[release-branch.go1.11] net/http: ensure null body in Fetch response is not read

The Fetch API returns a null body if there is no response body,
on browsers that support streaming the response body. This
change ensures we check for both undefined and null bodies
before attempting to read the body.

Fixes #27424

Change-Id: I0da86b61284fe394418b4b431495e715a037f335
Reviewed-on: https://go-review.googlesource.com/131236
Reviewed-by: Richard Musiol <neelance@gmail.com>
Run-TryBot: Richard Musiol <neelance@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
(cherry picked from commit ce536837d8e53f1bf0c7ef450d4580d19f7d6f52)
Reviewed-on: https://go-review.googlesource.com/136915

diff --git a/src/net/http/roundtrip_js.go b/src/net/http/roundtrip_js.go
index 16b7b891c86b1562763640ea97f078ee33a25fd8..38e4f5573e60edcb7afcd9c9ae480e4c0395191a 100644 (file)
--- a/src/net/http/roundtrip_js.go
+++ b/src/net/http/roundtrip_js.go
@@ -116,7 +116,9 @@ func (t *Transport) RoundTrip(req *Request) (*Response, error) {
 
                b := result.Get("body")
                var body io.ReadCloser
-               if b != js.Undefined() {
+               // The body is undefined when the browser does not support streaming response bodies (Firefox),
+               // and null in certain error cases, i.e. when the request is blocked because of CORS settings.
+               if b != js.Undefined() && b != js.Null() {
                        body = &streamReader{stream: b.Call("getReader")}
                } else {
                        // Fall back to using ArrayBuffer