Add CHECK's to debug QuicStreamSequencerBuffer in weird state. Add a destruction indicator to detec…

net/quic/core/quic_stream_sequencer_buffer.cc

 // Copyright (c) 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/quic_stream_sequencer_buffer.h"
 
+#include "base/debug/stack_trace.h"
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "net/quic/core/quic_bug_tracker.h"
 #include "net/quic/core/quic_flags.h"
 
 using base::StringPrintf;
 using std::min;
 using std::string;
@@ skipping 26 matching lines @@
 
 QuicStreamSequencerBuffer::FrameInfo::FrameInfo(size_t length,
                                                 QuicTime timestamp)
     : length(length), timestamp(timestamp) {}
 
 QuicStreamSequencerBuffer::QuicStreamSequencerBuffer(size_t max_capacity_bytes)
     : max_buffer_capacity_bytes_(max_capacity_bytes),
       blocks_count_(
           ceil(static_cast<double>(max_capacity_bytes) / kBlockSizeBytes)),
       total_bytes_read_(0),
-      blocks_(nullptr) {
+      blocks_(nullptr),
+      destruction_indicator_(123456) {
+  CHECK(blocks_count_ > 1) << "blocks_count_ = " << blocks_count_

[Ryan Hamilton, 2016/11/23 20:42:40]

nit: CHECK_GT()

[danzh1, 2016/11/23 21:39:24]

Done.

+                           << ", max_buffer_capacity_bytes_ = "
+                           << max_buffer_capacity_bytes_;
   Clear();
 }
 
 QuicStreamSequencerBuffer::~QuicStreamSequencerBuffer() {
   Clear();
+  destruction_indicator_ = 654321;
 }
 
 void QuicStreamSequencerBuffer::Clear() {
   if (blocks_ != nullptr) {
     for (size_t i = 0; i < blocks_count_; ++i) {
       if (blocks_[i] != nullptr) {
         RetireBlock(i);
       }
     }
   }
@@ skipping 16 matching lines @@
   DVLOG(1) << "Retired block with index: " << idx;
   return true;
 }
 
 QuicErrorCode QuicStreamSequencerBuffer::OnStreamData(
     QuicStreamOffset starting_offset,
     base::StringPiece data,
     QuicTime timestamp,
     size_t* const bytes_buffered,
     std::string* error_details) {
+  CHECK_EQ(destruction_indicator_, 123456) << "This object has been destructed";
   *bytes_buffered = 0;
   QuicStreamOffset offset = starting_offset;
   size_t size = data.size();
   if (size == 0) {
     *error_details = "Received empty stream frame without FIN.";
     return QUIC_EMPTY_STREAM_FRAME_NO_FIN;
   }
 
   // Find the first gap not ending before |offset|. This gap maybe the gap to
   // fill if the arriving frame doesn't overlaps with previous ones.
@@ skipping 161 matching lines @@
                  start_offset + bytes_written) {
     // This gap has been filled with new data. So it's no longer a gap.
     gaps_.erase(gap_with_new_data_written);
   }
 }
 
 QuicErrorCode QuicStreamSequencerBuffer::Readv(const iovec* dest_iov,
                                                size_t dest_count,
                                                size_t* bytes_read,
                                                string* error_details) {
+  CHECK_EQ(destruction_indicator_, 123456) << "This object has been destructed";
+
   *bytes_read = 0;
   for (size_t i = 0; i < dest_count && ReadableBytes() > 0; ++i) {
     char* dest = reinterpret_cast<char*>(dest_iov[i].iov_base);
+    CHECK_NE(dest, nullptr);
     size_t dest_remaining = dest_iov[i].iov_len;
     while (dest_remaining > 0 && ReadableBytes() > 0) {
       size_t block_idx = NextBlockToRead();
       size_t start_offset_in_block = ReadOffset();
       size_t block_capacity = GetBlockCapacity(block_idx);
       size_t bytes_available_in_block =
           min<size_t>(ReadableBytes(), block_capacity - start_offset_in_block);
       size_t bytes_to_copy =
           min<size_t>(bytes_available_in_block, dest_remaining);
       DCHECK_GT(bytes_to_copy, 0UL);
       if (blocks_[block_idx] == nullptr || dest == nullptr) {
         *error_details = StringPrintf(
             "QuicStreamSequencerBuffer error:"
             " Readv() dest == nullptr: %s"
-            " blocks_[%" PRIuS "] == nullptr: %s",
+            " blocks_[%" PRIuS "] == nullptr: %s, stack trace %s",
             (dest == nullptr ? "true" : "false"), block_idx,
-            (blocks_[block_idx] == nullptr ? "true" : "false"));
+            (blocks_[block_idx] == nullptr ? "true" : "false"),
+            base::debug::StackTrace().ToString().c_str());

