[Backport] CVE-2020-6407: Out of bounds memory access in streams

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/2032471
https://chromium-review.googlesource.com/c/chromium/src/+/2060221:
Streams: Convert state DCHECKs to CHECKs

Merge to release branch 3987. Original description:

For "cheap" checks of state in the streams implementation, use CHECKs
instead of DCHECKs. This will improve robustness against logic errors.

BUG=1045931
TBR=yhirano@chromium.org

(cherry picked from commit 122b074f0354079f3d9044cc14890dcfd2d72918)
Change-Id: Ide564096a4aeb05e0e09a8fad9056b617dbcaf31
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>

1 files changed, 3 insertions, 3 deletions

diff --git a/chromium/third_party/blink/renderer/core/streams/readable_stream_default_controller.cc b/chromium/third_party/blink/renderer/core/streams/readable_stream_default_controller.cc
index 653cab070a3..d9e69a72280 100644
--- a/chromium/third_party/blink/renderer/core/streams/readable_stream_default_controller.cc
+++ b/chromium/third_party/blink/renderer/core/streams/readable_stream_default_controller.cc
@@ -110,7 +110,7 @@ void ReadableStreamDefaultController::Close(
 
   // 2. Assert: ! ReadableStreamDefaultControllerCanCloseOrEnqueue(controller)
   //    is true.
-  DCHECK(CanCloseOrEnqueue(controller));
+  CHECK(CanCloseOrEnqueue(controller));
 
   // 3. Set controller.[[closeRequested]] to true.
   controller->is_close_requested_ = true;
@@ -136,7 +136,7 @@ void ReadableStreamDefaultController::Enqueue(
 
   // 2. Assert: ! ReadableStreamDefaultControllerCanCloseOrEnqueue(controller)
   //    is true.
-  DCHECK(CanCloseOrEnqueue(controller));
+  CHECK(CanCloseOrEnqueue(controller));
 
   // 3. If ! IsReadableStreamLocked(stream) is true and !
   //    ReadableStreamGetNumReadRequests(stream) > 0, perform !
@@ -261,7 +261,7 @@ const char* ReadableStreamDefaultController::EnqueueExceptionMessage(
   if (state == ReadableStreamNative::kErrored) {
     return "Cannot enqueue a chunk into an errored readable stream";
   }
-  DCHECK(state == ReadableStreamNative::kClosed);
+  CHECK(state == ReadableStreamNative::kClosed);
   return "Cannot enqueue a chunk into a closed readable stream";
 }