Repository: trafficserver Updated Branches: refs/heads/6.0.x 13190b9e5 -> 1de699ac2
TS-4011: HTTP/2 coredump with NULL FetchSM, another one (cherry picked from commit 0d8f083341300f7dfb384b4139c34d53a843c52d) Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/1de699ac Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/1de699ac Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/1de699ac Branch: refs/heads/6.0.x Commit: 1de699ac20ce79325311e3d864187eed8d040f97 Parents: 13190b9 Author: Bryan Call <[email protected]> Authored: Tue Nov 10 10:54:43 2015 -0800 Committer: Bryan Call <[email protected]> Committed: Thu Nov 19 16:44:27 2015 -0800 ---------------------------------------------------------------------- proxy/http2/Http2ConnectionState.cc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/1de699ac/proxy/http2/Http2ConnectionState.cc ---------------------------------------------------------------------- diff --git a/proxy/http2/Http2ConnectionState.cc b/proxy/http2/Http2ConnectionState.cc index 634b145..9ac7aa3 100644 --- a/proxy/http2/Http2ConnectionState.cc +++ b/proxy/http2/Http2ConnectionState.cc @@ -843,7 +843,7 @@ Http2ConnectionState::restart_streams() Http2Stream *s = stream_list.head; while (s) { Http2Stream *next = s->link.next; - if (s->get_fetcher() != NULL && min(this->client_rwnd, s->client_rwnd) > 0) { + if (min(this->client_rwnd, s->client_rwnd) > 0) { this->send_data_frame(s->get_fetcher()); } s = next; @@ -894,6 +894,10 @@ Http2ConnectionState::send_data_frame(FetchSM *fetch_sm) { DebugSsn(this->ua_session, "http2_cs", "[%" PRId64 "] Send DATA frame", this->ua_session->connection_id()); + if (fetch_sm == NULL) { + return; + } + size_t buf_len = BUFFER_SIZE_FOR_INDEX(buffer_size_index[HTTP2_FRAME_TYPE_DATA]) - HTTP2_FRAME_HEADER_LEN; uint8_t payload_buffer[buf_len];
