ReadableStreamBytesConsumer should check read results

ReadableStreamBytesConsumer expected that the results from
ReadableStreamReaderDefaultRead should be Promise<Object> because that
is provided from ReadableStream provided by blink, but it's possible to
inject arbitrary values with the promise assimilation.

This CL adds additional checks for such injection.

Bug: 840320
Change-Id: I7b3c6a8bfcf563dd860b133ff0295dd7a5d5fea5
Reviewed-on: https://chromium-review.googlesource.com/1049413
Commit-Queue: Yutaka Hirano <[email protected]>
Reviewed-by: Adam Rice <[email protected]>
Cr-Commit-Position: refs/heads/master@{#556751}

fetch/api/response/response-stream-with-broken-then.any.js

@@ -0,0 +1,75 @@
+// META: script=../resources/utils.js
+
+promise_test(async () => {
+  add_completion_callback(() => delete Object.prototype.then);
+  const hello = new TextEncoder().encode('hello');
+  const bye = new TextEncoder().encode('bye');
+  const rs = new ReadableStream({
+    start(controller) {
+      controller.enqueue(hello);
+      controller.close();
+    }
+  });
+  const resp = new Response(rs);
+  Object.prototype.then = (onFulfilled) => {
+    delete Object.prototype.then;
+    onFulfilled({done: false, value: bye});
+  };
+  const text = await resp.text();
+  assert_equals(text, 'bye', 'The valud should be replaced with "bye".');
+}, 'Inject {done: false, value: bye} via Object.prototype.then.');
+
+promise_test(async (t) => {
+  add_completion_callback(() => delete Object.prototype.then);
+  const hello = new TextEncoder().encode('hello');
+  const rs = new ReadableStream({
+    start(controller) {
+      controller.enqueue(hello);
+      controller.close();
+    }
+  });
+  const resp = new Response(rs);
+  Object.prototype.then = (onFulfilled) => {
+    delete Object.prototype.then;
+    onFulfilled({done: false, value: undefined});
+  };
+  promise_rejects(t, TypeError(), resp.text(),
+      'The value should be replaced with undefined.');
+}, 'Inject {done: false, value: undefined} via Object.prototype.then.');
+
+promise_test(async (t) => {
+  add_completion_callback(() => delete Object.prototype.then);
+  const hello = new TextEncoder().encode('hello');
+  const rs = new ReadableStream({
+    start(controller) {
+      controller.enqueue(hello);
+      controller.close();
+    }
+  });
+  const resp = new Response(rs);
+  Object.prototype.then = (onFulfilled) => {
+    delete Object.prototype.then;
+    onFulfilled(undefined);
+  };
+  promise_rejects(t, TypeError(), resp.text(),
+      'The read result should be replaced with undefined.');
+}, 'Inject undefined via Object.prototype.then.');
+
+promise_test(async (t) => {
+  add_completion_callback(() => delete Object.prototype.then);
+  const hello = new TextEncoder().encode('hello');
+  const rs = new ReadableStream({
+    start(controller) {
+      controller.enqueue(hello);
+      controller.close();
+    }
+  });
+  const resp = new Response(rs);
+  Object.prototype.then = (onFulfilled) => {
+    delete Object.prototype.then;
+    onFulfilled(8.2);
+  };
+  promise_rejects(t, TypeError(), resp.text(),
+      'The read result should be replaced with a number.');
+}, 'Inject 8.2 via Object.prototype.then.');
+