.

third_party/WebKit/Source/modules/peerconnection/RTCDataChannel.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "modules/peerconnection/RTCDataChannel.h"
 
 #include <memory>
+#include <utility>
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/DOMArrayBufferView.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/dom/TaskRunnerHelper.h"
 #include "core/events/MessageEvent.h"
 #include "core/fileapi/Blob.h"
 #include "modules/peerconnection/RTCPeerConnection.h"
 #include "platform/wtf/PtrUtil.h"
@@ skipping 199 matching lines @@
     ThrowCouldNotSendDataException(exception_state);
   }
 }
 
 void RTCDataChannel::send(Blob* data, ExceptionState& exception_state) {
   // FIXME: implement
   ThrowNoBlobSupportException(exception_state);
 }
 
 void RTCDataChannel::close() {
-  handler_->Close();
+  if (handler_)
+    handler_->Close();
 }
 
 void RTCDataChannel::DidChangeReadyState(
     WebRTCDataChannelHandlerClient::ReadyState new_state) {
   if (ready_state_ == kReadyStateClosed)
     return;
 
   ready_state_ = new_state;
 
   switch (ready_state_) {
@@ skipping 54 matching lines @@
     scheduled_event_timer_.StartOneShot(0, BLINK_FROM_HERE);
 }
 
 void RTCDataChannel::ContextDestroyed(ExecutionContext*) {
   if (stopped_)
     return;
 
   stopped_ = true;
   handler_->SetClient(nullptr);
   handler_.reset();
+  ready_state_ = kReadyStateClosed;
 }
 
 // ActiveScriptWrappable
 bool RTCDataChannel::HasPendingActivity() const {
   if (stopped_)
     return false;
 
   // A RTCDataChannel object must not be garbage collected if its
   // * readyState is connecting and at least one event listener is registered
   //   for open events, message events, error events, or close events.
@@ skipping 43 matching lines @@
   events.clear();
 }
 
 DEFINE_TRACE(RTCDataChannel) {
   visitor->Trace(scheduled_events_);
   EventTargetWithInlineData::Trace(visitor);
   SuspendableObject::Trace(visitor);
 }
 
 }  // namespace blink