Fix MessagePort race exposed by blink scheduler

Source/core/dom/MessagePort.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 165 matching lines @@
         channels = adoptPtr(new MessagePortChannelArray(webChannels.size()));
         for (size_t i = 0; i < webChannels.size(); ++i)
             (*channels)[i] = adoptPtr(webChannels[i]);
     }
     message = SerializedScriptValue::createFromWire(messageString);
     return true;
 }
 
 void MessagePort::dispatchMessages()
 {
+    // Because close() doesn't cancel any in flight calls to dispatchMessages() we need to check if the port is still open before dispatch.
+    if (m_closed)
+        return;
+
     // Messages for contexts that are not fully active get dispatched too, but JSAbstractEventListener::handleEvent() doesn't call handlers for these.
     // The HTML5 spec specifies that any messages sent to a document that is not fully active should be dropped, so this behavior is OK.
     if (!started())
         return;
 
     RefPtr<SerializedScriptValue> message;
     OwnPtr<MessagePortChannelArray> channels;
     while (m_entangledChannel && tryGetMessageFrom(*m_entangledChannel, message, channels)) {
         // close() in Worker onmessage handler should prevent next message from dispatching.
         if (executionContext()->isWorkerGlobalScope() && toWorkerGlobalScope(executionContext())->isClosing())
@@ skipping 53 matching lines @@
     OwnPtrWillBeRawPtr<MessagePortArray> portArray = adoptPtrWillBeNoop(new MessagePortArray(channels->size()));
     for (unsigned i = 0; i < channels->size(); ++i) {
         RefPtrWillBeRawPtr<MessagePort> port = MessagePort::create(context);
         port->entangle((*channels)[i].release());
         (*portArray)[i] = port.release();
     }
     return portArray.release();
 }
 
 } // namespace blink