Bug 144767 - Crashes in SocketStreamHandleBase::close
Summary: Crashes in SocketStreamHandleBase::close
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2015-05-07 15:20 PDT by Alexey Proskuryakov
Modified: 2015-05-08 12:16 PDT (History)
0 users

See Also:

Attachments
proposed fix (2.57 KB, patch)
2015-05-07 17:27 PDT, Alexey Proskuryakov 		beidson: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2015-05-07 15:20:02 PDT 
We have crash reports where SocketStreamHandleBase::close() is called on a null object while processing a CLOSE frame from the server.

Thread 0 Crashed:
0   WebCore                       	0x37daf446 WebCore::SocketStreamHandleBase::close() + 6 (SocketStreamHandleBase.cpp:86)
1   WebCore                       	0x37ee75b2 WebCore::WebSocketChannel::processOutgoingFrameQueue() + 554 (WebSocketChannel.cpp:775)
2   WebCore                       	0x37ee949a WebCore::WebSocketChannel::processFrame() + 3282 (WebSocketChannel.cpp:660)
3   WebCore                       	0x37ee8268 WebCore::WebSocketChannel::processBuffer() + 64 (WebSocketChannel.cpp:449)
4   WebCore                       	0x37ee8218 WebCore::WebSocketChannel::didReceiveSocketStreamData(WebCore::SocketStreamHandle*, char const*, int) + 172 (WebSocketChannel.cpp:312)

rdar://problem/20486538
Comment 1 Alexey Proskuryakov 2015-05-07 17:27:16 PDT 
Created attachment 252659 [details]
proposed fix
Comment 2 Alexey Proskuryakov 2015-05-08 12:16:20 PDT 
Committed <http://trac.webkit.org/r184005>.