Fix BackgroundURLLoader bug of handling redirect

Fixed: 1504317
Change-Id: I492d355590e412dc7cbc453d9072bc479c05e966
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5082996
Reviewed-by: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1232559}

third_party/blink/renderer/platform/loader/fetch/url_loader/background_url_loader_unittest.cc

@@ -622,6 +622,38 @@ TEST_F(BackgroundResourceFecherTest, RedirectAndCancelDoNotCrash) {
   EXPECT_TRUE(redirected_url.IsEmpty());
 }
 
+TEST_F(BackgroundResourceFecherTest, AbortWhileHandlingRedirectDoNotCrash) {
+  FakeURLLoaderClient client(freezable_task_runner_);
+  KURL redirected_url;
+  client.AddWillFollowRedirectCallback(
+      base::BindLambdaForTesting([&](const WebURL& new_url) {
+        redirected_url = new_url;
+        return true;
+      }));
+  auto background_url_loader =
+      CreateBackgroundURLLoaderAndStart(CreateTestRequest(), &client);
+
+  mojo::Remote<network::mojom::URLLoaderClient> loader_client_remote(
+      std::move(loader_client_pending_remote_));
+  FakeURLLoader loader(std::move(loader_pending_receiver_));
+
+  net::RedirectInfo redirect_info;
+  redirect_info.new_url = GURL(kRedirectedURL);
+
+  loader_client_remote->OnReceiveRedirect(
+      redirect_info, network::mojom::URLResponseHead::New());
+  loader_client_remote->OnComplete(
+      network::URLLoaderCompletionStatus(net::ERR_FAILED));
+
+  // Call RunUntilIdle() to receive Mojo IPC.
+  task_environment_.RunUntilIdle();
+
+  EXPECT_TRUE(redirected_url.IsEmpty());
+  freezable_task_runner_->RunUntilIdle();
+  EXPECT_FALSE(redirected_url.IsEmpty());
+  task_environment_.RunUntilIdle();
+}
+
 TEST_F(BackgroundResourceFecherTest, CancelSoonAfterStart) {
   base::WaitableEvent waitable_event(
       base::WaitableEvent::ResetPolicy::MANUAL,

third_party/blink/renderer/platform/loader/fetch/url_loader/resource_request_sender.cc

@@ -798,6 +798,10 @@ void ResourceRequestSender::OnFollowRedirectCallback(
   if (!request_info_) {
     return;
   }
+  if (request_info_->net_error != net::ERR_IO_PENDING) {
+    // The request has been completed.
+    return;
+  }
 
   // TODO(yoav): If request_info doesn't change above, we could avoid this
   // copy.