[Ryan Hamilton, 2016/11/23 20:42:40]

I'm not sure that sending stack traces to google is something we're allowed to
do from a privacy perspective.

[danzh1, 2016/11/23 21:39:24]

removed as I switch to crashing right above.

         return QUIC_STREAM_SEQUENCER_INVALID_STATE;
       }
       memcpy(dest, blocks_[block_idx]->buffer + start_offset_in_block,
              bytes_to_copy);
       dest += bytes_to_copy;
       dest_remaining -= bytes_to_copy;
       num_bytes_buffered_ -= bytes_to_copy;
       total_bytes_read_ += bytes_to_copy;
       *bytes_read += bytes_to_copy;
 
@@ skipping 16 matching lines @@
   }
 
   if (*bytes_read > 0) {
     UpdateFrameArrivalMap(total_bytes_read_);
   }
   return QUIC_NO_ERROR;
 }
 
 int QuicStreamSequencerBuffer::GetReadableRegions(struct iovec* iov,
                                                   int iov_count) const {
+  CHECK_EQ(destruction_indicator_, 123456) << "This object has been destructed";
+
   DCHECK(iov != nullptr);
   DCHECK_GT(iov_count, 0);
 
   if (ReadableBytes() == 0) {
     iov[0].iov_base = nullptr;
     iov[0].iov_len = 0;
     return 0;
   }
 
   size_t start_block_idx = NextBlockToRead();
@@ skipping 38 matching lines @@
     iov[iov_used].iov_base = blocks_[end_block_idx]->buffer;
     iov[iov_used].iov_len = end_block_offset + 1;
     DVLOG(1) << "Got last block with index: " << end_block_idx;
     ++iov_used;
   }
   return iov_used;
 }
 
 bool QuicStreamSequencerBuffer::GetReadableRegion(iovec* iov,
                                                   QuicTime* timestamp) const {
+  CHECK_EQ(destruction_indicator_, 123456) << "This object has been destructed";
+
   if (ReadableBytes() == 0) {
     iov[0].iov_base = nullptr;
     iov[0].iov_len = 0;
     return false;
   }
 
   size_t start_block_idx = NextBlockToRead();
   iov->iov_base = blocks_[start_block_idx]->buffer + ReadOffset();
   size_t readable_bytes_in_block = min<size_t>(
       GetBlockCapacity(start_block_idx) - ReadOffset(), ReadableBytes());
@@ skipping 18 matching lines @@
     // If encountered the end of readable bytes before reaching a different
     // timestamp.
     DVLOG(1) << "Got all readable bytes in first block.";
     region_len = readable_bytes_in_block;
   }
   iov->iov_len = region_len;
   return true;
 }
 
 bool QuicStreamSequencerBuffer::MarkConsumed(size_t bytes_used) {
+  CHECK_EQ(destruction_indicator_, 123456) << "This object has been destructed";
+
   if (bytes_used > ReadableBytes()) {
     return false;
   }
   size_t bytes_to_consume = bytes_used;
   while (bytes_to_consume > 0) {
     size_t block_idx = NextBlockToRead();
     size_t offset_in_block = ReadOffset();
     size_t bytes_available = min<size_t>(
         ReadableBytes(), GetBlockCapacity(block_idx) - offset_in_block);
     size_t bytes_read = min<size_t>(bytes_to_consume, bytes_available);
@@ skipping 144 matching lines @@
     QuicStreamOffset current_frame_end_offset =
         it.second.length + current_frame_begin_offset;
     current_frames_string = string(StringPrintf(
         "%s[%" PRIu64 ", %" PRIu64 ") ", current_frames_string.c_str(),
         current_frame_begin_offset, current_frame_end_offset));
   }
   return current_frames_string;
 }
 
 }  //  namespace net