Assertion hit / crash in EventSource::abortConnectionAttempt()

Source/core/page/EventSource.cpp

 /*
  * Copyright (C) 2009, 2012 Ericsson AB. All rights reserved.
  * Copyright (C) 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011, Code Aurora Forum. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 45 matching lines @@
 namespace WebCore {
 
 const unsigned long long EventSource::defaultReconnectDelay = 3000;
 
 inline EventSource::EventSource(ExecutionContext* context, const KURL& url, const Dictionary& eventSourceInit)
     : ActiveDOMObject(context)
     , m_url(url)
     , m_withCredentials(false)
     , m_state(CONNECTING)
     , m_decoder(TextResourceDecoder::create("text/plain", "UTF-8"))
-    , m_reconnectTimer(this, &EventSource::reconnectTimerFired)
+    , m_connectTimer(this, &EventSource::connectTimerFired)
     , m_discardTrailingNewline(false)
     , m_requestInFlight(false)
     , m_reconnectDelay(defaultReconnectDelay)
 {
     ScriptWrappable::init(this);
     eventSourceInit.get("withCredentials", m_withCredentials);
 }
 
 PassRefPtr<EventSource> EventSource::create(ExecutionContext* context, const String& url, const Dictionary& eventSourceInit, ExceptionState& es)
 {
@@ skipping 16 matching lines @@
     }
     if (!shouldBypassMainWorldContentSecurityPolicy && !context->contentSecurityPolicy()->allowConnectToSource(fullURL)) {
         // We can safely expose the URL to JavaScript, as this exception is generate synchronously before any redirects take place.
         es.throwSecurityError("Refused to connect to '" + fullURL.elidedString() + "' because it violates the document's Content Security Policy.");
         return 0;
     }
 
     RefPtr<EventSource> source = adoptRef(new EventSource(context, fullURL, eventSourceInit));
 
     source->setPendingActivity(source.get());
-    source->connect();
+    source->scheduleInitialConnect();
     source->suspendIfNeeded();
 
     return source.release();
 }
 
 EventSource::~EventSource()
 {
     ASSERT(m_state == CLOSED);
     ASSERT(!m_requestInFlight);
 }
 
+void EventSource::scheduleInitialConnect()
+{
+    ASSERT(m_state == CONNECTING);
+    ASSERT(!m_requestInFlight);
+
+    m_connectTimer.startOneShot(0);
+}
+
 void EventSource::connect()
 {
     ASSERT(m_state == CONNECTING);
     ASSERT(!m_requestInFlight);
 
     ResourceRequest request(m_url);
     request.setHTTPMethod("GET");
     request.setHTTPHeaderField("Accept", "text/event-stream");
     request.setHTTPHeaderField("Cache-Control", "no-cache");
     if (!m_lastEventId.isEmpty())
@@ skipping 27 matching lines @@
 
     if (m_state != CLOSED)
         scheduleReconnect();
     else
         unsetPendingActivity(this);
 }
 
 void EventSource::scheduleReconnect()
 {
     m_state = CONNECTING;
-    m_reconnectTimer.startOneShot(m_reconnectDelay / 1000.0);
+    m_connectTimer.startOneShot(m_reconnectDelay / 1000.0);
     dispatchEvent(Event::create(EventTypeNames::error));
 }
 
-void EventSource::reconnectTimerFired(Timer<EventSource>*)
+void EventSource::connectTimerFired(Timer<EventSource>*)
 {
     connect();
 }
 
 String EventSource::url() const
 {
     return m_url.string();
 }
 
 bool EventSource::withCredentials() const
 {
     return m_withCredentials;
 }
 
 EventSource::State EventSource::readyState() const
 {
     return m_state;
 }
 
 void EventSource::close()
 {
     if (m_state == CLOSED) {
         ASSERT(!m_requestInFlight);
         return;
     }
 
     // Stop trying to reconnect if EventSource was explicitly closed or if ActiveDOMObject::stop() was called.
-    if (m_reconnectTimer.isActive()) {
-        m_reconnectTimer.stop();
+    if (m_connectTimer.isActive()) {
+        m_connectTimer.stop();
         unsetPendingActivity(this);
     }
 
     if (m_requestInFlight)
         m_loader->cancel();
 
     m_state = CLOSED;
 }
 
 const AtomicString& EventSource::interfaceName() const
@@ skipping 93 matching lines @@
 }
 
 void EventSource::didFailRedirectCheck()
 {
     abortConnectionAttempt();
 }
 
 void EventSource::abortConnectionAttempt()
 {
     ASSERT(m_state == CONNECTING);
-    ASSERT(m_requestInFlight);
 
-    m_loader->cancel();
+    if (m_requestInFlight) {
+        m_loader->cancel();
+    } else {
+        m_state = CLOSED;
+        unsetPendingActivity(this);
+    }
 
     ASSERT(m_state == CLOSED);
     dispatchEvent(Event::create(EventTypeNames::error));
 }
 
 void EventSource::parseEventStream()
 {
     unsigned int bufPos = 0;
     unsigned int bufSize = m_receiveBuf.size();
     while (bufPos < bufSize) {
@@ skipping 93 matching lines @@
 
 PassRefPtr<MessageEvent> EventSource::createMessageEvent()
 {
     RefPtr<MessageEvent> event = MessageEvent::create();
     event->initMessageEvent(m_eventName.isEmpty() ? EventTypeNames::message : AtomicString(m_eventName), false, false, SerializedScriptValue::create(String(m_data)), m_eventStreamOrigin, m_lastEventId, 0, nullptr);
     m_data.clear();
     return event.release();
 }
 
 } // namespace WebCore