Bugzilla bug #29908: make sure that md.write.thread or md.read.thread is

nil when we return from SendReceiveStream so that we don't leave a
dangling reference for the OT notifier routine.  This patch is submitted
by Gordon Sheridon <gordon@netscape.com>.  r=wtc@netscape.com
a=jar@netscape.com.  (NSPRPUB_CLIENT_BRANCH)

1 files changed, 9 insertions, 5 deletions

diff --git a/pr/src/md/mac/macsockotpt.c b/pr/src/md/mac/macsockotpt.c
index 7b6e4441..f408d845 100644
--- a/pr/src/md/mac/macsockotpt.c
+++ b/pr/src/md/mac/macsockotpt.c
@@ -1350,6 +1350,7 @@ static PRInt32 SendReceiveStream(PRFileDesc *fd, void *buf, PRInt32 amount,
     PRInt32 bytesLeft = amount;
 
     PR_ASSERT(flags == 0);
+    PR_ASSERT(opCode == kSTREAM_SEND || opCode == kSTREAM_RECEIVE);
     
     if (endpoint == NULL) {
         err = kEBADFErr;
@@ -1361,11 +1362,6 @@ static PRInt32 SendReceiveStream(PRFileDesc *fd, void *buf, PRInt32 amount,
         goto ErrorExit;
     }
     
-    if (opCode != kSTREAM_SEND && opCode != kSTREAM_RECEIVE) {
-        err = kEINVALErr;
-        goto ErrorExit;
-    }
-        
     while (bytesLeft > 0) {
     
         PrepareForAsyncCompletion(me, fd->secret->md.osfd);    
@@ -1434,6 +1430,10 @@ static PRInt32 SendReceiveStream(PRFileDesc *fd, void *buf, PRInt32 amount,
         }
 
 		me->io_pending = PR_FALSE;
+        if (opCode == kSTREAM_SEND)
+            fd->secret->md.write.thread = nil;
+        else
+            fd->secret->md.read.thread  = nil;
 
         if (result > 0) {
             buf = (void *) ( (UInt32) buf + (UInt32)result );
@@ -1471,9 +1471,13 @@ static PRInt32 SendReceiveStream(PRFileDesc *fd, void *buf, PRInt32 amount,
 		}
     }
 
+    PR_ASSERT(opCode == kSTREAM_SEND ? fd->secret->md.write.thread == nil :
+                                       fd->secret->md.read.thread  == nil);
     return amount;
 
 ErrorExit:
+    PR_ASSERT(opCode == kSTREAM_SEND ? fd->secret->md.write.thread == nil :
+                                       fd->secret->md.read.thread  == nil);
     macsock_map_error(err);
     return -1;
 }