Title: [184005] trunk/Source/WebCore
- Revision
- 184005
- Author
- [email protected]
- Date
- 2015-05-08 12:14:43 -0700 (Fri, 08 May 2015)
Log Message
Crashes in SocketStreamHandleBase::close
https://bugs.webkit.org/show_bug.cgi?id=144767
rdar://problem/20486538
Reviewed by Brady Eidson.
This is a speculative fix, I could not reproduce the crash.
* Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processFrame):
Normally, processOutgoingFrameQueue() closes the handle in the end when called in
OutgoingFrameQueueClosing state. But there is no definitive protection against
processing two CLOSE frames, in which case we'd try to close the handle twice.
* platform/network/cf/SocketStreamHandleCFNet.cpp:
(WebCore::SocketStreamHandle::readStreamCallback): Passing empty data to the client
results in the socket being closed, which makes no sense here.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (184004 => 184005)
--- trunk/Source/WebCore/ChangeLog 2015-05-08 19:07:01 UTC (rev 184004)
+++ trunk/Source/WebCore/ChangeLog 2015-05-08 19:14:43 UTC (rev 184005)
@@ -1,3 +1,22 @@
+2015-05-08 Alexey Proskuryakov <[email protected]>
+
+ Crashes in SocketStreamHandleBase::close
+ https://bugs.webkit.org/show_bug.cgi?id=144767
+ rdar://problem/20486538
+
+ Reviewed by Brady Eidson.
+
+ This is a speculative fix, I could not reproduce the crash.
+
+ * Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processFrame):
+ Normally, processOutgoingFrameQueue() closes the handle in the end when called in
+ OutgoingFrameQueueClosing state. But there is no definitive protection against
+ processing two CLOSE frames, in which case we'd try to close the handle twice.
+
+ * platform/network/cf/SocketStreamHandleCFNet.cpp:
+ (WebCore::SocketStreamHandle::readStreamCallback): Passing empty data to the client
+ results in the socket being closed, which makes no sense here.
+
2015-05-08 Commit Queue <[email protected]>
Unreviewed, rolling out r183996.
Modified: trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp (184004 => 184005)
--- trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp 2015-05-08 19:07:01 UTC (rev 184004)
+++ trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp 2015-05-08 19:14:43 UTC (rev 184005)
@@ -649,7 +649,8 @@
m_receivedClosingHandshake = true;
startClosingHandshake(m_closeEventCode, m_closeEventReason);
if (m_closing) {
- m_outgoingFrameQueueStatus = OutgoingFrameQueueClosing;
+ if (m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen)
+ m_outgoingFrameQueueStatus = OutgoingFrameQueueClosing;
processOutgoingFrameQueue();
}
break;
Modified: trunk/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp (184004 => 184005)
--- trunk/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp 2015-05-08 19:07:01 UTC (rev 184004)
+++ trunk/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp 2015-05-08 19:14:43 UTC (rev 184005)
@@ -507,6 +507,9 @@
ptr = localBuffer;
}
+ if (!length)
+ return;
+
m_client->didReceiveSocketStreamData(this, reinterpret_cast<const char*>(ptr), length);
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
