<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[165886] releases/WebKitGTK/webkit-2.2/Source/WebKit2</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/165886">165886</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2014-03-19 02:47:22 -0700 (Wed, 19 Mar 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/165812">r165812</a> - [GTK] Race condition when the socket event source is cancelled
https://bugs.webkit.org/show_bug.cgi?id=130395
Reviewed by Martin Robinson.
In some cases when the socket event source is cancelled the socket
event source callback is called with the condition of the previous
poll instead of 0. This can happen sometimes when the source is
cancelled from the socket event source callback. Once the socket
event source is cancelled, it's dispatched by glib without
polling, so the condition is never reset again and the callback is
called again and again with the previous condition. When the
condition is G_IO_IN, the source is re-scheduled entering into an
infinite loop. We should always check if the source has been
cancelled at the beginning of the callback to destroy the source
instead of relying on the condition being 0.
* Platform/gtk/WorkQueueGtk.cpp:
(WorkQueue::SocketEventSource::isCancelled):
(WorkQueue::SocketEventSource::eventCallback):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit22SourceWebKit2ChangeLog">releases/WebKitGTK/webkit-2.2/Source/WebKit2/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit22SourceWebKit2PlatformgtkWorkQueueGtkcpp">releases/WebKitGTK/webkit-2.2/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit22SourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.2/Source/WebKit2/ChangeLog (165885 => 165886)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.2/Source/WebKit2/ChangeLog 2014-03-19 09:40:27 UTC (rev 165885)
+++ releases/WebKitGTK/webkit-2.2/Source/WebKit2/ChangeLog 2014-03-19 09:47:22 UTC (rev 165886)
</span><span class="lines">@@ -1,3 +1,26 @@
</span><ins>+2014-03-18 Carlos Garcia Campos <cgarcia@igalia.com>
+
+ [GTK] Race condition when the socket event source is cancelled
+ https://bugs.webkit.org/show_bug.cgi?id=130395
+
+ Reviewed by Martin Robinson.
+
+ In some cases when the socket event source is cancelled the socket
+ event source callback is called with the condition of the previous
+ poll instead of 0. This can happen sometimes when the source is
+ cancelled from the socket event source callback. Once the socket
+ event source is cancelled, it's dispatched by glib without
+ polling, so the condition is never reset again and the callback is
+ called again and again with the previous condition. When the
+ condition is G_IO_IN, the source is re-scheduled entering into an
+ infinite loop. We should always check if the source has been
+ cancelled at the beginning of the callback to destroy the source
+ instead of relying on the condition being 0.
+
+ * Platform/gtk/WorkQueueGtk.cpp:
+ (WorkQueue::SocketEventSource::isCancelled):
+ (WorkQueue::SocketEventSource::eventCallback):
+
</ins><span class="cx"> 2014-03-13 Carlos Garcia Campos <cgarcia@igalia.com>
</span><span class="cx">
</span><span class="cx"> [GTK] Close the connection when we fail to read from the socket for any unhandled error
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit22SourceWebKit2PlatformgtkWorkQueueGtkcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.2/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp (165885 => 165886)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.2/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp 2014-03-19 09:40:27 UTC (rev 165885)
+++ releases/WebKitGTK/webkit-2.2/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp 2014-03-19 09:47:22 UTC (rev 165886)
</span><span class="lines">@@ -100,11 +100,21 @@
</span><span class="cx"> return condition & m_condition;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static gboolean eventCallback(GSocket* socket, GIOCondition condition, SocketEventSource* eventSource)
</del><ins>+ bool isCancelled() const
</ins><span class="cx"> {
</span><ins>+ return g_cancellable_is_cancelled(m_cancellable);
+ }
+
+ static gboolean eventCallback(GSocket*, GIOCondition condition, SocketEventSource* eventSource)
+ {
</ins><span class="cx"> ASSERT(eventSource);
</span><span class="cx">
</span><del>- if (condition & G_IO_HUP || condition & G_IO_ERR) {
</del><ins>+ if (eventSource->isCancelled()) {
+ // EventSource has been cancelled, return FALSE to destroy the source.
+ return FALSE;
+ }
+
+ if (condition & G_IO_HUP || condition & G_IO_ERR || condition & G_IO_NVAL) {
</ins><span class="cx"> eventSource->didClose();
</span><span class="cx"> return FALSE;
</span><span class="cx"> }
</span><span class="lines">@@ -114,7 +124,7 @@
</span><span class="cx"> return TRUE;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // EventSource has been cancelled, return FALSE to destroy the source.
</del><ins>+ ASSERT_NOT_REACHED();
</ins><span class="cx"> return FALSE;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>