Title: [184186] releases/WebKitGTK/webkit-2.8/Source/WebCore
- Revision
- 184186
- Author
- [email protected]
- Date
- 2015-05-12 02:17:02 -0700 (Tue, 12 May 2015)
Log Message
Merge r184005 - Crashes in SocketStreamHandleBase::close
https://bugs.webkit.org/show_bug.cgi?id=144767
rdar://problem/20486538
Reviewed by Brady Eidson.
This is a speculative fix, I could not reproduce the crash.
* Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processFrame):
Normally, processOutgoingFrameQueue() closes the handle in the end when called in
OutgoingFrameQueueClosing state. But there is no definitive protection against
processing two CLOSE frames, in which case we'd try to close the handle twice.
* platform/network/cf/SocketStreamHandleCFNet.cpp:
(WebCore::SocketStreamHandle::readStreamCallback): Passing empty data to the client
results in the socket being closed, which makes no sense here.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184185 => 184186)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 09:16:10 UTC (rev 184185)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 09:17:02 UTC (rev 184186)
@@ -1,3 +1,22 @@
+2015-05-08 Alexey Proskuryakov <[email protected]>
+
+ Crashes in SocketStreamHandleBase::close
+ https://bugs.webkit.org/show_bug.cgi?id=144767
+ rdar://problem/20486538
+
+ Reviewed by Brady Eidson.
+
+ This is a speculative fix, I could not reproduce the crash.
+
+ * Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processFrame):
+ Normally, processOutgoingFrameQueue() closes the handle in the end when called in
+ OutgoingFrameQueueClosing state. But there is no definitive protection against
+ processing two CLOSE frames, in which case we'd try to close the handle twice.
+
+ * platform/network/cf/SocketStreamHandleCFNet.cpp:
+ (WebCore::SocketStreamHandle::readStreamCallback): Passing empty data to the client
+ results in the socket being closed, which makes no sense here.
+
2015-05-07 Zalan Bujtas <[email protected]>
REGRESSION (r164449): Subpixel rendering: http://www.apple.com/iphone-6/ "Faster wireless." image displays vertical black line on 1x displays at specific window width.
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/Modules/websockets/WebSocketChannel.cpp (184185 => 184186)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/Modules/websockets/WebSocketChannel.cpp 2015-05-12 09:16:10 UTC (rev 184185)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/Modules/websockets/WebSocketChannel.cpp 2015-05-12 09:17:02 UTC (rev 184186)
@@ -651,7 +651,8 @@
m_receivedClosingHandshake = true;
startClosingHandshake(m_closeEventCode, m_closeEventReason);
if (m_closing) {
- m_outgoingFrameQueueStatus = OutgoingFrameQueueClosing;
+ if (m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen)
+ m_outgoingFrameQueueStatus = OutgoingFrameQueueClosing;
processOutgoingFrameQueue();
}
break;
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp (184185 => 184186)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp 2015-05-12 09:16:10 UTC (rev 184185)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp 2015-05-12 09:17:02 UTC (rev 184186)
@@ -507,6 +507,9 @@
ptr = localBuffer;
}
+ if (!length)
+ return;
+
m_client->didReceiveSocketStreamData(this, reinterpret_cast<const char*>(ptr), length);
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
