From 0a94a75f6059c63897a56070d408e3641a0be768 Mon Sep 17 00:00:00 2001
From: Patrick McManus <mcmanus>
Date: Fri, 6 Jun 2014 11:18:00 -0400
Subject: [PATCH] bug 1021396 - duplicate spdy syn_stream can hang necko thread
 r=hurley

bug 1021396 - duplicate spdy syn_stream can hang necko thread r=hurley

--HG--
extra : rebase_source : caf1ad18fced8e9c7ef78c1eccbfb2dec2d6181c
---
 netwerk/protocol/http/SpdyStream3.cpp  | 17 +++++++++++------
 netwerk/protocol/http/SpdyStream31.cpp | 17 +++++++++++------
 2 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/netwerk/protocol/http/SpdyStream3.cpp b/netwerk/protocol/http/SpdyStream3.cpp
index efc2b3e06668..3599ec2f0cba 100644
--- a/netwerk/protocol/http/SpdyStream3.cpp
+++ b/netwerk/protocol/http/SpdyStream3.cpp
@@ -1031,6 +1031,10 @@ SpdyStream3::Uncompress(z_stream *context,
                         char *blockStart,
                         uint32_t blockLen)
 {
+  // ensure the minimum size
+  EnsureBuffer(mDecompressBuffer, SpdySession3::kDefaultBufferSize,
+               mDecompressBufferUsed, mDecompressBufferSize);
+
   mDecompressedBytes += blockLen;
 
   context->avail_in = blockLen;
@@ -1043,22 +1047,23 @@ SpdyStream3::Uncompress(z_stream *context,
       mDecompressBufferUsed;
     context->avail_out = mDecompressBufferSize - mDecompressBufferUsed;
     int zlib_rv = inflate(context, Z_NO_FLUSH);
+    LOG3(("SpdyStream3::Uncompress %p zlib_rv %d\n", this, zlib_rv));
 
     if (zlib_rv == Z_NEED_DICT) {
       if (triedDictionary) {
-        LOG3(("SpdySession3::Uncompress %p Dictionary Error\n", this));
+        LOG3(("SpdyStream3::Uncompress %p Dictionary Error\n", this));
         return NS_ERROR_ILLEGAL_VALUE;
       }
 
       triedDictionary = true;
       inflateSetDictionary(context, kDictionary, sizeof(kDictionary));
-    }
-
-    if (zlib_rv == Z_DATA_ERROR)
+    } else if (zlib_rv == Z_DATA_ERROR) {
+      LOG3(("SpdyStream3::Uncompress %p inflate returned data err\n", this));
       return NS_ERROR_ILLEGAL_VALUE;
-
-    if (zlib_rv == Z_MEM_ERROR)
+    } else  if (zlib_rv < Z_OK) { // probably Z_MEM_ERROR
+      LOG3(("SpdyStream3::Uncompress %p inflate returned %d\n", this, zlib_rv));
       return NS_ERROR_FAILURE;
+    }
 
     // zlib's inflate() decreases context->avail_out by the amount it places
     // in the output buffer
diff --git a/netwerk/protocol/http/SpdyStream31.cpp b/netwerk/protocol/http/SpdyStream31.cpp
index f8a32c8f2943..ad1a9264a6f4 100644
--- a/netwerk/protocol/http/SpdyStream31.cpp
+++ b/netwerk/protocol/http/SpdyStream31.cpp
@@ -1047,6 +1047,10 @@ SpdyStream31::Uncompress(z_stream *context,
                          char *blockStart,
                          uint32_t blockLen)
 {
+  // ensure the minimum size
+  EnsureBuffer(mDecompressBuffer, SpdySession31::kDefaultBufferSize,
+               mDecompressBufferUsed, mDecompressBufferSize);
+
   mDecompressedBytes += blockLen;
 
   context->avail_in = blockLen;
@@ -1059,22 +1063,23 @@ SpdyStream31::Uncompress(z_stream *context,
       mDecompressBufferUsed;
     context->avail_out = mDecompressBufferSize - mDecompressBufferUsed;
     int zlib_rv = inflate(context, Z_NO_FLUSH);
+    LOG3(("SpdyStream31::Uncompress %p zlib_rv %d\n", this, zlib_rv));
 
     if (zlib_rv == Z_NEED_DICT) {
       if (triedDictionary) {
-        LOG3(("SpdySession31::Uncompress %p Dictionary Error\n", this));
+        LOG3(("SpdyStream31::Uncompress %p Dictionary Error\n", this));
         return NS_ERROR_ILLEGAL_VALUE;
       }
 
       triedDictionary = true;
       inflateSetDictionary(context, kDictionary, sizeof(kDictionary));
-    }
-
-    if (zlib_rv == Z_DATA_ERROR)
+    } else if (zlib_rv == Z_DATA_ERROR) {
+      LOG3(("SpdyStream31::Uncompress %p inflate returned data err\n", this));
       return NS_ERROR_ILLEGAL_VALUE;
-
-    if (zlib_rv == Z_MEM_ERROR)
+    } else  if (zlib_rv < Z_OK) { // probably Z_MEM_ERROR
+      LOG3(("SpdyStream31::Uncompress %p inflate returned %d\n", this, zlib_rv));
       return NS_ERROR_FAILURE;
+    }
 
     // zlib's inflate() decreases context->avail_out by the amount it places
     // in the output buffer