Merge WebKit at r63173 : Initial merge by git.

Change-Id: Ife5af0c7c6261fbbc8ae6bc08c390efa9ef10b44

2 files changed, 10 insertions, 3 deletions

diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 561b821..91761fb 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -179,7 +179,10 @@ void WebSocket::close()
         return;
     m_state = CLOSED;
     m_bufferedAmountAfterClose = m_channel->bufferedAmount();
-    m_channel->close();
+    // didClose notification may be already queued, which we will inadvertently process while waiting for bufferedAmount() to return.
+    // In this case m_channel will be set to null during didClose() call, thus we need to test validness of m_channel here.
+    if (m_channel)
+        m_channel->close();
 }
 
 const KURL& WebSocket::url() const
diff --git a/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp b/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
index f8d1230..fd82591 100644
--- a/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -300,6 +300,7 @@ bool WorkerThreadableWebSocketChannel::Bridge::send(const String& message)
     ASSERT(m_peer);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSend, m_peer, message));
+    RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
     return clientWrapper && clientWrapper->sent();
@@ -321,6 +322,7 @@ unsigned long WorkerThreadableWebSocketChannel::Bridge::bufferedAmount()
     ASSERT(m_peer);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadBufferedAmount, m_peer));
+    RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
     if (clientWrapper)
@@ -404,6 +406,8 @@ void WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted()
     m_workerClientWrapper->clearSyncMethodDone();
 }
 
+// Caller of this function should hold a reference to the bridge, because this function may call WebSocket::didClose() in the end,
+// which causes the bridge to get disconnected from the WebSocket and deleted if there is no other reference.
 void WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion()
 {
     if (!m_workerContext)
@@ -411,8 +415,8 @@ void WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion()
     WorkerRunLoop& runLoop = m_workerContext->thread()->runLoop();
     MessageQueueWaitResult result = MessageQueueMessageReceived;
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    while (clientWrapper && !clientWrapper->syncMethodDone() && result != MessageQueueTerminated) {
-        result = runLoop.runInMode(m_workerContext.get(), m_taskMode);
+    while (m_workerContext && clientWrapper && !clientWrapper->syncMethodDone() && result != MessageQueueTerminated) {
+        result = runLoop.runInMode(m_workerContext.get(), m_taskMode); // May cause this bridge to get disconnected, which makes m_workerContext become null.
         clientWrapper = m_workerClientWrapper.get();
     }
 }