From 55b31f6e979293a90d2626e2bafe50982a98069c Mon Sep 17 00:00:00 2001
From: Ethan Tseng <ettseng@mozilla.com>
Date: Mon, 16 Feb 2015 12:37:09 +0800
Subject: [PATCH] Bug 1117486 - [FFOS2.0][Woodduck] System crash by replaying
 the same RTSP clip several times. r=bechen

---
 .../rtsp/rtsp/RTSPConnectionHandler.h         | 13 ++++++----
 netwerk/protocol/rtsp/rtsp/RTSPSource.cpp     | 26 +++++++++++++++++++
 netwerk/protocol/rtsp/rtsp/RTSPSource.h       |  2 ++
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/netwerk/protocol/rtsp/rtsp/RTSPConnectionHandler.h b/netwerk/protocol/rtsp/rtsp/RTSPConnectionHandler.h
index e585d488429d..20a09414d365 100644
--- a/netwerk/protocol/rtsp/rtsp/RTSPConnectionHandler.h
+++ b/netwerk/protocol/rtsp/rtsp/RTSPConnectionHandler.h
@@ -1104,6 +1104,11 @@ struct RtspConnectionHandler : public AHandler {
 
             case kWhatSeek1:
             {
+                if (mAborted || !mSeekPending) {
+                    LOGV("We're aborted, dropping stale packet.");
+                    break;
+                }
+
                 // Session is paused now.
                 for (size_t i = 0; i < mTracks.size(); ++i) {
                     TrackInfo *info = &mTracks.editItemAt(i);
@@ -1136,16 +1141,14 @@ struct RtspConnectionHandler : public AHandler {
 
             case kWhatSeek2:
             {
-                CHECK(mSeekPending);
-
                 int32_t result;
                 CHECK(msg->findInt32("result", &result));
 
                 LOGI("PLAY completed with result %d (%s)",
                      result, strerror(-result));
-                if (mAborted) {
-                  LOGV("we're aborted, dropping stale packet.");
-                  break;
+                if (mAborted || !mSeekPending) {
+                    LOGV("We're aborted, dropping stale packet.");
+                    break;
                 }
 
                 for (size_t i = 0; i < mTracks.size(); i++) {
diff --git a/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp b/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
index bfb3e8d5e359..b91481aa273d 100644
--- a/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
+++ b/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
@@ -425,6 +425,10 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatAccessUnitComplete:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping access unit.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -481,6 +485,10 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatEOS:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping end-of-stream message.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -501,6 +509,10 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatSeekDiscontinuity:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping seek discontinuity message.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -521,6 +533,11 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatNormalPlayTimeMapping:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping normal play time mapping "
+                     "message.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -771,6 +788,15 @@ void RTSPSource::onTrackEndOfStream(size_t trackIndex)
     mListener->OnMediaDataAvailable(trackIndex, data, data.Length(), 0, meta.get());
 }
 
+inline bool RTSPSource::isValidState()
+{
+    if (mState == DISCONNECTED || mTracks.size() == 0) {
+        return false;
+    }
+    return true;
+}
+
+
 
 bool RTSPSource::isLiveStream() {
     int64_t duration = 0;
diff --git a/netwerk/protocol/rtsp/rtsp/RTSPSource.h b/netwerk/protocol/rtsp/rtsp/RTSPSource.h
index 6f79f0f63ccf..c716433df341 100644
--- a/netwerk/protocol/rtsp/rtsp/RTSPSource.h
+++ b/netwerk/protocol/rtsp/rtsp/RTSPSource.h
@@ -152,6 +152,8 @@ private:
 
     void onTrackEndOfStream(size_t trackIndex);
 
+    inline bool isValidState();
+
     bool isLiveStream();
 
     // This flag is set if we have just disconnected