Bug 814761 - Part 1/2: fix ril worker exception due to buffer overwritten, r=yoshi
authorVicamo Yang <vyang@mozilla.com>
Mon, 10 Dec 2012 14:19:38 +0800
changeset 124570 4130f20282defdcdc61c2a8c5fc2041396f5fe4c
parent 124569 b30a1fff2d0758a6e69bbac0d87707444349b860
child 124571 957e9d5fe527d6bea6d141bc1864f42b443c51de
push id2151
push userlsblakk@mozilla.com
push dateTue, 19 Feb 2013 18:06:57 +0000
treeherdermozilla-beta@4952e88741ec [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyoshi
bugs814761
milestone20.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 814761 - Part 1/2: fix ril worker exception due to buffer overwritten, r=yoshi
dom/system/gonk/ril_worker.js
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -473,18 +473,19 @@ let Buf = {
    * @param incoming
    *        Uint8Array containing the incoming data.
    */
   writeToIncoming: function writeToIncoming(incoming) {
     // We don't have to worry about the head catching the tail since
     // we process any backlog in parcels immediately, before writing
     // new data to the buffer. So the only edge case we need to handle
     // is when the incoming data is larger than the buffer size.
-    if (incoming.length > this.INCOMING_BUFFER_LENGTH) {
-      this.growIncomingBuffer(incoming.length);
+    let minMustAvailableSize = incoming.length + this.readIncoming;
+    if (minMustAvailableSize > this.INCOMING_BUFFER_LENGTH) {
+      this.growIncomingBuffer(minMustAvailableSize);
     }
 
     // We can let the typed arrays do the copying if the incoming data won't
     // wrap around the edges of the circular buffer.
     let remaining = this.INCOMING_BUFFER_LENGTH - this.incomingWriteIndex;
     if (remaining >= incoming.length) {
       this.incomingBytes.set(incoming, this.incomingWriteIndex);
     } else {
@@ -583,16 +584,23 @@ let Buf = {
     let response_type = this.readUint32();
 
     let request_type, options;
     if (response_type == RESPONSE_TYPE_SOLICITED) {
       let token = this.readUint32();
       let error = this.readUint32();
 
       options = this.tokenRequestMap[token];
+      if (!options) {
+        if (DEBUG) {
+          debug("Suspicious uninvited request found: " + token + ". Ignored!");
+        }
+        return;
+      }
+
       delete this.tokenRequestMap[token];
       request_type = options.rilRequestType;
 
       options.rilRequestError = error;
       if (DEBUG) {
         debug("Solicited response for request type " + request_type +
               ", token " + token + ", error " + error);
       }