Fix for codeplex #1996 - Nullref on 404 with webapi batching

The issue here is that one of the requests in a batch was matched by an
MVC route when running in web host.

The batch handler uses HttpServer to invoke the individual requests.
Internally the HttpServer forwards the request to an
HttpRoutingDispatcher.

In the web host case, the HttpRoutingDispatcher has a reference to
HostedHttpRouteCollection - which is implemented by matching BOTH WebAPI
and MVC (System.Web) routes. If an MVC route matches, then the produced
IHttpRouteData instance doesn't have its .Route property set as the
underlying route that matched does not implement IHttpRoute.

This causes attribute routing in the controller selector to fail, as we
did not anticipate this case.

Followup filed to consider whether or not this is the right behavior for
the dispatcher/route-collection.

Author: rynowak

src/System.Web.Http/Routing/HttpRouteDataExtensions.cs

@@ -72,10 +72,22 @@ internal static CandidateAction[] GetDirectRouteCandidates(this IHttpRouteData r
         {
             Contract.Assert(routeData != null);
             IEnumerable<IHttpRouteData> subRoutes = routeData.GetSubRoutes();
+
+            // Possible this is being called on a subroute. This can happen after ElevateRouteData. Just chain. 
             if (subRoutes == null)
             {
-                // Possible this is being called on a subroute. This can happen after ElevateRouteData. Just chain. 
-                return routeData.Route.GetDirectRouteCandidates();
+                if (routeData.Route == null)
+                {
+                    // If the matched route is a System.Web.Routing.Route (in web host) then routeData.Route
+                    // will be null. Normally a System.Web.Routing.Route match would go through an MVC handler
+                    // but we can get here through HttpRoutingDispatcher in WebAPI batching. If that happens, 
+                    // then obviously it's not a WebAPI attribute routing match.
+                    return null;
+                }
+                else
+                {
+                    return routeData.Route.GetDirectRouteCandidates();
+                }
             }
 
             var list = new List<CandidateAction>();

test/System.Web.Http.Test/Dispatcher/DefaultHttpControllerSelectorTest.cs

@@ -1,5 +1,6 @@
 // Copyright (c) Microsoft Open Technologies, Inc. All rights reserved. See License.txt in the project root for license information.
 
+using System.Collections.Generic;
 using System.Collections.ObjectModel;
 using System.Linq;
 using System.Net;
@@ -290,6 +291,77 @@ public void SelectController_Throws_NotFound_NoRouteData()
             Assert.Equal(HttpStatusCode.NotFound, ex.Response.StatusCode);
         }
 
+        // We ignore attribute routes when RouteData.Route is null
+        // See: https://aspnetwebstack.codeplex.com/workitem/1996
+        [Fact]
+        public void SelectController_WhenRouteData_RouteIsNull_FindsController()
+        {
+            // Arrange
+            HttpConfiguration configuration = new HttpConfiguration();
+            Mock<IHttpControllerTypeResolver> controllerTypeResolver = new Mock<IHttpControllerTypeResolver>();
+            configuration.Services.Replace(typeof(IHttpControllerTypeResolver), controllerTypeResolver.Object);
+
+            Type controllerType = GetMockControllerType("Sample");
+            controllerTypeResolver
+                .Setup(c => c.GetControllerTypes(It.IsAny<IAssembliesResolver>()))
+                .Returns(new Collection<Type> { controllerType });
+
+            HttpRequestMessage request = new HttpRequestMessage();
+
+            var routeValues = new Dictionary<string, object>(StringComparer.Ordinal)
+            {
+                { "controller", "Sample" }
+            };
+
+            var routeData = new Mock<IHttpRouteData>();
+            routeData.SetupGet(rd => rd.Values).Returns(routeValues);
+            routeData.SetupGet(rd => rd.Route).Returns((IHttpRoute)null);
+            request.SetRouteData(routeData.Object);
+
+            DefaultHttpControllerSelector selector = new DefaultHttpControllerSelector(configuration);
+
+            // Act 
+            var controller = selector.SelectController(request);
+
+            // Assert
+            Assert.Equal(controllerType, controller.ControllerType);
+        }
+
+        // We ignore attribute routes when RouteData.Route is null
+        // See: https://aspnetwebstack.codeplex.com/workitem/1996
+        [Fact]
+        public void SelectController_WhenRouteData_RouteIsNull_DoesNotFindController()
+        {
+            // Arrange
+            HttpConfiguration configuration = new HttpConfiguration();
+            Mock<IHttpControllerTypeResolver> controllerTypeResolver = new Mock<IHttpControllerTypeResolver>();
+            configuration.Services.Replace(typeof(IHttpControllerTypeResolver), controllerTypeResolver.Object);
+
+            controllerTypeResolver
+                .Setup(c => c.GetControllerTypes(It.IsAny<IAssembliesResolver>()))
+                .Returns(new Collection<Type> {}); // No controllers here
+
+            HttpRequestMessage request = new HttpRequestMessage();
+
+            var routeValues = new Dictionary<string, object>(StringComparer.Ordinal)
+            {
+                { "controller", "Sample" }
+            };
+
+            var routeData = new Mock<IHttpRouteData>();
+            routeData.SetupGet(rd => rd.Values).Returns(routeValues);
+            routeData.SetupGet(rd => rd.Route).Returns((IHttpRoute)null);
+            request.SetRouteData(routeData.Object);
+
+            DefaultHttpControllerSelector selector = new DefaultHttpControllerSelector(configuration);
+
+            // Act 
+            var ex = Assert.Throws<HttpResponseException>(
+                () => selector.SelectController(request));
+
+            // Assert
+            Assert.Equal(HttpStatusCode.NotFound, ex.Response.StatusCode);
+        }
 
         [Fact]
         public void SelectController_Throws_NotFound_NoMatchingControllerType()