NewWebSocketChannel sends a message endlessly

Source/modules/websockets/NewWebSocketChannelImpl.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 284 matching lines @@
     ASSERT(m_handle);
     unsigned long bufferedAmount = m_bufferedAmount;
     while (!m_messages.isEmpty() && m_sendingQuota > 0 && !m_blobLoader) {
         bool final = false;
         const Message& message = m_messages.first();
         switch (message.type) {
         case MessageTypeText: {
             WebSocketHandle::MessageType type =
                 m_sentSizeOfTopMessage ? WebSocketHandle::MessageTypeContinuation : WebSocketHandle::MessageTypeText;
             size_t size = std::min(static_cast<size_t>(m_sendingQuota), message.text.length() - m_sentSizeOfTopMessage);
-            final = (static_cast<size_t>(m_sendingQuota) == size);
+            final = (m_sentSizeOfTopMessage + size == message.text.length());
             m_handle->send(final, type, message.text.data() + m_sentSizeOfTopMessage, size);
             m_sentSizeOfTopMessage += size;
             m_sendingQuota -= size;
             break;
         }
         case MessageTypeBlob:
             ASSERT(!m_blobLoader);
             m_blobLoader = adoptPtr(new BlobLoader(message.blobDataHandle, this));
             break;
         case MessageTypeArrayBuffer: {
             WebSocketHandle::MessageType type =
                 m_sentSizeOfTopMessage ? WebSocketHandle::MessageTypeContinuation : WebSocketHandle::MessageTypeBinary;
             size_t size = std::min(static_cast<size_t>(m_sendingQuota), message.arrayBuffer->byteLength() - m_sentSizeOfTopMessage);
-            final = (static_cast<size_t>(m_sendingQuota) == size);
+            final = (m_sentSizeOfTopMessage + size == message.arrayBuffer->byteLength());
             m_handle->send(final, type, static_cast<const char*>(message.arrayBuffer->data()) + m_sentSizeOfTopMessage, size);
             m_sentSizeOfTopMessage += size;
             m_sendingQuota -= size;
             break;
         }
         }
         if (final) {
             m_messages.removeFirst();
             m_sentSizeOfTopMessage = 0;
         }
@@ skipping 146 matching lines @@
     if (errorCode == FileError::ABORT_ERR) {
         // The error is caused by cancel().
         return;
     }
     // FIXME: Generate human-friendly reason message.
     failAsError("Failed to load Blob: error code = " + String::number(errorCode));
     // |this| can be deleted here.
 }
 
 } // namespace WebCore